Privacy policy

This policy explains how Willow handles information connected with this editorial website. Willow operates from Jl. Taman Anggrek No. 25, Grogol Petamburan, West Jakarta, Jakarta 11470, Indonesia, and can be contacted at +62 878 5241 9036. It applies to visitors, newsletter or contact correspondents and people who communicate with the editorial desk. It does not govern websites linked from Willow that are operated by other organisations. The policy is written with regard to Indonesia's Personal Data Protection Law (Law No. 27 of 2022) and the Electronic Information and Transactions framework, and Willow aims to apply their principles in plain language. In this document, "personal information" means anything that identifies a person directly or in combination with other details, such as an email address attached to a message. Aggregated or technical figures that cannot reasonably be linked to a person, such as a count of page requests, are treated as operational data. Where this policy and a mandatory legal requirement differ, the legal requirement prevails.

1. Scope and responsibility

   Willow is responsible for deciding why limited website information is used. The publication is designed to minimise personal data and does not ask readers to create an account for ordinary reading. This document covers pages, forms, cookies and editorial correspondence. It should be read with the cookies and data-rights pages. In practice the scope covers four situations: reading pages without interaction, sending a message through the contact form, writing or calling the editorial desk, and choosing a cookie preference. Willow does not operate a members area, paid subscription or public comment system at the time of this review, so no password, payment card or reader profile is held. If a feature that collects additional information is introduced, this policy will be updated before the feature is made available. Access to messages is limited to editors and the person who maintains the site, each of whom is bound by a confidentiality obligation.

2. Information collected

   Server systems may receive an IP address, browser family, operating system, requested page, referring page and time of request. A contact message may include the name, email address and message a visitor deliberately provides. Willow asks visitors not to submit diagnoses, medical records or unnecessary sensitive details. Images and article reading activity are not used to create a health profile. Willow does not ask for a national identity number, date of birth, bank detail or health history, and the contact form has no field for them. IP addresses are not used to work out a precise location and are not combined with message content to build a profile of an individual. If a message arrives containing sensitive details that were not requested, editors will redact or delete them where practicable and answer the underlying question without repeating them.

   • (a) Technical records: IP address, browser family and version, operating system, requested address, referring page, response status and time.
   • (b) Correspondence: name, email address, message text and any phone number a visitor chooses to include.
   • (c) Preference record: the single word stored under cookieChoice after an accept or reject action.

3. Purpose and legal basis

   Technical information is used to deliver pages, protect the service and investigate faults, based on legitimate operational interests. Contact details are used to respond to a request, based on the visitor's request and the steps needed to answer it. Optional analytics or preference tools are used only where the visitor permits them. Willow does not sell personal information or use it for targeted health advertising. Where consent is the basis, it is requested separately from any other agreement and can be withdrawn as easily as it was given. Where Willow relies on legitimate operational interests, it weighs those interests against the visitor's reasonable expectations and keeps the amount of information to what is needed for the stated purpose. Information is not reused for an unrelated purpose, such as building a mailing list from a one-off enquiry, without a fresh and clear request from the person concerned.

   • (a) Legitimate operational interests: server logs, security monitoring and fault investigation.
   • (b) Request and steps to respond: handling a contact message or phone enquiry.
   • (c) Consent: any optional measurement or preference tool beyond the essential cookie choice.
   • (d) Legal obligation: retaining a record when Indonesian law or a lawful authority requires it.

4. Retention periods

   Security and server records are normally retained for up to 90 days, unless a longer period is needed to investigate abuse or comply with law. Editorial correspondence is retained for up to 24 months after the last meaningful exchange, then deleted or anonymised. Cookie choices remain in the browser until removed or replaced. A legal record may be retained for the applicable limitation period. When deletion is requested or a retention period ends, active copies are removed promptly and routine backups are overwritten within roughly 35 days. A short note recording that a data-rights request was received and how it was resolved is kept for 24 months, without repeating the content of the original message, so that Willow can show it responded properly. Anonymised information that no longer identifies anyone, such as a general tally of topics readers ask about, may be kept longer because it is no longer personal information.

