This portal is operated by PT Savian Investasi Indonesia (“Savian”, “we”, “us”), a foreign investment company (PMA) incorporated in Indonesia under business registration number (NIB) 2807230236903, with its registered office at Jl. Raya Sanggingan, Kedewatan, Ubud, Gianyar, Bali 80571, Indonesia. This page explains what personal data we process when you use the Savian investor portal at investors.saviangroup.com, and the rights you have over it.
The portal is private. Access is granted by invitation only and there is no public registration.
Who is responsible
PT Savian Investasi Indonesia, Jl. Raya Sanggingan, Kedewatan, Ubud, Gianyar, Bali 80571, Indonesia, is the data controller for the personal data described here. For any question about this policy or to exercise your rights, write to privacy@saviangroup.com.
What we collect
Account data
Your full name and email address, entered by Savian when your access is created. If you set a password, it is stored only as a cryptographic hash by our authentication provider — we never see it. If you choose “Continue with Google”, we receive your name, email address and Google account identifier from Google; we never receive your Google password.
Investment data
Information about the villa or villas linked to your account: amounts, payment dates, currency, completion status, estimated delivery, construction milestones, photographs and documents. Savian produces this information about your investment.
Technical data
Our hosting and database providers keep standard server logs, including IP address, request time and browser type, for security and reliability.
We use no analytics, advertising or tracking tools of any kind. We do not profile you, and we do not build an audience from your visits.
Cookies
The portal sets strictly necessary cookies only: session cookies that keep you signed in and protect your account. There are no analytics, advertising or profiling cookies — which is why the portal shows no cookie banner.
Why we process it
| Purpose | Legal basis |
|---|---|
| Giving you access to your own investment information | Performance of a contract (Art. 6(1)(b) GDPR) |
| Authenticating you and protecting your account | Legitimate interests (Art. 6(1)(f)) — keeping confidential data confidential |
| Notifying you when a construction milestone is published | Performance of a contract / legitimate interests |
| Replying to messages you send us | Legitimate interests (Art. 6(1)(f)) |
| Meeting accounting and legal record-keeping duties | Legal obligation (Art. 6(1)(c)) |
Who else processes it
We rely on a small number of providers, each acting on our instructions and bound to protect your data:
- Supabase — database, authentication and file storage
- Vercel — hosting and delivery of the portal
- Resend — sending transactional email: invitations, password resets, milestone notifications
- Google — only if you choose to sign in with a Google account
We do not sell personal data and we share none of it with advertisers. Your investment information is never visible to another investor: access is enforced in the database itself, not merely hidden in the interface, and each account can read only the villas linked to it.
International transfers
Savian is established in Indonesia, and your data is stored and processed outside your country of residence. Naming where, precisely:
- Supabase — database, authentication and files, hosted in Tokyo, Japan (region ap-northeast-1)
- Vercel — the portal itself, executed in Washington, United States (region iad1)
Where data concerning individuals in the European Economic Area or the United Kingdom leaves that area, the transfer is covered by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.
How long we keep it
We keep your account and investment data for as long as your relationship with Savian continues, and for ten years after it ends — the period Indonesian law sets for company records. When your access is withdrawn, your account is disabled and what remains is kept only to meet that obligation.
Your rights
If you are in the European Economic Area or the United Kingdom, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where processing rests on consent, you may withdraw that consent at any time.
Write to privacy@saviangroup.com and we will answer within one month. If you believe we have handled your request badly, you may complain to your national data protection authority.
If you are in Indonesia, comparable rights apply under Law No. 27 of 2022 on Personal Data Protection.
Security
Access is by invitation only. Data travels over encrypted connections, access rights are enforced at the database level rather than only in the interface, and construction photographs and documents are held in private storage reachable only through short-lived signed links.
No system is perfectly secure. Should a breach affect your personal data, we will notify you and the competent authority wherever the law requires it.
Changes to this policy
We will update this page when our practices change and revise the date at the top. If a change matters to you, we will say so by email.