Privacy Policy

1. Overview & Data Controller

This Privacy Policy describes how Nongshim Indonesia ("we", "our", or "us") collects, uses, stores, and protects personal information obtained through the SHINsational platform (the "Platform"), including when you authenticate using Google Sign-In, update your participant profile, or submit competition entries.

2. Information We Collect

We only collect data necessary to provide secure access and administer the contest:

• Google Authentication (OAuth 2.0): When you choose to sign in with Google, we request the standard openid email profile scopes to access your full name, verified email address, and Google Subject ID (sub). We do not access contacts, emails, Google Drive, or any other Google user data.
• Contact & Account Details: Your full name, email address, password hash (for direct email registrations; omitted for Google OAuth accounts), and your Indonesian WhatsApp phone number (E.164 format, e.g. +628...) for participant verification and prize announcements.
• Contest Submissions: Your submitted public video URL (TikTok, Instagram, or YouTube), platform identifier, creator handles, retailer channel (SHINsational general, Alfamart Group, or Indomaret Group), store name, item count, and your story caption ("My SHIN Moment").
• Proof of Purchase (Receipts): Uploaded photos or PDF files of purchase receipts, file metadata, and an authoritatively computed SHA-256 cryptographic digest to detect duplicates and prevent submission fraud.
• Device & Technical Data: Client IP address, browser/device user agent, HTTP session cookies, and activity timestamps used for security monitoring and rate limiting.

3. Google API Services User Data Policy Compliance

4. How We Use Your Information

We process personal data strictly for legitimate operational purposes:

• Creating and securing your participant account and authentication sessions.
• Validating entry submissions against campaign rules and retailer receipt criteria.
• Facilitating fair scoring by our authorized judging panel.
• Contacting verified winners regarding the 6-day South Korea trip prize fulfillment.
• Detecting, investigating, and preventing duplicate submissions, bot activity, and fraudulent claims.
• Publishing shortlisted finalist entries and winner announcements on the official campaign website and social media (@nongshimindonesia).

5. Legal Basis for Processing (UU PDP)

Under Indonesia's Personal Data Protection Law (UU No. 27/2022), our legal bases for processing include:

• Consent: Explicit consent provided upon registering, authenticating with Google, and submitting contest entries.
• Contractual Performance: Administering the competition and fulfilling prizes under the Official Campaign Rules.
• Legal Obligations & Legitimate Interests: Complying with statutory reporting, maintaining audit integrity, and protecting against consumer contest fraud.

6. Data Sharing and Third Parties

We never sell your personal data. Data is shared exclusively with:

• Campaign Organizers & Judges: Authorized review teams evaluating entries and validating receipts.
• Retail Validation Partners: Alfamart and Indomaret partner teams solely if physical purchase cross-checking is required.
• Secure Cloud Infrastructure: Encrypted cloud database and hosting providers located in compliance with data localization and security regulations.
• Legal Authorities: When required under Indonesian legal proceedings or regulatory requests.

7. Security & Retention Period

We implement modern technical safeguards including HTTPS transmission, HTTP-only session cookies with SameSite=Lax, cryptographic hashing for sensitive credentials, and isolated storage keys for receipt media. Account and entry records are retained for the duration of the 2026 campaign and archived for up to 12 months post-fulfillment for statutory audit and tax verification.

8. Your Rights & Data Deletion Requests

As a data subject under Indonesian law and international privacy standards, you have the right to access, correct, or request the deletion of your personal data.

9. Contact Us

For questions regarding this policy or personal data protection:

Nongshim Indonesia — SHINsational Campaign Team
Email: contact@shinsational.com
Official Channels: Instagram & TikTok @nongshimindonesia