Privacy Policy

ISO Ready (cbms.asia) is a multi-tenant Integrated Management System (IMS) platform developed and operated by PT. CBMS Asia Consulting, headquartered in South Jakarta, Indonesia. The platform covers ISO compliance management modules (controlled documents, evidence, audit findings, corrective actions, risks, KPIs), Commercial Management (leads, proposals, contracts, invoices), the Portfolio Control Tower, and IMS Academy for training and certificate management.

This Privacy Policy explains how we collect, use, store, protect, and share your personal data when you use the platform, whether as a visitor of the public site or as an organization (tenant) user. By using the platform, you agree to the practices described in this policy.

We process the following categories of data as required by the service:

• Account data: full name, email address, profile photo (optional), and access role (admin/user) within the organization you belong to. Accounts are created through invitations or direct registration.
• Organization (tenant) data: information about your organization created by the organization owner, including organizational context, processes, controlled documents, risk registers, aspect-impact registers, objectives, and other compliance data you upload or manage in the platform.
• Documents and evidence: files you upload (policy documents, audit evidence, reports, activity photos) are kept in private storage and can only be opened through short-lived signed links issued to authorized users.
• IMS Academy participant data: participant name, organization, job title, attendance, pre/post-test scores, training evaluations, and certificate records issued by trainers, for documentation and training verification purposes.
• Third-party data you enter: names and contact details of persons in charge in Commercial leads and clients, customer contact data, supplier information, and external auditor details in the auditor portal.
• Visit and analytics data: browser type, device, pages visited, and anonymized usage events to measure performance and improve the service.
• Communication data: public contact form submissions, quotation requests, mailing list subscriptions, and support correspondence.

We process personal data under Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (UU PDP), as well as data protection regulations applicable to international users.

Our legal bases include: (a) contract performance — providing the platform in accordance with subscription terms; (b) consent — on account registration, training evaluation forms, and mailing list subscriptions; (c) legitimate interests — system security, abuse prevention, and service improvement; and (d) legal obligations — including taxation and handling data subject requests.

Data is not used for purposes other than those described in this policy without additional consent.

We use essential cookies to maintain authentication sessions and site language preferences. We also use analytics tools to measure aggregate visits and interactions (such as site visit counts and contact form submissions) without identifying individuals.

You can control cookies through your browser settings; disabling essential cookies may affect your ability to sign in to the platform.

We do not sell or rent your personal data. Data is only shared in the following circumstances:

• Infrastructure providers: this platform runs on hosting and storage providers acting as processors under our instructions.
• External auditor portal: if your organization enables it, auditors from certification bodies can access the compliance data designated by the organization through time-limited tokenized links.
• Public share links: proposals, invoices, contracts, training certificates, and test sheets intentionally shared by authorized users through tokenized links. Public views only display permitted fields (certificate number, participant name, program, dates, status); test scores and internal notes are never published.
• Legal obligations: when required by law, court order, or valid legal process.

We apply security controls aligned with ISO/IEC 27001 practices, including server-side tenant isolation with membership verification on every request, role-based access control, immutable audit trails for critical events, private storage for documents, and short-lived signed links for accessing sensitive files.

No system is entirely risk-free; if a security incident affecting your personal data occurs, we will notify you via your registered email as soon as reasonably practicable.

Account data and organization data are retained while your organization's subscription is active and for as long as needed for the purposes described in this policy. After an organization is deleted or a subscription ends, data is deleted or anonymized within a reasonable period, except for data that must be retained longer under legal obligations (such as tax records and training evidence required for audits).

Under the UU PDP and applicable regulations, you have the right to:

• request access to a copy of the personal data we process about you;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data, subject to legal retention obligations;
• withdraw consent to specific processing (for example, mailing lists) without affecting the lawfulness of prior processing;
• obtain your personal data in a structured format (portability); and
• object to specific processing.

Because our service operates in Indonesia on global cloud infrastructure, data may be processed or stored in data centers outside Indonesia. We ensure such transfers are protected by contractual and technical safeguards equivalent to the data protection standards described here.

We may update this policy from time to time. We will notify you of significant changes via registered email or in-app notification at least 14 days before they take effect. The latest update date is always shown at the top of this page.

For personal data requests or questions about this policy, please reach our team through the Contact page on this site, with a privacy request as the subject. We will respond within a reasonable period in accordance with the UU PDP.