Kleven

Privacy policy

Last updated 1 October 2026. This policy explains how Kleven, an editorial project operating from Jakarta, handles information when you read the site, contact the editorial desk, or interact with its cookie controls. It applies to kleven pages, forms, and related communications. It does not apply to third-party websites linked from our articles. For example, if you follow a link from an article to a public health resource or a research journal, that destination site's own privacy notice governs your visit rather than this policy. This document is written with reference to Indonesia's Personal Data Protection Law (Undang-Undang No. 27 of 2022, "UU PDP") and with general principles of purpose limitation, data minimisation, and accountability. Where a term used here is not separately defined, it carries the meaning given to it under that law or under ordinary English usage. We review this policy at least once a year, and more often if our tools, forms, or hosting arrangements change in a way that affects how information is handled.

1. Scope and controller

Kleven is responsible for the editorial website and can be contacted at Jl. Thamrin No. 8, Kebon Melati, Tanah Abang, Jakarta Pusat, DKI Jakarta 10230, Indonesia, or +62 811 2783 6059. We collect only information needed to operate, secure, improve, and respond to the service. We do not buy personal profiles or use health content to make individual decisions. For the purposes of applicable data protection law, Kleven acts as the data controller for information submitted directly to the editorial desk, meaning we decide the purpose and means of processing that information. For example, when you submit the contact form, Kleven determines that the message will be used only to answer your query and improve article accuracy, not for an unrelated purpose such as building a marketing list. Requests relating to this policy can be addressed to the editorial desk using the contact details above, quoting the words "privacy enquiry" so the message is routed correctly. If a dedicated privacy contact is introduced in the future, it will be published on this page before it is used operationally.

  • a) General reader questions about an article are handled by the editorial desk, not treated as a formal data request.
  • b) A formal access, correction, or deletion request is logged separately with a reference date.
  • c) Requests sent through social media or other informal channels are redirected to contact.php for verification.

2. Information collected

Server logs may include an IP address, browser type, requested page, referring page, date, and error details. A contact message may include your name, email address, telephone details if supplied, and the content you choose to send. We ask readers not to include diagnoses, medical records, or unnecessary sensitive information in a general message. For instance, a typical server log entry records the requesting IP address, the page requested such as /nutrition.php, the HTTP status returned, and a timestamp, but it does not record the content of any article you read beyond the URL itself. A contact message is stored together with the date it was sent and the page, if any, that the reader referenced, so the editorial team has enough context to respond without requesting repeated clarification. We do not use hidden form fields, device fingerprinting, or cross-site tracking identifiers to link a message to a broader browsing history. If a reader nonetheless includes sensitive information such as a specific diagnosis in a message, it is treated with heightened confidentiality and is not forwarded outside the small team handling the reply.

  • a) Standard web server log fields: IP address, browser type, requested path, referring page, response code, timestamp.
  • b) Contact form fields: name, email address, optional phone number, subject, message body.
  • c) Information volunteered beyond the form fields is discouraged and is handled on a case-by-case basis.

3. Legal basis

We process contact information to respond to a request, maintain site security, and pursue legitimate editorial and operational interests. Where optional analytics or preference cookies are used, we rely on consent recorded through the cookie banner. You may withdraw optional consent without affecting access to ordinary editorial pages. Under the UU PDP framework, responding to a contact message relies on taking steps requested by the data subject before or during a communication, comparable to a contractual or pre-contractual interest. Security logging relies on our legitimate interest in keeping the service available and free of abuse, an interest we consider is not overridden by a reader's expectation of privacy given the limited and short-lived nature of the logs. Analytics or preference cookies rely on consent collected through the banner described in cookies.php, recorded as a simple accepted or rejected value rather than inferred from continued browsing. Where we rely on legitimate interest, we keep an internal record of that assessment so it can be reviewed if a reader or authority asks us to justify the processing.

  • a) Consent: optional analytics and preference cookies.
  • b) Legitimate interest: security logging, fraud prevention, editorial correspondence records.
  • c) Legal obligation: responding to a lawful authority request where applicable.

