Privacy policy.
This privacy policy explains, in detail, how Drevak Journal collects, uses, stores, and safeguards information connected with its editorial website, its correspondence channel, and its cookie preference tools. It applies to every visitor who reads the publication from Indonesia or elsewhere, to readers who submit a message through the contact form, and to anyone who interacts with the cookie banner described in the separate cookie policy. The document is intentionally detailed so that a reader can locate the exact scope, purpose, retention period, and available right without needing to request clarification from the editorial desk. Where a term is not defined here, it carries its ordinary meaning under general Indonesian data protection practice and widely recognised international privacy principles.
1. Scope of this document
This policy covers the public pages of the Drevak Journal website, the contact form located on the contact page, the cookie consent banner that appears on first visit, and any newsletter or subscription mechanism that may be introduced in the future. It does not cover third-party websites that are linked from articles, even where those links appear inside editorial content, because Drevak Journal does not control how other operators handle information once a reader leaves this site. It also does not cover information a reader may choose to share directly on a third-party social network when discussing or sharing an article, since that exchange takes place entirely on infrastructure operated by another organisation. Readers who want to understand how a linked third party handles information should consult that operator's own privacy documentation before submitting anything to it.
2. Information we collect
The contact form on the contact page requests a name, an email address, and a free-text message; these three fields are the only information actively submitted by a reader through that form, and no additional fields are hidden or auto-populated without disclosure. Server-side technical logs may automatically record an IP address, a browser user-agent string, the page requested, the referring page where applicable, and the date and time of the request, because this information is generated by the ordinary operation of any web server and is not something a reader chooses to submit. Cookie preference tools store a simple value describing whether a reader accepted all cookies, a partial selection, or functional cookies only, as described further in section 7 below and in the dedicated cookie policy. Readers who do not use the contact form and who decline optional cookies can browse the entire editorial archive without submitting any information that could reasonably identify them as an individual.
3. Legal basis for processing
Where a reader submits the contact form, the legal basis for processing the submitted name, email address, and message is consent, because submission is a voluntary act that a reader can decline by simply not using the form. Where optional analytics cookies are enabled through the cookie banner, the legal basis is likewise consent, and that consent can be withdrawn at any time using the cookie settings link found in the footer of every page. Where technical server logs are recorded automatically, the legal basis is legitimate interest in operating a secure, reliable website, preventing abuse of the contact form, and diagnosing technical faults that could otherwise degrade the reading experience. Legitimate interest is balanced against a reader's own interest in privacy, and Drevak Journal limits the technical logs described above to the minimum fields necessary to achieve those security and reliability purposes.
4. Retention periods
Messages submitted through the contact form, together with the associated name and email address, are retained for twenty-four months from the date of the last exchange with the editorial desk, after which they are deleted from active systems unless a longer period is required to resolve an open enquiry or complaint. Server-side technical logs that record IP addresses and browser information are retained for a maximum of ninety days for security and fault-assessment purposes, after which they are automatically rotated out of storage. Cookie preference values are retained on a reader's own device for up to one hundred eighty days, as described in the cookie policy, and are not separately stored on Drevak Journal's servers beyond what is needed to honour the stated preference during that browsing period. Where a reader exercises a right described in section 5 to request earlier deletion, the editorial desk will remove the relevant record within thirty calendar days of verifying the request, except where a shorter statutory retention exception applies.
5. Reader rights and how to exercise them
A reader may request access to any personal information Drevak Journal holds about them, may request correction of inaccurate information, may request deletion of information that is no longer needed for the purposes described in this policy, and may object to processing that relies on legitimate interest as described in section 3. A reader may also withdraw consent for optional analytics cookies or for retention of a contact-form submission at any time, without affecting the lawfulness of processing carried out before the withdrawal. To exercise any of these rights, a reader should write to the Jakarta editorial desk at [email protected] with a clear description of the request and enough detail to allow the desk to locate the relevant record, such as the approximate date of a contact-form submission. The editorial desk aims to acknowledge every rights request within five business days and to provide a substantive response, including any requested deletion or correction, within thirty calendar days of acknowledgement.
