Privacy Policy

1Introduction

PT. Kustomer Indonesia Sejahtera ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our platform and services.

This policy applies to all data processing activities related to:

• ✓Our website at kustomersuite.id and all subdomains
• ✓The Kustomer Suite platform and mobile applications
• ✓Customer support interactions and communications
• ✓Marketing communications (with your consent)
• ✓Third-party integrations facilitated through our Service

2Information We Collect

2.1 Information You Provide Directly

• ✓Account information: name, email address, phone number, password
• ✓Business information: company name, business address, industry, team size
• ✓Payment information: billing details (processed securely via our payment partners)
• ✓Content you create: knowledge base articles, chatbot scripts, message templates
• ✓Support communications: tickets, chat logs, and feedback you submit
• ✓Identity verification documents (for Business/Corporate plans)

2.2 Automatically Collected Information

• ✓Usage data: features accessed, pages visited, time spent, actions taken
• ✓Device information: browser type, operating system, screen resolution, IP address
• ✓Log data: access times, error reports, API requests, performance metrics
• ✓Conversation metadata: message volumes, response times (not message content without consent)
• ✓Cookies and tracking technologies (see Section 9)

2.3 Information from Third Parties

• ✓Social login data: if you sign in via Google or another OAuth provider
• ✓Payment processors: transaction status and payment verification data
• ✓Channel platforms: WhatsApp, Telegram, Instagram account metadata (not message content beyond your use)
• ✓Analytics providers: aggregated, anonymized usage statistics

3How We Use Your Information

Essential Services (required for the Service to function)

• ✓Provide, operate, and maintain the Kustomer Suite platform
• ✓Process payments, issue invoices, and manage subscriptions
• ✓Provide customer and technical support
• ✓Send transactional notifications (account alerts, billing, security)
• ✓Authenticate your identity and prevent unauthorized access

Business Operations (legitimate interest)

• ✓Analyze usage patterns to improve features and user experience
• ✓Detect, investigate, and prevent fraudulent or abusive activity
• ✓Comply with legal and regulatory obligations
• ✓Enforce our Terms of Service and other agreements
• ✓Conduct security audits and ensure data integrity

Optional Uses (with your explicit consent)

• ✓Send marketing emails, newsletters, and product updates
• ✓Personalize your experience based on usage preferences
• ✓Conduct user research, surveys, and interviews
• ✓Share anonymized case studies or testimonials (with permission)

4Data Sharing & Disclosure

4.1 Service Providers

We share data with trusted service providers who help us operate the Service, under strict confidentiality agreements:

4.2 Legal Requirements

We may disclose your information when required by law, including in response to:

• ✓Valid court orders or legal process under Indonesian law
• ✓Legitimate government or law enforcement requests (Kominfo, Polri)
• ✓Protection of the rights, property, or safety of Kustomer Suite, our users, or the public

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the successor entity. We will notify you at least 30 days in advance and ensure the same level of data protection is maintained.

5Data Security

5.1 Technical Measures

• ✓Encryption in transit: TLS 1.3 for all data transmitted to and from our servers
• ✓Encryption at rest: AES-256 encryption for all stored data
• ✓Regular penetration testing and vulnerability assessments (quarterly)
• ✓Strict access controls: role-based permissions with least-privilege principle
• ✓Activity logging and anomaly detection for all administrative access
• ✓Multi-factor authentication (MFA) required for admin accounts

5.2 Organizational Measures

• ✓ISO 27001:2022 certified Information Security Management System
• ✓Regular security training for all employees handling personal data
• ✓Comprehensive incident response procedures
• ✓Data breach notification within 72 hours (GDPR Art. 33 & UU PDP)
• ✓Background checks for employees with data access
• ✓Data Protection Officer (DPO) appointed

Despite our best efforts, no security system is 100% impenetrable. You also share responsibility for protecting your account by using a strong, unique password and enabling MFA in Account Settings.

6Data Retention

We retain your data only for as long as necessary to fulfill the purposes described in this Policy, or as required by law:

You may request early deletion of your data. We will honor such requests subject to legal obligations that require us to retain certain records.

7Your Rights

Under the Indonesian Personal Data Protection Law (UU PDP), GDPR, and other applicable regulations, you have the following rights:

8International Transfers

Your data is primarily stored and processed on servers located in Jakarta, Indonesia (AWS ap-southeast-3 region), in compliance with PP 71/2019 on Electronic System Operation.

For international customers and third-party service providers:

• ✓We comply with GDPR requirements for EU/EEA data subjects
• ✓Standard Contractual Clauses (SCCs) are in place for transfers to countries without adequate protection
• ✓Sub-processors are contractually bound to equivalent data protection standards
• ✓Adequacy decisions are relied upon where applicable

If you are located outside Indonesia, your use of the Service involves a transfer of your personal data to Indonesia. By using the Service, you acknowledge this transfer and consent to processing under Indonesian law.

9Cookies & Tracking

We use cookies and similar tracking technologies to improve your experience and understand how the Service is used.

You can manage cookie preferences via your browser settings. Note that disabling essential cookies may impair Service functionality. See our Cookie Policy for full details.

10Children's Privacy

Our Service is intended exclusively for business use by individuals who are at least 18 years of age. We do not knowingly collect, process, or store personal data from individuals under 18.

If you are a parent or guardian and believe that your child has provided us with personal data, please contact us immediately at [email protected]. We will take prompt action to delete such data from our systems.

11Changes to Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will notify you of changes as follows:

Continued use of the Service after changes become effective constitutes your acceptance. If you do not agree with the updated policy, please discontinue use and contact us to close your account.

Previous versions of this Privacy Policy are available at /legal/privacy/archive.

12Contact & Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee our data protection strategy and compliance.