Privacy Policy

PT Inovatera Nusantara Anugrah, domiciled in Yogyakarta, Indonesia, acts as the Personal Data Controller for account data and Service usage data of business owners (merchants) and the staff they register.

If you are a merchant and enter other people's personal data into the Service (for example, data of your staff or your outlet's customers), you act as the Personal Data Controller for that data and SmartKris acts as a Personal Data Processor, processing it on your instructions.

Depending on how you use the Service, we may collect the following data:

• Account data: name, email address, phone or WhatsApp number, login credentials, and user roles and access rights.
• Business data: merchant and outlet names, outlet addresses, machine lists, and staff structure.
• Financial data: destination bank account details for fund withdrawals, balances, withdrawal request history, and cash flow reports. We do not store your payment card data.
• Transaction data: time, amount, status, related machine, and reference numbers of QRIS and manual payments recorded in the Service.
• Device and operational data: IoT device identifiers, machine status (online, offline, in use), remote power command history, and firmware versions and update history.
• Technical and usage data: IP address, browser and device type, operating system, access time, and activity logs (audit trail) inside the dashboard.
• Communication data: the content of messages you send us via WhatsApp or email, for example when requesting a demo or technical help.

• Directly from you, for example when you register, fill in business details, request a withdrawal, or contact us.
• Automatically from your use of the Service, including from IoT devices on machines, system logs, and cookies.
• From third parties, such as partner banks or QRIS providers that notify us of transaction status, or from a merchant owner who registers you as staff.

We process personal data only for legitimate purposes related to the Service, namely:

• creating and managing your account and access rights;
• operating machine monitoring, remote power control, and firmware updates;
• processing, recording, and reconciling transactions, and processing withdrawal requests;
• maintaining security, preventing fraud and abuse, and providing audit trails;
• providing customer support and responding to your requests;
• billing subscription fees and other service charges;
• sending service notices, such as system maintenance and changes to terms;
• analyzing and improving the quality of the Service; and
• complying with legal obligations, including bookkeeping and taxation.

Our legal bases for processing are your consent, performance of our agreement with you, compliance with legal obligations, or other legitimate interests as provided by applicable regulations.

We do not sell your personal data. We share data only as needed with:

• partner banks and payment or QRIS providers, to process transactions and withdrawals;
• infrastructure and technology providers, such as hosting, cloud storage, and email or messaging services, who act on our instructions;
• other users within your merchant, according to the roles and access rights set by the merchant owner;
• competent authorities or institutions, when required by law or legal process;
• professional advisers, such as legal and tax consultants and auditors, who are bound by confidentiality; and
• a prospective successor to our business, in the event of a merger, acquisition, or asset sale, with notice to you.

Every party that receives data from us must keep it confidential and secure.

Some of our infrastructure providers may store or process data outside Indonesia. When this happens, we make sure the destination country or recipient offers an equal or higher level of personal data protection, or we apply adequate safeguards as required by applicable regulations.

We keep personal data while your account is active and as long as needed to provide the Service. After that, certain data is retained for the period required by law, for example for bookkeeping, taxation, and dispute resolution. Once that period ends, the data is deleted or anonymized.

We apply reasonable technical and organizational measures to protect your data, including:

• encrypted connections (HTTPS) for data in transit;
• role-based access control so each user sees only the data they are responsible for;
• audit trails for important activity, including use of the impersonation feature by our support team; and
• restricting internal access to personal data to personnel who need it.

No system is completely risk free. If a personal data protection failure occurs, we will notify you and the competent authority in writing within 3 x 24 hours as required by applicable regulations. You are also responsible for keeping your password and the devices you use confidential.

Under the Personal Data Protection Law, you have the right to:

• obtain information about the processing of your personal data;
• access and obtain a copy of your personal data;
• complete, update, or correct inaccurate data;
• request deletion or destruction of your personal data;
• withdraw consent you have given;
• object to decisions made solely on automated processing;
• request postponement or restriction of processing in line with its purpose;
• sue and receive compensation for violations in the processing of personal data; and
• obtain your personal data in a commonly used format, and use or transfer it to another controller where feasible.

To exercise these rights, contact us using the details at the end of this document. We may ask you to verify your identity before processing a request. Some requests, such as deletion, may be limited where we are legally required to retain the data. Withdrawing consent or deleting certain data may also make parts of the Service unavailable.

Our website and dashboard use cookies or local storage that are necessary for the Service to work, for example to keep your login session, security, and basic preferences. You can manage or delete cookies in your browser settings, but some features may not work properly.

If we later add analytics or advertising cookies, we will update this policy and, where required, ask for your consent.

Our Service may link to or connect with third-party services, such as WhatsApp, banks, and payment providers. Data processing by those parties is governed by their own privacy policies, and we are not responsible for their practices.

The Service is intended for business operators and is not directed at children under 18. We do not knowingly collect personal data from children. If you know that a child's data has entered the Service without parental or guardian consent, contact us so we can delete it.

We may update this policy from time to time. The date of the latest update is shown at the top of the page. For material changes, we will notify you through the website, the dashboard, or email. By continuing to use the Service after a change takes effect, you are deemed to accept the updated policy.