Privacy policy

This notice explains what we do with personal data. It covers both the people who run an Anggota account and the members whose records those organisations keep here, because the answer is quite different for each - and that difference is the most useful thing on this page.

Anggota is operated by CV San Siro Media Denpasar of Jalan Sedap Malam No 111A, Kesiman, Bali 80237, Indonesia. You can reach us about anything here at [email protected]. We are an Indonesian company and we work to Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Pelindungan Data Pribadi, "UU PDP").

Are you an administrator, or a member?

Almost every question about privacy here resolves once you know which of the two you are.

If you run an organisation on Anggota - you signed up, you administer the account - then for your own account details we are the one responsible - in the language of UU PDP, we are the controller of that data. We decided to collect it and we decide how it is used, and this notice describes that.

If you are a member of a club or association that uses Anggota, your record belongs to that organisation, not to us. They chose what to record about you and why; we hold it and work with it on their instructions and nothing more. In legal terms they are the controller of your data and we are their processor, and we do not use it for anything of our own. So if you want your details corrected or removed, ask the organisation first - they can do it themselves in minutes. You are also welcome to write to us and we will help them do it.

What ends up in our hands

From administrators, we hold your name and email, the password you set (kept only as a one-way hash, never as text we could read), the organisation you represent and your role in it, your language preference, your billing details and payment history, and whatever you have sent us in support conversations.

From organisations about their members, we hold whatever that organisation decided to record - typically names, contact details, membership level and status, renewal dates, payment history, event registrations, and any custom fields or notes they added. The choice of what to collect is theirs, not ours.

From everybody who visits, we log the ordinary technical traces a web service produces: IP address, browser and device, pages viewed, and the diagnostic records we need to keep the service secure and to work out what went wrong when something breaks.

Why we hold it

Running your account and everything in it - memberships, renewals, events, payments - is the main reason, and the basis for it is simply the agreement between us. The same goes for taking your subscription payment and, where you collect money from members, passing what a payment provider needs to complete the transaction.

We also use it to answer your questions and to send you the service messages that matter: a renewal notice, a security alert, a change you would want to know about. That rests partly on our agreement and partly on our legitimate interest in running a service that works.

Keeping the service secure and reliable - stopping abuse and unauthorised access, maintaining backups - is a legitimate interest and in places a legal obligation. Meeting Indonesian tax and accounting requirements is straightforwardly a legal obligation. And we only send marketing where you have said yes, which you can take back at any time without it affecting anything else.

Who else sees it

We do not sell personal data, and we do not share it for anyone else's advertising. It leaves us in four situations.

Payment providers receive what they need to complete a transaction - the ones behind QRIS, virtual accounts, e-wallets and cards. They handle it under their own privacy terms. Suppliers who help us operate - hosting, email delivery, error monitoring, analytics - act on our instructions and nothing more. Your own organisation sees your membership record, if you are a member; that is rather the point of it. And authorities receive data where the law requires us to hand it over. If the business is ever sold or transferred, a successor would take it on under this same notice.

Where it lives

Some of the suppliers above operate outside Indonesia, so personal data may be stored or processed abroad. Where that happens we take reasonable steps to make sure it keeps an adequate level of protection, as UU PDP requires.

How long we keep it

Account data stays while your account is open, and for a reasonable period afterwards so that disputes and legal obligations can be dealt with. Member data stays for as long as the organisation keeps it here; when an organisation closes its account we delete or anonymise it within a reasonable period, unless something must be retained by law. Financial records are kept for the period Indonesian tax and accounting rules require. Logs and backups roll over on a limited cycle and are then overwritten.

Cookies

We use the cookies the service genuinely needs: keeping you signed in, remembering which language you read in, and protecting forms against cross-site request forgery. We may also use limited analytics to see how the site is used. Your browser can block or clear cookies, though without the essential ones parts of the service will not work.

What you can ask us to do

Under Indonesian law you can ask to be told what we hold about you and to receive a copy of it; to have anything wrong or incomplete corrected; to have your data deleted and its processing stopped; to withdraw consent where consent is what we relied on; to object to certain processing or ask us to restrict it; to receive your data in a form you can take elsewhere, where that is technically possible; and to complain to the relevant Indonesian authority if we have not handled something properly.

Email [email protected] to do any of these. We may need to confirm who you are first, and we will answer within the period the law sets. If you are a member of an organisation rather than an account holder, please see the second section above - the organisation can usually act faster than we can.

How we protect it

Data is encrypted in transit, passwords are stored only as hashes, access is controlled, and each organisation's data is kept separate from every other organisation's. Our own access to customer data is limited to what a support request actually needs and is recorded when it happens.

No system is perfectly secure, and we would rather say so than imply otherwise. If a breach happens that puts you at risk, we will tell affected users and notify the authorities as UU PDP requires.

Children

Anggota is built for organisations and the people who administer them, not for children. Where an organisation records data about members below the age of consent, obtaining any parental or guardian consent the law requires is that organisation's responsibility.

When this notice changes

We will revise this page as the service develops and the law moves, with the date at the top updated each time. If a change materially affects you we will tell you directly rather than leaving you to notice.

Getting in touch

Questions, requests and complaints about privacy all go to the same place:

CV San Siro Media Denpasar (trading as Anggota)
Jalan Sedap Malam No 111A, Kesiman, Bali 80237, Indonesia
[email protected]