4. Retention

General contact correspondence is retained for up to 24 months after the last meaningful exchange, unless a longer period is needed for a legal issue. Security logs are normally retained for 30 days. Cookie choices remain in the browser until deleted or replaced, and limited analytics records are retained for up to 14 months. For example, a reader who writes in March 2026 about an article correction and receives a final reply in April 2026 can expect that correspondence to be deleted or anonymised by around April 2028, unless the exchange is relevant to an ongoing legal or editorial integrity matter. Security logs rotate on a 30-day cycle on most hosting configurations, meaning a log entry from early in a month is generally no longer accessible by the same point in the following month. Where a dispute, safety concern, or legal request requires longer retention, we isolate the specific records involved rather than extending retention for the entire dataset. Backup copies may persist for a short additional period of up to 60 days after deletion from the live system, purely because of how routine backup cycles overwrite older copies.

  • a) Contact correspondence: up to 24 months from the last exchange.
  • b) Security and error logs: approximately 30 days.
  • c) Backup archives: up to an additional 60 days after live deletion.

5. Rights

Subject to applicable law, you may request access, correction, deletion, restriction, or information about processing. Send a request through contact.php or to the address above and describe the account or message involved. We may verify identity proportionately and respond within 30 calendar days, with an extension explained where permitted. To exercise a right, please identify yourself with reasonable detail, such as the email address used in your original message and the approximate date it was sent, so we can locate the correct record without accessing unrelated correspondence. For example, a request to delete a message about a nutrition article will usually be completed by removing the message and any reply thread connected to it, unless a legal retention reason applies. We may decline or narrow a request where it would reveal information about another person, where it concerns a record we are legally required to keep, or where the request is manifestly unfounded or repetitive, and we will explain the reason in plain language. If you are dissatisfied with our response, you retain the right to escalate the matter to the relevant Indonesian authority described in the complaints section below.

  • a) Access: a summary of information held about you.
  • b) Correction: amending inaccurate contact details.
  • c) Deletion: removing a message once it is no longer needed.
  • d) Restriction or objection: limiting a specific use of your information where applicable.

6. Processors

Hosting, security, email delivery, and analytics providers may process limited information on our instructions. They are expected to use safeguards, confidentiality controls, and data only for agreed services. We do not permit processors to sell Kleven reader information. Our hosting provider stores website files and server logs on infrastructure that may be located in Indonesia or a neighbouring region such as Singapore, selected for reliability and reasonable proximity to our Jakarta-based readership. An email delivery service relays contact form submissions to the editorial team's inbox and may briefly retain delivery metadata, such as whether a message bounced, for troubleshooting rather than for content review. If analytics are enabled, the measurement provider processes aggregated, non-identifying statistics rather than named individual profiles. Each processor operates under a written agreement describing confidentiality, security expectations, and the limited purposes for which Kleven's information may be used, reviewed periodically rather than treated as permanent.

  • a) Hosting and infrastructure provider.
  • b) Email delivery and spam-filtering service.
  • c) Optional website analytics provider.

7. Cookies

The site uses a cookieChoice value to remember whether you accepted or rejected optional cookies. Essential technical cookies may support security or delivery. Optional analytics cookies, if enabled, are used to understand broad page use rather than identify a reader’s health interests. Details and lifespans appear in cookies.php. For example, if a reader selects reject in the banner, the cookieChoice value itself is still stored locally, simply set to reject, because the site needs to remember that choice to avoid showing the banner on every page. Essential cookies related to security, such as a short-lived token used to prevent form abuse, are not covered by the optional consent banner because they are necessary for the page to function safely. Where analytics are active, a reader's approximate region may be inferred from a non-precise IP range, but this is not combined with a contact message to build a personal profile. Full cookie names, categories, and lifespans are listed on the dedicated cookies.php page, which should be read together with this section rather than as a separate, unrelated policy.

  • a) Strictly necessary cookies: security, load balancing, form protection.
  • b) Functional cookie: cookieChoice, consent record.
  • c) Optional analytics cookies: enabled only after acceptance.

8. International transfers

Hosting and service providers may operate in Indonesia or other jurisdictions. Where information crosses borders, Kleven seeks contractual, technical, and organisational safeguards appropriate to the service and the nature of the information. We encourage readers to avoid sending unnecessary sensitive health details. For example, a hosting or content delivery provider may route traffic through a server located outside Indonesia for performance reasons, even though the website's primary audience and operator are based in Jakarta. Where information is transferred internationally, we look for providers offering contractual confidentiality commitments, encryption in transit, and restricted employee access, consistent with the safeguards contemplated for cross-border processing under the UU PDP. We do not transfer contact correspondence to a third country for sale, profiling, or unrelated marketing use. If local data protection guidance changes the conditions for cross-border transfer, we will update our provider selection and this policy accordingly rather than relying on an outdated arrangement.

