DRAFT — not yet in effect. This document must be reviewed by legal counsel before publication.
This is an English translation provided for convenience. In the event of any inconsistency, the Indonesian version prevails.
1. About this policy
This Privacy Policy explains how [LEGAL ENTITY NAME], domiciled at [FULL ADDRESS] ("we"), as the operator of Taksu POS, obtains, collects, processes, analyses, stores, corrects, displays, transmits and deletes personal data.
This policy is based on Law No. 27 of 2022 on Personal Data Protection (the "PDP Law"), Law No. 11 of 2008 on Electronic Information and Transactions as amended (the "EIT Law"), Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions ("GR 71/2019"), and their implementing regulations. It forms an integral part of our Terms of Service.
2. Our role
- As Personal Data Controller for registration and account data: business owners, admins and staff who use Taksu POS.
- As Personal Data Processor for your business's customer data (for example names, phone numbers, purchase history and vehicle data when the workshop module is used). For this data, your business is the Controller, and we process it only on your business's instructions through the app's features, in line with Article 51 of the PDP Law.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Identity & contact of the responsible person | Full name, position, email address, WhatsApp number | Registration form |
| Business profile | Business name, legal form, registered entity name, NIB (business ID number) and NPWP (tax ID) if provided, address, province, city/regency, postal code, business phone, business type | Registration form & settings |
| Account & security | Password and PIN (stored as hashes that cannot be read back), two-step verification secret (encrypted), recovery codes (hashed), sign-in history | You |
| Business operations | Branches, items, prices, stock, transactions, work orders, cashier shifts, expenses, item photos | Use of the app |
| Your business's customers (we act as Processor) | Name, phone number, address (optional), transaction history, receivables, plate numbers and vehicle data | Entered by your business |
| Subscription billing | Plan, period, amount, payment status and reference. We do not store card numbers or full bank account details. | You & payment provider |
| Technical & security | IP address, device and browser type, registered checkout device identifiers, audit log of important actions | Automatic |
| Consent | Version of the documents accepted, time and IP address of acceptance, marketing preference | Automatic on sign-up |
In line with the data minimisation principle, we do not ask for your national identity number (NIK), a photo of your ID card, or specific personal data as referred to in Article 4(2) of the PDP Law in order to register.
4. Legal basis & purposes
| Purpose | Legal basis (Article 20 PDP Law) |
|---|---|
| Creating your account, providing features, customer support | Performance of a contract |
| Identity verification (OTP), two-step verification, fraud and abuse prevention, audit logs | Legitimate interests and performance of a contract |
| Subscription billing, tax invoices, bookkeeping | Compliance with legal obligations (including tax regulations) |
| Important notices about your account, security and service changes | Performance of a contract |
| Product news, business tips and offers | Explicit consent (optional, withdrawable at any time) |
| Aggregate analysis to improve the service | Legitimate interests, using aggregated data |
We do not sell personal data and do not use your business's customer data for advertising or our own purposes.
5. Third parties
We share data only with providers that help us run the service, only to the extent necessary, and under agreements requiring them to protect the data:
| Provider | Function |
|---|---|
| [DATA CENTRE PROVIDER] | Servers and databases |
| Cloudflare, Inc. | Content delivery network and security protection |
| [EMAIL PROVIDER] | Email delivery (one-time codes, notifications, invoices) |
| Fonnte | WhatsApp message delivery (one-time codes, notifications) |
| PT Xendit Indonesia | Subscription payments; and dynamic QRIS when your business connects its own Xendit account |
We may also disclose data where required by law or upon a lawful request from law enforcement, and in connection with a merger, demerger or acquisition, with notice to you in accordance with Article 48 of the PDP Law.
6. International transfers
Primary data is stored in [DATA CENTRE LOCATION, e.g. Jakarta region, Indonesia]. Some providers listed in section 5 may process data outside Indonesia. Where this happens, we ensure that the destination country or provider offers an equal or higher level of data protection, or that adequate and binding safeguards are in place, in accordance with Article 56 of the PDP Law.
7. Security
- All connections are encrypted (HTTPS/TLS). Passwords are hashed with Argon2id; PINs and recovery codes are also stored as hashes.
- Each business's data is technically isolated at the database level (Row Level Security).
- Owner accounts must use two-step verification. Checkout devices must be approved by the owner and can be revoked remotely.
- Every transaction is signed by the device and recorded in a tamper-proof audit log.
- Some branch data is stored on registered checkout devices so the app keeps working offline. You are responsible for the physical security of those devices.
8. Retention
- Account and business data are kept while the account is active.
- After the owner closes the account, all business data is permanently deleted within 30 days. During that period, closure can be cancelled and data can still be exported.
- Subscription billing records and proof of consent are kept for 10 years to meet bookkeeping retention obligations under Indonesian tax law, then deleted.
- Security logs are kept for up to [12 months] unless needed to investigate an incident.
9. Your rights as a data subject
Under Articles 5 to 13 of the PDP Law, you have the right to:
- obtain information about our identity and the basis, purpose and accountability of the processing;
- access and obtain a copy of your personal data;
- complete, update and correct inaccurate data;
- end processing of, delete and/or destroy your personal data;
- withdraw consent you have given, including marketing consent;
- object to decisions based solely on automated processing;
- suspend or restrict processing;
- obtain and/or use your data in a commonly used, machine-readable format;
- sue and receive compensation for violations in the processing of your personal data.
Most rights can be exercised directly in the app: edit data in Settings, download all data or close the account in Settings → Data & privacy. Customers of a business who want their data deleted can contact that business, which can delete it via Customers → Delete personal data. For other requests, contact us as set out in section 14; we respond within 3 × 24 hours of receiving the request.
10. Local storage & cookies
The app uses the browser's local storage (localStorage and IndexedDB) for sign-in sessions, checkout device identity and offline data. This storage is necessary for the service to work. We do not use advertising cookies or third-party trackers.
11. Minors
The service is intended for business operators aged at least 18 or otherwise legally competent. We do not knowingly collect children's personal data. If your business enters a child's data as a customer, your business must obtain the consent of a parent or guardian in accordance with Article 25 of the PDP Law.
12. Data breaches
In the event of a personal data protection failure, we will notify affected data subjects and the competent authority in writing within 3 × 24 hours of becoming aware of it, stating the data disclosed, when and how it occurred, and the handling and recovery measures, in accordance with Article 46 of the PDP Law. For your business's customer data, we will notify your business as Controller without delay.
13. Changes to this policy
We may update this policy. Material changes are announced in the app and/or by email at least 14 days before they take effect. Where a change requires new consent, we will ask for it again.
14. Contact us
Questions, requests or complaints about personal data can be sent to our Data Protection Officer:
- Email: [PRIVACY EMAIL, e.g. privasi@taksupos.id]
- WhatsApp: [WHATSAPP NUMBER]
- Post: [LEGAL ENTITY NAME], [FULL ADDRESS]