Zenith

Privacy policy

Effective October 1, 2026. This policy explains how Zenith, operating from Jalan Sudirman No. 52-53, Tanah Abang, Central Jakarta, 10210, Indonesia, handles information when visitors read the site or contact the editorial team.

1. Scope

This policy applies to Zenith pages, contact messages, newsletter requests if offered, and ordinary browser interactions. It does not govern third-party sites linked from our articles. Those services publish their own notices. We update this page when our practices materially change. In practice this means the policy covers the public pages under the zenith domain, the contact form described on the Contact page, and any subscription box that may appear on an article page, but it stops at the boundary of our own servers. For example, if a reader follows a citation link to a university research page, that university's own privacy notice governs the visit from that point forward, not this document. Where a feature changes in a way that affects what is collected or why, we treat that as material and publish a new version with an updated effective date rather than editing the existing text silently. Readers who rely on an older printed or saved copy of this page should check the live version before treating it as current, since only the version published on this domain is authoritative.

  • a) Pages reached through outbound citation links are explicitly outside this policy's scope.
  • b) A visual or structural site redesign alone, without a change to data practices, is not treated as a material change requiring a new version.
  • c) If Zenith launches a new interactive feature, such as a comment system, this policy will be updated before that feature goes live, not afterward.

2. Information collected

We may receive a name, email address, phone number, and message when someone contacts us. Server systems may record an IP address, browser type, requested page, referrer, and timestamp. We do not ask readers to submit health records. Please avoid sending sensitive medical details through ordinary contact forms. Beyond these categories, our hosting environment may also log the HTTP status code returned for a request and a coarse device category, such as mobile or desktop, which helps diagnose display issues reported by readers. A concrete example is a reader writing in about a broken link on the Mobility page: the message itself, the reader's email for a reply, and the automatically logged referrer showing they arrived from a search engine are the data points involved in that single exchange. The practical consequence is that routine browsing without submitting a form generates only server-level technical logs, not a personal profile tied to a name. An edge case arises when a reader voluntarily includes sensitive information, such as a chronic condition, inside a free-text message; in that situation we treat the content as provided voluntarily and limit its use strictly to answering that message. Where relevant, this collection activity relates to Indonesia's Personal Data Protection Law (Law No. 27 of 2022), which frames how we think about categories of data and the care owed to anything resembling health information.

  • a) Contact-form submissions are the main source of voluntarily provided personal data.
  • b) Server logs are generated automatically by every visit, regardless of whether a form is submitted.
  • c) Voluntarily disclosed sensitive details in free-text fields are handled with extra restraint and are not forwarded to any analytics or advertising system.

3. Legal basis

We process contact details to respond to a request, maintain site security, and pursue legitimate editorial administration. Where optional analytics operate, consent is requested through the cookie banner. We do not sell personal information. We assess necessity and proportionality when relying on legitimate interests. In concrete terms, replying to a reader's question about a training article relies on the reader's own initiation of contact as the basis for processing, while keeping a 90-day security log to detect abusive traffic relies on a legitimate interest in protecting the site rather than on consent. The practical consequence of this distinction is that a reader can withdraw consent for optional analytics at any point without affecting our ability to respond to a message they have already sent, since that exchange rests on a different basis entirely. An edge case involves a reader who contacts us anonymously using a disposable email address; we still process that message under the same legitimate-interest basis for editorial administration, even though we cannot verify identity. Where legitimate interest is used, we weigh the limited, non-commercial nature of the processing against the modest privacy impact on a reader who has voluntarily initiated contact.

  • a) Consent-based processing is limited to optional analytics and any future marketing feature, never to replying to messages already received.
  • b) Security logging continues to operate even if a reader rejects the analytics cookie category.
  • c) Legitimate-interest processing is reassessed whenever a new data use is proposed internally.

4. Retention

Editorial correspondence is normally retained for 24 months after the last meaningful exchange. Security logs are generally retained for 90 days. Records connected to a legal inquiry may be kept for the period required to establish or defend a claim. Data is deleted or anonymised when the applicable period ends. For example, a reader who emails a correction in March 2026 and receives a reply the same month would have that thread retained until roughly March 2028 under the standard schedule, unless a further reply restarts the clock. The practical consequence of the shorter 90-day window for security logs is that routine browsing activity is not kept long enough to build a long-term behavioural history of an individual visitor. An edge case arises when correspondence becomes relevant to a legal dispute or a regulatory inquiry before the 24-month period ends; in that situation the relevant records are preserved beyond the normal schedule until the matter is resolved, consistent with standard litigation-hold practice. Deletion at the end of a retention period means permanent removal from active systems, while anonymisation, used occasionally for aggregate analytics summaries, strips identifying fields so the remaining statistics can no longer be linked back to a person.

  • a) The 24-month clock for correspondence restarts with each substantive new message in the same thread.
  • b) Backup copies of deleted records are purged on the hosting provider's own backup rotation cycle, typically within 30 to 60 days of the live deletion.
  • c) Legal-hold records are reviewed at the close of the relevant matter to confirm whether continued retention is still justified.