6. Third-party processors
Drevak Journal uses a small number of named third-party service providers to operate the website and handle correspondence, and each provider is engaged only for the specific function described here. The website is hosted on infrastructure provided by a commercial hosting provider that stores server logs and website files on Drevak Journal's behalf and does not use that information for its own independent purposes. Where optional analytics are enabled, an analytics provider may process aggregate, non-identifying page-view statistics to help the editorial team understand which articles are being read, without building an advertising profile of any individual reader. Where the contact form is used, the submitted message is delivered to the editorial desk's email provider, which stores the message in the same way as any ordinary business correspondence and is bound by its own standard confidentiality practices. Drevak Journal does not sell reader information to data brokers, advertising networks, or any other third party, and does not share contact-form submissions outside the editorial desk except where legally required to do so.
7. Cookies and similar technologies
The website uses a limited set of cookies, each of which is described by name, purpose, and lifespan in the dedicated cookie policy linked from the footer of every page. In summary, a functional cookie named drevak_cookie_consent records a reader's banner choice for up to one hundred eighty days, a session-scoped technical record named drevak_session supports the contact form for the duration of a single browsing session, and an optional analytics cookie named drevak_analytics may be set for up to fourteen months if a reader accepts analytics through the banner. None of these cookies are used to serve targeted advertising, and none are shared with third-party advertising networks. A reader can change or withdraw a cookie choice at any time through the Cookie Settings link in the site footer, or through their browser's own cookie management controls.
8. International data transfers
Drevak Journal's editorial desk and primary hosting arrangements are based in Indonesia, and most information described in this policy is processed within Indonesia. Where a named third-party processor described in section 6 operates infrastructure located outside Indonesia, that provider is contractually required to apply data protection safeguards that are at least equivalent to those described in this policy, including limits on further disclosure and defined retention periods. Drevak Journal reviews its processor arrangements periodically to confirm that any cross-border transfer remains necessary and proportionate to the stated purpose. A reader who wants further detail about a specific transfer can request it using the contact procedure described in section 9.
9. Complaints and contact procedure
A reader who believes that Drevak Journal has not handled their information in line with this policy may raise a complaint by writing to [email protected] with a description of the concern and, where possible, the approximate date of the interaction in question. The editorial desk aims to acknowledge a complaint within five business days and to provide a substantive written response within thirty calendar days, including any corrective action taken. Where a complaint cannot be resolved directly with the editorial desk, a reader in Indonesia may also raise the matter with the relevant national authority responsible for personal data protection. Postal correspondence can be sent to Jalan Imam Bonjol No. 34, 10310 Jakarta Pusat, DKI Jakarta, Indonesia, and urgent matters can be raised by telephone at +62 21 2184 7205 during the desk's published hours of Monday to Friday, 09:00 to 17:00 WIB.
10. Children's information
Drevak Journal is an editorial publication intended for an adult general readership and does not knowingly collect information from children. The contact form and cookie preference tools are not directed at children, and the editorial team does not seek to identify or profile readers by age. Where the editorial desk becomes aware that information was submitted by a child without appropriate consent, it will delete the relevant submission promptly upon verification. A parent or guardian with a concern about a submission believed to have come from a child should contact the editorial desk using the procedure described in section 9.
11. Security measures
Drevak Journal applies reasonable technical and organisational measures to protect the limited information it holds, including restricting access to contact-form submissions to editorial staff who need that information to respond to a reader, and applying standard transport encryption to the connection between a reader's browser and the website. Server logs and stored correspondence are kept on systems that are not publicly accessible and that require authenticated access for any editorial staff member. While no online system can be described as entirely free of risk, the editorial desk reviews its handling practices periodically and updates them as reasonably necessary to reflect current good practice. Any suspected security incident affecting reader information will be assessed promptly, and affected readers will be notified where notification is appropriate and required.
12. Changes to this policy and revision log
Drevak Journal may update this policy from time to time to reflect changes in its practices, its named processors, or applicable requirements, and the version in force is always the one published at this address. Material changes will be indicated by an updated revision date at the top of this page, and where a change is significant the editorial desk may also note it briefly on the homepage. The current version was published on 18 August 2026 and reflects the retention periods, processor list, and rights procedure described above. Prior versions of this policy are available on request from the editorial desk at [email protected] for readers who wish to compare the current text against an earlier version they previously reviewed.