Privacy policy

This privacy policy explains how CV San Siro Media Denpasar ("we", "us"), trading as Anggota, collects, uses, stores and protects personal data when you use the Anggota website and service.

We are based in Indonesia and handle personal data in line with Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi, "UU PDP").

1. Who we are

• Legal entity: CV San Siro Media Denpasar, trading as Anggota
• Address: Jalan Sedap Malam No 111A, Kesiman, Bali 80237, Indonesia
• Email: info@anggota.app

2. Our two roles: controller and processor

This distinction matters, because it determines who is responsible for what.

• We are the controller of data about the people who sign up for and administer an Anggota account, and about visitors to our website. We decide how that data is used.
• We are a processor of the member data that an organisation puts into Anggota. If your club or association uses Anggota to manage its members, that organisation is the controller of its members' data. It decides what to collect and why; we process it on that organisation's instructions in order to provide the service.

If you are a member of an organisation that uses Anggota and you want your data corrected or deleted, please contact that organisation first. You may also contact us and we will assist them.

3. What personal data we collect

Account and administrator data

• Name, email address, and password (stored only as a secure hash)
• The organisation you represent, your role in it, and your language preference
• Billing details for your subscription, and records of payments
• Support correspondence you send us

Member data your organisation uploads

Organisations decide what to record about their members. This typically includes names, contact details, membership level and status, renewal dates, payment records, event registrations, and any notes or custom fields the organisation chooses to add. We do not use this data for our own purposes.

Technical and usage data

• IP address, browser and device type, and pages viewed
• Log data needed to operate the service securely and diagnose faults
• Cookies and similar technologies (see section 8)

4. Why we use personal data, and our legal basis

• To provide the service - creating and running your account, processing memberships, renewals, events and payments. Basis: performance of a contract with you.
• To take payment - billing your subscription and, where you use our payment features, passing transaction details to a payment provider. Basis: performance of a contract.
• To support and communicate with you - answering questions and sending service messages such as renewal reminders, security notices and important changes. Basis: contract and our legitimate interest in running the service.
• To keep the service secure and reliable - preventing abuse, fraud and unauthorised access, and maintaining backups. Basis: legitimate interest and legal obligation.
• To meet legal and tax obligations in Indonesia. Basis: legal obligation.
• To send marketing, only where you have agreed. Basis: consent, which you can withdraw at any time.

5. Who we share personal data with

We do not sell personal data. We share it only where necessary:

• Payment providers who process transactions (for example providers supporting QRIS, virtual accounts, e-wallets and cards). They receive the data needed to complete a payment and handle it under their own privacy terms.
• Infrastructure and service suppliers such as hosting, email delivery, error monitoring and analytics, who act on our instructions.
• Your organisation, if you are a member - its administrators can see your membership record.
• Authorities, where we are legally required to disclose data.
• A successor, if the business is transferred, subject to this policy.

6. International transfers

Some of our suppliers operate outside Indonesia, so personal data may be transferred and stored abroad. Where that happens, we take reasonable steps to ensure the data receives an adequate level of protection, as required by UU PDP.

7. How long we keep data

• Account data: for as long as your account is active, and for a reasonable period afterwards to handle disputes and meet legal obligations.
• Member data: for as long as the organisation keeps it in Anggota. When an organisation closes its account, we delete or anonymise the data within a reasonable period, unless we must retain it by law.
• Financial records: for the period required by Indonesian tax and accounting rules.
• Logs and backups: for a limited period, then overwritten on a rolling basis.

8. Cookies

We use cookies that are necessary for the service to work - keeping you signed in, remembering your language, and protecting forms against cross-site request forgery. We may also use limited analytics to understand how the site is used. You can block or delete cookies in your browser, but the service may not work properly without the essential ones.

9. Your rights

Subject to Indonesian law, you have the right to:

• be informed about, and obtain a copy of, the personal data we hold about you
• have inaccurate or incomplete data corrected
• have your data deleted, and to end its processing
• withdraw consent where processing relies on consent
• object to certain processing, and to request that we restrict it
• receive your data in a usable format, where technically feasible
• complain to the relevant Indonesian authority

To exercise any of these, email info@anggota.app. We may need to verify your identity, and we will respond within the period required by law.

10. Security

We protect personal data with measures appropriate to the risk, including encryption in transit, hashed passwords, access controls, and separation of each organisation's data. Administrator access to customer data is limited to what is needed for support and is recorded. No system is completely secure, but if a data breach occurs that poses a risk to you, we will notify affected users and the authorities as required by UU PDP.

11. Children

Anggota is intended for organisations and their administrators, not for children. Where an organisation records data about members under the age of consent, it is that organisation's responsibility to obtain any parental or guardian consent required by law.

12. Changes to this policy

We may update this policy as the service develops or the law changes. We will post the revised version here and update the date at the top. If a change materially affects you, we will tell you directly.

13. Contact us

Questions, requests or complaints about privacy:

CV San Siro Media Denpasar (trading as Anggota)
Jalan Sedap Malam No 111A, Kesiman, Bali 80237, Indonesia
info@anggota.app