Your Privacy,
Our Priority

Welcome to Funtasya World (“Funtasya”, “we”). We are an education technology company (“Edu Fantasy Company”) that creates educational apps and games (“App”), learning platforms (“Platform”), and sites such as funtasyaworld.com (“Site”) — together, the “Services”.

This Policy explains what personal data we collect, why, how we use it, and what rights you have over it.

Data controller: PT DIGITAL LEAP TECHNOLOGIES acts as the Data Controller for these Services.

Legal basis for this Policy: drafted to align with Indonesia's Law No. 27 of 2022 on Personal Data Protection (“UU PDP”) — the primary law governing personal data in Indonesia — and, where relevant, Regulation (EU) 2016/679 (GDPR) for users from the European Economic Area.

Depending on how you (or your child, under your supervision) use the Services, we may collect:

• When you contact us — name, email, and phone number, to maintain a communication history.
• When you subscribe (paid or free newsletter) — name and email, to identify users and send service updates.
• When you register an account — registration data, used as a unique identifier to distinguish each user.
• When you update your profile — profile photo, education history, portfolio, etc., as needed for the relevant service (e.g. internship applications).
• When you apply for a job — application data, used solely for recruitment and as an application record.
• Automatically, via analytics — Google Analytics (usage patterns, session duration), Facebook Pixel (ad retargeting), and similar technologies we may use going forward.
• Through social media — if you sign in via Google or another provider, we receive data per their own policies.
• Through other sites/partners — from referral programs, business partners, or payment providers we work with.

Most of our Apps — like letter recognition, reading, and Qur'an learning — are designed for young children to use under the supervision of a parent or guardian. We treat children's data as a special category requiring extra protection, in line with Article 25 of UU PDP, which requires that children's personal data be processed specifically and only with parental/guardian consent.

• Who registers: accounts are created and managed only by a parent or guardian, never directly by the child.
• Minimizing children's data: we try not to request personal data directly from a child (full name, photo, contact info) unless truly necessary for a learning feature, and always with the parent/guardian's knowledge.
• No targeted ads to children: data related to a child's learning activity is not used for behavioral advertising.
• Parental/guardian rights: you can review, correct, or request deletion of your child's data at any time via the contact in Section O.

We process personal data for the following purposes, on the following legal bases under UU PDP:

• Within our company: accessible only to staff who need it for their role, following internal security procedures.
• Service providers: e.g. bulk email delivery services, protected by contractual data-protection terms.
• Legal compliance: if you violate the law or our Terms, relevant data may be disclosed to authorities.
• Third-party integrations: features connecting to Instagram, TikTok, Google, or Apple (including in-app payments) will share data per those providers' own policies.

When your data is transferred outside Indonesia (e.g. to overseas cloud hosting), we take steps to ensure the destination provides an adequate level of protection consistent with Article 56 of UU PDP — for example, through contractual safeguards with our processors — before the transfer takes place.

• Active accounts: data is retained for as long as you use the Services.
• After account closure / deletion request: data is deleted or anonymized within 90 days, unless we're legally required to retain it longer (e.g. tax, dispute, or fraud-prevention records) — and only for as long as truly necessary.
• Job applicants: application data is kept as needed for the recruitment process, unless you request earlier deletion.

We apply reasonable legal, organizational, and technical safeguards, including encrypted payment transactions and internal access restrictions.

• Data protection contact: reach dpo@funtasyaworld.com for any questions about the security or protection of your data.
• Breach notification: if a personal data breach occurs, we will notify affected users and, where required, the relevant supervisory authority, within the timeframe set by UU PDP.
• No internet transmission is completely secure — please keep your password, OTP, and device secure.

You (or a parent/guardian, for children's data) have the following rights over your personal data:

• Right to access — request a copy of the data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data, subject to legal retention obligations (see Section G).
• Right to restrict processing — request that we limit how your data is used under certain conditions.
• Right to object — object to our processing of your data, including for direct marketing.
• Right to data portability — request your data be given to you or transferred to another provider, where technically feasible.
• Right to withdraw consent — at any time, for processing based on consent.

Contact us via Section O to exercise these rights. We may ask you to verify your identity first.

We use cookies to recognize you as a user and improve the Services. You can disable cookies in your browser settings, though some features may not work as well afterward. See Section B for details on the analytics/marketing tools we use (Google Analytics, Facebook Pixel).

We send marketing materials (notifications, SMS, email, etc.) only if you've opted in. You can unsubscribe at any time via the contact in Section O; we may still send non-promotional messages like receipts or account notices.

Changes to this Policy will be published on this page, and for material changes we'll notify you by email. Continued use of the Services, where permitted by law, is treated as acceptance of the changes — but for significant changes in how we use your data, we'll ask for fresh, explicit consent.

By checking “I agree to the Privacy Policy” or creating an account, you (or a parent/guardian for a child user, per Section C) confirm you've read and understood this Policy and consent to the data processing described here.

If you provide personal data about someone else (a family member, friend, etc.), you confirm you've obtained their consent to do so.

Funtasya's primary audience is families in Indonesia, but we're aware some of our users access the Services from European Union countries. As a precaution, we apply a number of additional protections relevant to Regulation (EU) 2016/679 (GDPR) for these users — complementing the rights already described in Section I.

• Legal basis for processing: the same as described in Section D (contract, consent, legitimate interest, legal obligation) — this framework aligns with Article 6 GDPR.
• Children's consent age: EU member states set the age of independent consent for digital services between 13–16 (Article 8 GDPR). Because Section C already requires parental/guardian consent for all child users regardless of age, this requirement is inherently met.
• Right to complain to a European authority: besides contacting us directly (Section O), you may lodge a complaint with the data protection supervisory authority in your EU country of residence.
• Data transfer to Indonesia: your data is processed on servers located in Indonesia. We apply reasonable safeguards for this processing and are evaluating formal transfer mechanisms (such as Standard Contractual Clauses) as our European user base grows.

Note: our GDPR compliance posture is under ongoing review with legal counsel, given that our European user base is currently real but not yet an actively targeted market.

For general privacy questions or to exercise your rights over your personal data, contact:

privacy@funtasyaworld.com

Please include your full name, contact details, and a description of your request.