5. Rights

Subject to applicable Indonesian law, you may ask for access, correction, deletion, restriction, or information about processing. You may withdraw consent for optional analytics at any time. Send a clear request to the contact details on our Contact page. We may need reasonable verification before responding. In practice, an access request means we will tell a reader what correspondence, if any, we hold under their name or email address, while a correction request might involve fixing a misspelled name attached to a past message. A concrete example of restriction is a reader who disputes whether a message should still be retained pending a dispute; in that case we pause active use of the record while the matter is reviewed, without deleting it outright. The practical consequence of the verification step is a short delay, usually no more than a few days, while we confirm that a request genuinely comes from the person whose data is involved, which protects readers from a third party impersonating them. An edge case involves a request submitted in a language other than English; we will still process it and may reply in the same language where a team member is able to do so, or otherwise request clarification.

  • a) Access and correction requests are generally the fastest to resolve, often within the standard acknowledgment window noted in Section 10.
  • b) Deletion requests affecting records under an active legal hold will be acknowledged but may be delayed until the hold is lifted.
  • c) Verification may involve replying from the same email address originally used to contact us, or confirming details only the original sender would know.

6. Processors

Hosting, email delivery, security monitoring, and analytics providers may process limited information on our instructions. Providers are selected for appropriate confidentiality and security commitments. They may not use contact messages for their own unrelated purposes. A current provider question can be sent to Zenith. Concretely, our hosting infrastructure stores the site files and server logs, a transactional email service relays replies sent from the Contact page, and, where enabled, a privacy-conscious analytics tool aggregates anonymised visit counts. The practical consequence of using processors rather than handling every function in-house is that a modest, editorially focused publication like Zenith can maintain reasonable security and reliability without operating its own data centre, while still remaining responsible for how those providers handle information on our behalf. An edge case arises if a processor itself suffers a security incident; our agreements with processors require prompt notification to us so we can assess whether the incident affects Zenith readers and whether further steps, including notice under Section 9, are required. We do not permit processors to repurpose contact-form content for their own product development or marketing. By name, the processors currently engaged by Zenith are: Cloudflare, Inc., which provides content delivery and security filtering for the site; Google Asia Pacific Pte. Ltd. (Google Workspace), which handles internal and reply email for the editorial team; Hetzner Online GmbH, which provides the underlying server infrastructure on which the site is hosted; and, where the analytics cookie category is accepted, Plausible Analytics, a privacy-focused analytics provider that does not use cookies to build cross-site profiles. Each of these providers is contractually limited to processing information strictly for the service described here, and none is authorised to sell or independently repurpose data collected through Zenith.

  • a) Hosting and email-delivery providers are considered core processors necessary for the site to function at all.
  • b) Analytics providers are engaged only on an opt-in basis tied to the cookie banner described in Section 7.
  • c) Processor contracts include confidentiality obligations consistent with the Personal Data Protection Law's requirements for data processing agreements.

7. Cookies

Essential session technologies support navigation and security. Optional analytics cookies, where enabled, are described in the Cookies policy and are not required to read public pages. Lifespans vary, with session cookies ending when the browser closes and analytics identifiers generally limited to 13 months. You can reject optional cookies using the banner. For a full account of individual cookie names, purposes, and exact lifespans, including the first-party cookieChoice preference, see the dedicated Cookies policy, which this section summarises rather than duplicates. The practical consequence of rejecting optional cookies is that every public article, including the physiology and training sections, remains fully readable, since no content is gated behind an analytics or marketing cookie. An edge case involves a reader who clears browser storage mid-session; essential session cookies will be reissued automatically on the next page load, while the analytics opt-in choice, if previously given, will need to be re-confirmed through the banner. We do not use cookies to build cross-site advertising profiles of individual readers.

  • a) Essential cookies are exempt from the consent requirement under applicable guidance because they are strictly necessary for the site to operate.
  • b) Analytics cookies are never set before a reader makes an affirmative choice on the banner.
  • c) Clearing the cookieChoice value causes the banner to reappear on the next visit, as described further in the Cookies policy.

8. International transfers

Some hosting or infrastructure providers may process data outside Indonesia. We consider contractual, technical, and organisational safeguards appropriate to the service. Transfers are limited to the information needed for the stated purpose. Contact us if you need more detail about a particular request. A concrete example is a content delivery or cloud hosting provider operating data centres in Singapore or another regional hub, which may temporarily route or cache technical log data outside Indonesian territory as part of normal infrastructure operation. The practical consequence of such a transfer is typically improved page-loading speed and resilience for readers, balanced against the need for appropriate safeguards such as contractual data protection clauses with the provider. An edge case would be a request from a reader specifically asking which country holds backup copies of their correspondence; we will provide a general description of the hosting architecture to the extent that disclosing exact technical details would not itself create a security risk. We review processor locations periodically as part of our vendor selection process, consistent with the cross-border transfer expectations under the Personal Data Protection Law.

