Privacy Notice

This Privacy Notice explains how Fish ID Nusantara (FIN) collects, uses, and protects competition participants' personal data.

1. Personal Data Controller

The competition organizer operating this platform is the Personal Data Controller as referred to in Law No. 27 of 2022 on Personal Data Protection (UU PDP).

2. Data Collected

• Identity data: full name, email, phone number, date of birth, gender, nationality, country of residence.
• Diving certification data: certifying organization, certification number, certification date, diving level, logged dive count.
• Identity documents: diving certification card, recent passport photo.
• Financial data: proof of payment, amount, date, and method of registration fee payment (specific personal data under Article 4 of the UU PDP).
• Minor data: date of birth for participants under 18, and guardian data (name, relationship, contact, consent documents) for participants aged 12-17 (specific personal data under Article 4 of the UU PDP).
• Photography equipment data (optional): camera brand/model, housing, strobe/lighting.
• Technical data: IP address at the time consent was given, audit log of actions taken on the platform.

3. Purpose of Processing

Data is used for: registration and competition-participation administration, eligibility and certification verification, photo judging, attendance validation by dive operators, publication of results and gallery (under a non-exclusive license over submitted photos), and competition-related communication.

4. Legal Basis for Processing

Explicit consent (Terms & Conditions agreed to at registration), performance of the competition-participation contract, and legal obligation where applicable.

5. Disclosure to Third Parties and Cross-Border Data Transfer

A. Disclosure to Third-Party Service Providers
In operating and managing the platform, we may share or provide access to your personal data to trusted third-party service providers (Selected Third Parties) who are bound by confidentiality obligations and data security standards. These third parties include:

• Cloud Computing & Database Service Providers: For encrypted data storage, database management, and user account authentication.
• Digital Media Storage Service Providers: To securely store identity documents, proof of certification, and uploaded photos.
• Transactional Communication Service Providers: For sending registration notifications, account verification, and official platform announcements via email.

B. Cross-Border Data Transfer
For system reliability and data processing purposes, the personal data collected may be transmitted, stored, or processed on third-party servers located outside the territory of the Republic of Indonesia. In conducting such cross-border data transfers, we ensure that:

• The receiving country or third-party service provider has a level of personal data protection that is equivalent to, higher than, or provides adequate protection in accordance with applicable laws in Indonesia; and/or
• There are valid data protection instruments/agreements in place to guarantee the security and confidentiality of your personal data during processing.

6. Data Retention

A. We will retain your Personal Data only for as long as necessary to fulfill the processing purposes outlined in this Privacy Notice, or to comply with statutory data retention obligations under applicable laws and regulations in Indonesia.

B. When your Personal Data is no longer required for processing purposes or when the legally mandated retention period has expired, we will delete, destroy, or anonymize your personal data so that it can no longer be associated with your identity.

C. Information regarding specific retention terms and schedules for each data category is managed in accordance with internal retention policies that are updated periodically.

7. Data Subject Rights

Every data subject has the right to: obtain clarity on the processing of their data, access and obtain a copy of their personal data, complete/update/correct inaccurate data, terminate processing and delete their personal data, withdraw consent given, object to automated processing, delay or restrict processing, and claim and receive compensation for violations in the processing of their personal data. Requests can be submitted via the relevant menu in your account.

8. Contact and Data Protection Officer

If you have any questions, feedback, complaints, or wish to exercise your Data Subject Rights regarding the processing of Personal Data on the Fish-ID Nusantara platform, you may contact our Data Protection Officer through:

• Email: contact@fish-id.co
• Email Subject: [Data Protection] - Your Request / Question
• Operating Entity: Fish-ID Nusantara

For security and confidentiality reasons, we may verify your identity prior to processing any requests or complaints submitted.

9. Language and Governing Version

This Privacy Notice may be translated into languages other than Indonesian. In the event of any discrepancy, conflict, or difference in interpretation between the Indonesian version and any foreign language version, the Indonesian version shall prevail and serve as the primary reference.