Effective Date: [Tanggal Upload]
This Privacy Policy is published electronically on Vanaya NeuroTech's website and applies to all visitors, users, and Technology Licensees who access or use Vanaya's Neurometric™ technology and services. By proceeding with any subscription, license acquisition, or use of our services, users acknowledge that they have read, understood, and agreed to this Privacy Policy. No physical meeting or manual signature is required.

This Privacy Policy is separate and distinct from the Technology License Agreement.
This Policy complies with applicable data protection laws in Indonesia (UU PDP 2022).
 
1. Scope
This Privacy Policy applies to all services provided by Vanaya NeuroTech, including:

• Licensing of Neurometric™ technology to Technology Licensees;

• Brain assessments using EEG devices (e.g., Emotiv Epoc-X);

• Access to websites and digital platforms operated by Vanaya.

 

Principal-Reseller Relationship: Vanaya NeuroTech acts as the principal and technology owner. Technology Licensees act as authorized resellers with limited rights to use, distribute, and deliver Neurometric™ reports under strict compliance with Vanaya's standards.
Vanaya reserves the right to periodically audit Licensee's data handling and privacy practices to ensure compliance.
 
2. Data We Collect
We may collect the following types of information:

• Brain Data: Neuroelectrical signals captured through EEG devices.

• Assessment Data: Responses to psychometric surveys.

• Personal Data: Name, email, gender, job title, organizational affiliation.

• Device and Interaction Data: IP address, device type, browser information, access logs.

 
3. Purpose of Data Collection
We process collected data for the following purposes:

• To generate personalized and organizational Neurometric™ reports;

• To improve Vanaya’s Neurotech and AI algorithms;

• To support anonymized scientific research and product development;

• To manage licensing operations and contractual obligations.

 

All scientific research uses fully anonymized data.
 
4. Legal Basis for Processing
We rely on the following lawful bases:

• Consent: Each respondent signs an informed consent form before participation;

• Contractual Necessity: Fulfillment of licensing agreements with Technology Licensees;

• Legitimate Interests: Securing and improving our services and technological offerings.

 

Licensees are solely responsible for obtaining valid, informed consent from all respondents prior to any data collection activities involving Neurometric™ assessments.
 
5. Data Protection and Security
Vanaya implements robust security measures:

• End-to-end encryption of all stored and transmitted data;

• Multi-layer authentication and role-based access control;

• Regular third-party cybersecurity audits;

• Anonymization and pseudonymization where applicable.

 

Licensees are contractually obligated to uphold these same standards. Licensees must ensure that all EEG devices used for Neurometric™ assessments are properly secured, maintained, and operated according to the manufacturer’s maintenance standards.
 
6. Data Retention and Deletion

• Personal identifiable information (PII) is retained for 24 months post-termination;

• Brain and analytical data are retained for 5 years in anonymized form;

• After expiration, data are permanently deleted or fully anonymized.

• Data retained for research will be anonymized at the point of retention.

 
7. Data Sharing and Disclosure
We do not sell or rent data. We may share anonymized data with:

• Accredited research institutions;

• Authorized subprocessors (EEG service centers, cybersecurity vendors);

• Legal authorities, where mandated by law.

 

An updated list of authorized subprocessors is available upon request.
Licensees must immediately notify Vanaya of any suspected or actual data breach within 48 hours. Licensees shall promptly forward any data subject rights requests (withdrawal of consent or deletion) to Vanaya NeuroTech within 5 business days.
 
8. Respondent Rights
Respondents have the right to:

• Receive the final Neurometric™ report generated from their brain assessment;

• Withdraw consent at any time without affecting prior lawful processing.

 

Respondents are not entitled to access, request correction, or obtain raw brain data or intermediate analytical data stored on Vanaya’s cloud servers.

Requests for withdrawal of consent or deletion of data must be submitted directly to the relevant Technology Licensee managing the respondent’s data in their respective jurisdiction. Vanaya NeuroTech does not directly process or respond to individual data subject requests.
 
9. International Transfers
Where data is transferred outside Indonesia or Singapore (e.g., cloud hosting), Vanaya ensures:

• Compliance with relevant data protection laws;

• Implementation of Standard Contractual Clauses or equivalent safeguards.

 
10. Children's Privacy
Our services are not intended for individuals under 18 years old. No data from minors will be collected without verifiable parental consent.
 
11. Intellectual Property Rights
All Neurometric™ technologies, brain analytics models, and generated reports remain the exclusive intellectual property of Vanaya NeuroTech. No transfer of ownership to Licensees or Respondents occurs.
 
12. Updates to this Privacy Policy
Vanaya may update this Privacy Policy periodically. Updates will be posted on our website with a new effective date. Users are advised to review this Policy regularly.
 
13. Governing Law and Dispute Resolution
This Privacy Policy is governed by:

• Primary Jurisdiction: Laws of the Republic of Indonesia;

Any disputes shall be resolved:

• In the courts of South Jakarta;

 
14. Contact Information
For any inquiries about this Privacy Policy or data protection practices, please contact:

​

Vanaya NeuroTech
Grha Vanaya Jl Raya Ragunan Kav P1 Jakarta 12540 INDONESIA
Email: privacy@vanaya.co