  • a) Cross-border processing is limited to technical infrastructure functions, not sold or shared onward for commercial purposes.
  • b) Where a provider is located outside Indonesia, we seek contractual commitments comparable to local protection standards.
  • c) A reader may ask, through Contact, for a general description of where core infrastructure is hosted.

9. Security

We use access controls, encrypted connections where supported, and limited administrative access. No internet service can promise absolute security. We review unusual activity and may preserve relevant logs for 90 days. If a material incident affects personal information, we will follow applicable notification requirements. In practice this means the site is served over an encrypted HTTPS connection, administrative access to hosting and email systems is limited to a small editorial and technical team, and login credentials for those systems are not shared broadly. A concrete example of unusual activity is a sudden spike in automated form submissions resembling a spam campaign, which triggers a manual review and, where needed, temporary rate limiting. The practical consequence of the 90-day log retention window described here and in Section 4 is that we retain enough history to investigate a recent incident without keeping indefinite behavioural records. An edge case is a suspected but unconfirmed incident, such as an unusual login attempt that is blocked automatically; we log and review these events but do not treat every blocked attempt as a reportable incident requiring reader notification, reserving that step for confirmed events involving actual exposure of personal information.

  • a) Encrypted connections are applied site-wide, not selectively to sensitive pages only.
  • b) Administrative access follows a least-privilege approach limited to staff who need it for their role.
  • c) Confirmed incidents affecting personal data trigger an assessment of notification obligations under the Personal Data Protection Law and, where phone contact is more appropriate, direct outreach using the details a reader previously provided.

10. Complaints

First contact Zenith at +62 812 7384 5901 or through the Contact page so we can investigate. Include the relevant page, date, and concern without sending unnecessary sensitive data. We aim to acknowledge privacy requests within five working days. You may also contact the competent Indonesian authority where available. A concrete example of a well-formed complaint is a message stating the date a contact form was submitted, the general nature of the concern, such as a request to delete an old message, and a preferred reply method. The practical consequence of the five-working-day acknowledgment target is that a reader will typically hear back with at least a confirmation that the matter is being looked into, even if full resolution takes longer for more complex requests. An edge case involves a complaint received outside normal Jakarta business hours or around a public holiday; acknowledgment may extend slightly into the following working week, and we note this possibility rather than promising an exact figure regardless of circumstance. Escalation to the competent Indonesian supervisory authority remains available to a reader who is not satisfied with how a complaint was handled directly.

  • a) Phone complaints are logged with the same reference details as written ones to ensure consistent follow-up.
  • b) Complex requests involving multiple past messages may take longer than five working days to fully resolve, though acknowledgment still falls within that window.
  • c) A reader dissatisfied with our response retains the right to raise the matter with the relevant Indonesian authority.

11. Children

Zenith is written for adults and does not knowingly collect information from children. We do not create child profiles or target children with advertising. If a guardian believes a child submitted information, contact us promptly. We will review and delete it where appropriate. In practice, our editorial subject matter, functional training and physiology for men 35 and older, is simply not designed to attract a youth audience, which limits incidental collection as a practical matter even without a formal age-gate. A concrete example would be a guardian discovering that a household email address, shared with a child, was used to submit a question through the Contact page; upon notification we would locate and remove the relevant message promptly. The practical consequence of our no-child-targeting stance is that no advertising, where it exists under the Advertising policy, is ever configured to target a youth demographic. An edge case is a message that provides no clear indication of the sender's age; absent a specific report from a guardian, we have no reliable way to determine age from a short text message alone, so we rely on guardians to flag the situation as described here.

  • a) Guardian reports are treated as a priority item and reviewed promptly upon receipt.
  • b) Deletion in this context includes removing the relevant message content from active correspondence records.
  • c) We do not ask for or record a sender's age on the standard contact form.

12. Changes

Version 1.0 was published October 1, 2026. Future revisions will show a new effective date and a short change description. We may make minor wording corrections without changing the underlying practice. Readers should review this page periodically. A concrete example of a minor correction would be fixing a typo in a retention period without altering the actual duration applied, which would not warrant a new version number. By contrast, introducing a new analytics vendor or a newsletter sign-up feature would be treated as a material change requiring a new effective date and a visible note describing what changed. The practical consequence of this approach is that long-time readers can tell, from the version history alone, whether a change affects how their information is handled or is purely cosmetic. An edge case is a change required by an update to Indonesian data protection guidance itself; in that situation we will revise the policy promptly to remain aligned with current legal expectations and will describe the change plainly rather than burying it in general language.

  • a) Minor wording or formatting corrections do not trigger a new version number.
  • b) Any new data-collection feature results in a new effective date and an explanatory note at the top of this page.
  • c) Legally required updates are prioritised and published as soon as the revised text has been reviewed internally.