Privacy Policy

Identity and scope

Muhammad Hafaz Assufy is an individual service provider trading as Fazen and publicly known as Hafaz Sofyan. He is responsible for the personal data described in this policy and operates from Lalang, Medan Sunggal, Medan, North Sumatra 20127, Indonesia.

This policy applies to fazen.co, enquiries, quotations, payments, and delivery of Brand Launch System, Website Design, Social Media Design, and Presentation Design services. It does not cover a future store, digital products, or services that Fazen does not currently offer.

A third-party website or platform linked from Fazen has its own privacy practices. This policy describes Fazen's handling of data before and after that external service is used.

Data categories and sources

Identity and contact data: Name, business name, role, email address, phone number, social handle, location, and preferred contact channel supplied in an enquiry or project conversation.
Enquiry and project data: Briefs, goals, audience information, budgets, schedules, feedback, approvals, files, brand assets, content, credentials, and other material supplied for quoting or delivery.
Contract and payment data: Accepted scope, quotation and invoice references, billing details, payment status, transaction references, and accounting records. Fazen does not receive a complete payment-card number from PayPal.
Technical and communication data: IP address, browser and device information, requested page, timestamps, security logs, email records, WhatsApp messages, and Instagram direct messages generated through normal use of those channels.

Most data is supplied directly by the person or an authorized business contact. Technical data is generated when a page is requested. PayPal and communication platforms may send transaction status or message data when their services are used.

Sensitive and unnecessary data

Fazen does not ask for government identification, health information, biometric data, or other sensitive personal data as part of a normal enquiry. A person should not send such data unless it is necessary for a documented legal or project requirement agreed in advance.

Purposes and legal bases

Steps before a contract: To answer an enquiry, assess fit, discuss scope, prepare a quotation, and reserve a provisional schedule at the person's request.
Contract performance: To organize kickoff, communicate with the decision-maker, create the agreed work, manage revisions, receive payment, and deliver files or publishing work.
Legal obligations: To keep tax, payment, accounting, and dispute records and to respond to a valid request from a competent authority.
Legitimate interests: To maintain service records, secure accounts and the website, diagnose faults, prevent misuse, establish or defend claims, and improve the studio process without overriding a person's rights.
Consent: To send optional marketing updates after a separate single opt-in, to use a conditional provider for a project when approval is needed, and to publish work in a portfolio after written opt-in.

Fazen does not use automated decision-making to accept, reject, score, or price an enquiry. Consent may be withdrawn for future use without changing the lawfulness of earlier processing.

Cookies and marketing

The current website may use strictly necessary technical storage if Next.js or Vercel needs it to serve, secure, or operate a requested page. Fazen does not currently activate nonessential analytics, advertising cookies, behavioral tracking, or a newsletter delivery provider.

Submitting an enquiry does not subscribe the sender to marketing. If studio updates are introduced, subscription will require a separate single opt-in and each message will provide a practical way to unsubscribe. Withdrawing from marketing does not stop project or service messages that remain necessary.

Service providers and disclosures

The providers below support current website, communication, payment, planning, and design work. A listing does not mean that every provider receives every enquiry, every file, or every project. Use depends on the requested channel, service, deliverable, and agreed workflow.

Vercel: Hosts and serves the website and processes normal request and security logs.
Fontshare: Supplies web fonts. A visitor's IP address and request data may reach Indian Type Foundry servers when the font files load.
Personal Google account: Stores and transmits studio email, correspondence, selected project files, calendar details, and working records until a dedicated business account replaces it.
PayPal Business: Issues commercial invoices, processes project payments, confirms payment status, and maintains transaction records under PayPal's own terms.
Meta: Processes messages and account data when a person contacts Fazen through WhatsApp Business or Instagram.
Notion: Supports internal notes, project planning, schedules, and structured project records when used for the engagement.
Adobe Suite: The primary production software for visual design and delivery files.
Figma: Supports UIX planning and interface design where that workflow forms part of the project.
Canva: Used only when an agreed deliverable or native-file requirement needs Canva.
Framer: Used only for an agreed website or homepage deliverable, publishing setup, or client handoff.

International transfers

Fazen operates from Indonesia. The providers named in section 05 may process or store data in the United States, Europe, India, Singapore, or other locations described in their current service documentation. This can place data under laws different from those in the person's location.

Where a transfer requires safeguards, Fazen relies on the provider's available contractual, organizational, and technical transfer measures and limits the data used for the task. A person may ask for information about the relevant provider and transfer route by email.

Retention and deletion

07.1An enquiry that does not become a project is retained for 12 months after the last meaningful communication, then deleted or de-identified unless a dispute or legal duty requires longer retention.
07.2Project correspondence, briefs, approvals, working records, and delivered-file records are retained for 5 years after project closure so Fazen can support the delivery and establish or defend claims.
07.3Tax, payment, invoice, and accounting records are retained for 10 years or longer when a binding legal requirement applies.
07.4Security and provider logs follow the relevant provider's operational schedule unless a specific incident requires preservation. Backups may retain a record temporarily until the normal backup cycle replaces it.

A valid deletion request is applied earlier where no contract, legal, accounting, security, or claim-related reason requires the record to remain. The response identifies any record that must be retained and the reason.

Security and incidents

Fazen uses proportionate safeguards such as access limits, unique credentials, software updates, encrypted connections where supported, controlled sharing, and provider security features. Security settings vary by account and provider. This policy does not claim that every account always uses two-factor authentication.

No internet, storage, or communication system is absolutely secure. If an incident occurs, Fazen will contain and assess it, preserve relevant records, notify affected people when required, and meet applicable authority-reporting duties. The 3 x 24 hour period is applied only when Indonesian law specifically requires that period for the incident in question.

Rights and response periods

Ask whether Fazen holds personal data and request a readable copy.
Correct inaccurate or incomplete personal data.
Request deletion or destruction where an overriding duty does not require continued processing.
Request restriction where an overriding duty does not require continued processing.
Object to a use based on legitimate interests and withdraw consent for future consent-based use.
Request portable data where the applicable law provides that right and the data can reasonably be exported.
Request compensation where applicable under the law governing the affected processing.
Raise a concern with the relevant data protection authority or other competent body.

Fazen acknowledges a rights request within 2 working days. Requests for access, correction, withdrawal or ending processing, and restriction follow the 3 x 24 hour period where Indonesian law specifically requires it. The 30 calendar day target applies to other verified requests. If a request is complex, repetitive, affects another person's rights, or requires more time under applicable law, the response will explain the reason and revised period. Identity may be verified proportionately before data is disclosed or changed.

Children and business users

Fazen's website and services are directed to adults acting for themselves or an organization. Fazen does not knowingly solicit project enquiries from children. If personal data from a child is identified without a lawful reason, it will be deleted and the sender may be asked to use an authorized adult contact.

A business contact must be authorized to share personal data, files, testimonials, customer information, employee details, or other third-party material supplied for a project. The client remains responsible for the lawfulness and accuracy of that source material.

Changes and contact

This policy may change when services, providers, laws, or data practices change. The document control panel records the current version, status, effective value, and update date. A material change will be presented before it becomes effective where notice is reasonably possible.

Formal privacy questions and rights requests should be emailed to hello@fazen.co with FZ-LEG-01 in the subject. WhatsApp is available as secondary support, but it is not the formal channel for a rights request or confidential material.