  • a) Preferred: hosting within Indonesia or the wider Southeast Asian region.
  • b) Acceptable: providers offering contractual safeguards and encryption in transit.
  • c) Avoided: transfers without any documented safeguard.

9. Children and vulnerable people

Kleven is intended for adults and is not directed to children. We do not knowingly request information from children. If a parent or guardian believes a child has sent personal information, contact us so we can assess and remove it where appropriate. For instance, our contact form does not ask for a date of birth or school information, and editorial topics are written with an adult readership of men beyond thirty specifically in mind, which naturally limits the likelihood of a child submitting a message. If we become aware that a message was sent by someone who appears to be a minor, we restrict internal access to that message and delete it once any immediate safety concern has been addressed. Parents or guardians who believe a child has contacted us can request deletion using the same channel described in the rights section, and we will prioritise such a request. We do not knowingly direct advertising, surveys, or newsletter sign-ups toward readers who identify themselves as minors.

  • a) No age-gated or child-directed content is published on Kleven.
  • b) Forms do not request information that would identify a minor.
  • c) Suspected minor submissions are deleted promptly upon identification.

10. Security

We use access controls, limited retention, secure hosting practices, and staff awareness to reduce risk. No internet transmission is guaranteed to be completely secure. If we identify a material incident affecting personal information, we will assess notification duties and communicate through a suitable channel. For example, access to the contact inbox is limited to the small editorial team responsible for responses, rather than being shared broadly across contributors or advertisers. We apply reasonable technical measures such as encrypted connections for the website and periodic review of hosting account access, proportionate to the modest scale and sensitivity of the information we hold. Despite these measures, a sophisticated attack, software vulnerability, or human error can still occur, and no editorial website of this size can promise absolute security. If an incident is assessed as materially affecting personal information, we will consider notification obligations under applicable Indonesian law and, where appropriate, inform affected readers through a notice on this page or a direct message.

  • a) Encrypted connections between browser and server.
  • b) Restricted internal access to contact correspondence.
  • c) Periodic review of third-party account permissions.

11. Complaints

Contact us first so we can investigate a concern. You may also contact the relevant Indonesian data protection or consumer authority if you believe your rights have not been respected. We will keep a record of the concern, the steps taken, and the outcome. For example, if you believe a request was not handled correctly, describe the original request, the date it was sent, and the response you received, so we can review the specific exchange rather than treating it as a general objection. We aim to provide a substantive reply to a complaint within 30 calendar days of receipt, and we will tell you if more time is genuinely needed because the matter is complex. If our internal review does not resolve your concern, Indonesia's data protection supervisory arrangements under the UU PDP allow you to raise the matter with the responsible government body, and you are free to do so at any stage. We keep an internal log noting the date a complaint was received, the steps taken, and the date it was closed, so similar issues can be identified and addressed.

  • a) Step one: contact the editorial desk directly.
  • b) Step two: request escalation if unresolved within 30 days.
  • c) Step three: contact the relevant Indonesian authority if still unresolved.

12. Changes

This policy was reviewed on 1 October 2026. Previous material changes were recorded on 1 March 2026 when the contact retention period was clarified. Future changes will be posted on this page with a new date, and significant changes may be highlighted on the homepage. For example, the March 2026 revision narrowed the stated retention period for general contact correspondence from an open-ended description to a specific 24-month figure, so readers could better understand what to expect. Any future material change, such as introducing a new category of processor or a new type of cookie, will be reflected both in the body of this policy and in the revision date at the top of the page. We do not apply a materially more permissive policy retroactively to information already collected under an earlier version without separately informing affected readers where required. Readers can always view the version of this page that is currently published; we do not maintain a hidden or different policy for any particular audience.

  • a) 1 March 2026 — initial detailed retention periods published.
  • b) 1 October 2026 — current review; processor and rights sections expanded.
  • c) Next scheduled review — on or before 30 September 2027.