Privacy Policy

Welcome to indogmp.com ("Site", "we", "our", or "us"), operated by PT. Permata Global Agroindo (PT. PGA). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, submit inquiries, or interact with our content.

INDO GMP is a B2B kratom supplier based in Indonesia, serving wholesale buyers in the United States, European Union, and international markets. Our operations are conducted in full compliance with Good Manufacturing Practice (GMP) standards and applicable international regulations.

Please read this policy carefully. If you disagree with its terms, please discontinue use of the Site.

2.1 Information You Provide Directly

When you submit an inquiry, request a product sample, register as a buyer, or contact us, we may collect:

• Full name, company name, and professional title
• Business email address and phone number
• Shipping and billing address
• Order details, product specifications, and quantity requirements
• Communications, messages, and correspondence you send us
• Documents required for compliance (e.g. business registration, import licenses)

2.2 Information Collected Automatically

When you browse our Site, we automatically collect:

• IP address and approximate geographic location
• Browser type, operating system, and device information
• Pages visited, time spent on pages, and referring URLs
• Cookie identifiers and similar tracking technologies
• Behavioral and clickstream data for analytics purposes

2.3 Information from Third Parties

We may receive information from analytics providers, advertising partners, and HubSpot CRM in connection with your interactions with our content or marketing materials.

We use cookies, web beacons, pixels, and similar technologies to:

• Maintain session state and remember your preferences
• Analyze website traffic and usage patterns (e.g. Google Analytics)
• Support CRM and marketing automation via HubSpot
• Measure the effectiveness of our outreach and content

We use the information we collect to:

• Process and respond to product inquiries, quotation requests, and sample orders
• Manage buyer relationships and accounts via HubSpot CRM
• Send transactional communications and, with your consent, marketing updates
• Improve our Site, product offerings, and services through analytics
• Verify buyer eligibility and ensure regulatory compliance
• Detect fraud, ensure security, and comply with legal obligations
• Comply with applicable laws, export regulations, and law enforcement requests

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

We may share it with:

• Service Providers: Shipping carriers, payment processors, email platforms (HubSpot, Make.com), analytics providers, and IT services that assist in operating the Site.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity.
• Legal Requirements: When required by law, court order, or government authority, or to protect the rights and safety of our users or the public.
• Compliance Partners: Third-party GMP testing laboratories and certification bodies for product verification purposes, strictly on a need-to-know basis.

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, including:

• Order and transaction records: up to 7 years for tax and legal compliance
• Account and inquiry data: until you close your account or withdraw, plus a reasonable grace period
• Marketing preferences: until you unsubscribe or withdraw consent
• Analytics data: typically aggregated and anonymized after 26 months

8.1 All Users

You have the right to opt out of marketing communications at any time by clicking "unsubscribe" in any email or contacting us directly.

8.2 EU / EEA Users (GDPR)

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to certain types of processing
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time without affecting prior lawful processing
• Lodge a complaint with your local data protection supervisory authority

8.3 California Residents (CCPA / CPRA)

California residents have the right to know what personal information we collect, delete it (subject to exceptions), opt out of its sale or sharing, and not be discriminated against for exercising these rights. We do not sell personal information as defined under the CCPA. To submit a verifiable consumer request, contact us at the details in Section 14. We will respond within 45 days.

We implement industry-standard technical and organizational measures to protect your personal information, including SSL/TLS encryption for data in transit, access controls limiting employee access to personal data, and secure third-party processors compliant with applicable security standards.

INDO GMP operates from Indonesia (Sourcing, Production & Export), with sales activity directed primarily to buyers in the United States and European Union. Your personal information may be transferred to, stored, and processed in Indonesia, the United States, or countries where our service providers operate.

For transfers from the EEA or UK to Indonesia, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, to ensure your data receives an adequate level of protection consistent with GDPR requirements.

Our Site and services are directed exclusively to business buyers and are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from an individual under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us immediately.

Our Site may contain links to third-party websites, certification bodies, or embedded content. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. For material changes, we will provide a more prominent notice such as an email notification or a banner on our Site. Your continued use of the Site after any changes constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us:

For GDPR-related requests, EU/EEA users may also lodge a complaint with their national data protection supervisory authority.