Privacy Policy | Kinnara Capital

Kinnara Capital and its affiliated entities ("Kinnara," "we," "us," or "our") are committed to protecting your privacy and ensuring you feel secure whenever you engage with us. This Privacy Policy applies to all data collected on or after the effective date and replaces all prior versions.

1. Scope and Compliance

This Privacy Policy applies to all personal information collected through our website kinnara.capital, our services, and any related communications. We comply with applicable privacy laws including:

Hong Kong's Personal Data (Privacy) Ordinance
General Data Protection Regulation (GDPR) and UK GDPR
California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
Australia's Privacy Act 1988
Indonesia's Law No. 27 of 2022 on Personal Data Protection (PDPL)
Indonesia's Electronic Information and Transactions Law (UU ITE) and related implementing regulations governing electronic systems and personal data processing
Thailand's Personal Data Protection Act B.E. 2562

2. Data Controller

Data Controller: Kinnara Capital
Address: Grand Sudirman Office Panin Tower, 8th Floor, Jl. Jendral Sudirman No.7, Balikpapan City 76113, Indonesia
Email: [email protected]

3. Information We Collect

We collect the following types of personal information:

Identifiers: Names, email addresses, phone numbers, and contact details
Commercial Information: Reservation details, payment information, and transaction history
Financial Information: Limited payment data processed via secure third-party payment providers; we do not store full card details
Internet Activity: Browsing history, page views, and interaction logs
Location Data: IP-based location information
Sensitive Data: Government-issued identification data and biometric verification data collected solely for legally required identity verification and AML/KYC purposes

4. How We Use Your Information

We use your personal information for the following purposes:

Service delivery and account management
Legal compliance including AML/KYC procedures
Security and fraud prevention
Service improvement and analytics
Marketing communications (with your consent)

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect navigation data and page-view metrics. Essential cookies are placed without consent; non-essential cookies require approval in regulated regions.

We may use third-party analytics and advertising services such as Google Analytics and Meta platforms, which may set their own cookies in accordance with their privacy policies.

We use five categories of cookies:

Strictly Necessary: Security, authentication, and session management
Preferences: Language and regional settings
Analytics/Performance: Site usage and performance metrics
Advertising/Marketing: Targeted advertising (with consent)
Functional: Enhanced site features

6. KYC and Identity Verification

For certain services, we utilize Personr.co as our identity verification provider. Personr.co acts as an independent data processor in accordance with its own privacy policy. We recommend reviewing their privacy practices before submitting identity information. This processor may request:

Passport information
Government-issued identification documents
Biometric selfie data
Sanctions and Politically Exposed Person (PEP) screening

Biometric Consent: By proceeding with identity verification, you explicitly consent to the processing of biometric data for verification and compliance purposes where required by law.

KYC data is retained for 5-7 years depending on jurisdiction.

7. Data Sharing and International Transfers

We may disclose your information to service providers, regulators, business partners, and authorized representatives. International data processing occurs across Hong Kong, Indonesia, Thailand, Australia, EU, UK, and US jurisdictions.

We use Standard Contractual Clauses and encryption safeguards to protect data during international transfers. Where data is transferred internationally, we take reasonable steps to ensure an equivalent level of protection, though laws in recipient jurisdictions may differ from those in your country.

8. Data Retention

Account and lead data is retained for the duration of the relationship and up to 5 years thereafter, unless longer retention is required by law. Transaction and KYC data is retained for at least 7 years in accordance with legal requirements.

9. Automated Processing

Certain compliance checks, including identity verification and sanctions screening, may involve automated processing. No decisions producing legal or significant effects are made without appropriate human review where required by law.

10. Your Rights

Depending on your jurisdiction, you may have the following rights:

Access: Request a copy of your personal data
Correction: Request correction of inaccurate data
Erasure: Request deletion of your data (where applicable)
Portability: Request transfer of your data
Restriction: Request limitation of processing
Opt-out: Opt out of targeted advertising
Withdrawal of Consent: Where required by Indonesian or Thai law, you may withdraw consent to data processing or lodge a complaint with the relevant supervisory authority

Response Timelines: GDPR/UK requests are processed within one month (extendable by two months). California requests are processed within 45 days.

11. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not intentionally collect personal information from minors.

12. Important Declarations

We do not "sell" personal information as defined by applicable privacy laws.
We honor Global Privacy Control (GPC) signals for opt-outs where legally mandated.
We do not discriminate against users who exercise their privacy rights.

13. Contact Us

For privacy inquiries or to exercise your rights, please contact us:

Data Controller: Kinnara Capital
Address: Grand Sudirman Office Panin Tower, 8th Floor, Jl. Jendral Sudirman No.7, Balikpapan City 76113, Indonesia
Email: [email protected]

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.