5. Service providers

   Hosting, security, email delivery and form-processing providers may process limited data on Willow's behalf. They receive only what is needed for their function and are expected to maintain confidentiality and security. Willow does not provide contact messages to supplement sellers, employment advertisers or data brokers. A provider list can be requested from the editorial desk. The register Willow maintains describes each provider's role, the categories of information involved, the country where processing takes place and the date the arrangement was last reviewed. A request for the register is answered within 10 working days. Providers act on Willow's instructions and may not use the information for their own marketing. If a provider changes materially, for example by moving processing to another country, the register is updated and this policy is revised where the change affects visitors.

   • (a) Web hosting and content delivery: serves pages and records technical logs.
   • (b) Security services: filter abusive traffic and protect the contact form from automated submissions.
   • (c) Email delivery: transmits replies from the editorial desk to the address the visitor supplied.

6. Cookies and similar technologies

   The site uses an essential preference called cookieChoice to remember an accept or reject action. It is stored in the browser and has no purpose beyond that choice. If optional measurement is introduced, its name, provider, purpose and lifespan will be described before use. The separate cookies policy explains session, analytics and preference categories in more detail. Willow treats a stored choice as current for up to 12 months and may ask again after a significant change to the cookies policy. No cookie is used to follow a visitor across other websites, and the site does not use advertising identifiers. A visitor who rejects optional cookies can still read every page and send a message.

7. International transfers

   Hosting or service providers may operate servers outside Indonesia. When information crosses a border, Willow seeks contractual confidentiality, access controls and a transfer arrangement appropriate to the provider and the information involved. Because the site minimises data, most reading does not identify an individual. Visitors may contact Willow for the current provider location information. Indonesian law expects the destination country to offer an equivalent or sufficient level of protection, or for adequate safeguards to be in place, and Willow checks this when a provider is selected or changed. Contact messages are the information most likely to identify a person, so they are handled through providers that commit to access limitation and encryption in transit. A visitor who prefers that a message stay within Indonesia can telephone the editorial desk instead of using the form.

8. User rights

   Subject to applicable Indonesian law, a person may ask for access to, correction of or deletion of personal information, and may object to optional processing. A request should identify the email used and describe the action sought. Willow may ask for reasonable verification to prevent disclosure to the wrong person. The data-rights page gives the procedure and expected response timing. Willow acknowledges a request within 3 working days and aims to complete it within 14 calendar days, extending by up to a further 14 days for a complex request and explaining the reason for the extension. No fee is charged for an ordinary request. If Willow cannot fulfil a request in full, for instance because a record must be kept by law, it explains which part was declined and why.

   • (a) Access: a copy or summary of the personal information Willow holds about the requester.
   • (b) Correction: updating details that are inaccurate or incomplete.
   • (c) Deletion and withdrawal: removing information or withdrawing consent to optional processing, subject to legal retention duties.
   • (d) Objection and restriction: asking Willow to pause optional use while a question is resolved.

9. Security

   Willow uses access limitation, ordinary transport security and restricted editorial handling for messages. No internet transmission is guaranteed to be completely secure, so visitors should avoid sending highly sensitive medical or identity information through a general form. Suspected security incidents should be reported promptly to the contact address. The team records material incidents and takes proportionate corrective action. Page traffic is served over an encrypted connection, administrative access requires individual credentials, and software components are updated when maintainers publish security fixes. If an incident is likely to affect a person's rights, Willow notifies the affected people and, where the law requires, the competent authority within 3 x 24 hours of becoming aware, describing what happened, what information was involved and what steps are recommended.

10. Complaints and revisions

    Questions can be sent to Willow at the address or phone number stated above. If a person believes a concern remains unresolved, they may seek guidance from the relevant Indonesian data-protection or consumer authority. This policy was first published for the 2026 site launch and reviewed on October 12, 2026. Material changes will be dated in the revision record and made visible on this page. A complaint is acknowledged within 3 working days and a written outcome is normally provided within 21 calendar days. The outcome explains what Willow reviewed, what it decided and what the person can do next. A complaint does not affect how the person is treated when reading the site or writing to the desk in future.

Revision record

October 12, 2026: policy reviewed for the Willow editorial launch, contact handling, cookie choice and Indonesian operating address. Future revisions will describe the changed section and effective date. Earlier versions are available on request for as long as Willow retains them. The entries below summarise changes in date order.

• April 6, 2026: first version published with the launch of the Willow editorial site.
• August 24, 2026: wording on provider registers and international transfers clarified.
• October 12, 2026: retention periods, response timings and rights procedure described in more detail; no change to the categories of information collected.