Privacy Policy

1. Who is responsible for which data

Biissa is the controller (pengendali data pribadi) of the accounts of business owners and staff: their name, email address, password and the memberships that give them access to a business.

Each business that uses the Service is the controller of the records it keeps about its own customers: names, contact details, orders, bookings, support tickets, gift cards and loyalty points. Biissa processes those records on that business’s behalf and on its instructions, as its processor (prosesor data pribadi). A customer who wants to exercise a right over those records can ask the business, or use the options described on our data deletion page.

2. Information we collect

We collect the following categories of information.

From business owners and staff: name, email address, a hashed password, the businesses and roles you belong to, invitations you accept, the time you accept our Terms and this Policy, and the actions you take in the workspace, such as the sales and stock changes you record.

About a business: its name, currency, language, timezone, tax rate, catalogue, prices, stock, purchases, expenses, accounting journals and the settings its owner chooses.

From a business’s customers: a name; an email address or phone number; birthday, notes and addresses if the business records them; the orders, bookings, gift cards, loyalty points and support messages linked to that customer; and the contact details used to send a sign-in code.

When a customer places an order at a business’s online shop, the items, total, the name and phone number they enter for pickup, and their note are shared with that business so it can prepare the order and reach them. We email the customer’s own address about the order’s progress; those emails carry the business name and order code, not prices or the note.

From sign-in with Google, Apple or Facebook: the identifier those providers give us for your account and, when the provider shares them, your name and email address. We use them only to sign you in to the business you chose and to link that sign-in to your customer record there.

Technical information: IP address, browser and device type, pages visited and timestamps, used to run, secure and improve the Service, and error reports that never include names, email addresses or phone numbers.

3. How we use information

We use personal data to:

• provide the Service and let each business run its sales, purchasing, stock, expenses and books;
• create and secure accounts, verify email addresses and sign people in, including by sending one-time codes by email or WhatsApp;
• send service messages such as invitations, password resets and sign-in codes;
• let customers see their own orders, loyalty points, gift cards and support conversations;
• detect, investigate and prevent fraud, abuse and security incidents;
• meet legal, tax and accounting obligations.

We do not sell personal data, and we do not share it with third parties for their own marketing.

4. Legal bases

We process personal data on the bases recognised in Law No. 27 of 2022 on Personal Data Protection (UU PDP):

• performing the agreement under which we provide the Service;
• complying with legal obligations, including bookkeeping and tax;
• our legitimate interest in operating and securing the Service, where your rights do not outweigh it;
• your consent, where it is required and given.

5. Service providers

We use service providers who process personal data only on our instructions and under confidentiality and security commitments:

• Amazon Web Services: hosting, backups and storage;
• Resend: delivery of emails such as invitations, verification links and sign-in codes;
• Meta (WhatsApp Cloud API): delivery of sign-in codes to a phone number, when a customer chooses WhatsApp;
• Google, Apple and Meta (Facebook): the sign-in options a customer chooses to use;
• Biissa’s payment gateway: payment processing when a customer buys a gift card online; the payment request carries the amount and a transaction reference, not the customer’s name;
• our own observability service: error and performance reports that exclude names, email addresses and phone numbers.

Some providers run servers outside Indonesia. Where data is transferred abroad we apply the safeguards UU PDP requires.

6. Cookies

We use only the cookies and browser storage the Service needs to work: sign-in sessions for staff and for customers, and your language and display preferences. We do not use advertising or analytics cookies in the workspace or the customer portal.

7. How long we keep data

We keep account data while the account is active. When a person’s data is erased we remove their name, contact details, notes, addresses, sessions and linked sign-in accounts, and we replace the name on their records with a placeholder.

When a customer’s data is erased, the contact name, phone number and note on their online orders are cleared; the items, totals and status of the orders stay with the sales records.

We keep the business records that Indonesian bookkeeping and tax rules require, without personal details: sales documents, payments, gift card balances and movements, loyalty balances and accounting journals stay attached to the erased customer record. Financial records are generally kept for up to ten (10) years.

Backups are overwritten on their normal cycle, and providers keep delivery logs for their own retention periods.

8. Your rights

Under UU PDP you may:

• ask whether we process your personal data and get a copy;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data, as described on our data deletion page;
• withdraw consent where processing relies on it;
• object to or ask us to limit certain processing;
• receive your data in a structured, commonly used format;
• complain to the competent supervisory authority.

To use these rights, contact us at the address in section 11. If your data is held in a business’s customer records, we may direct your request to that business, which decides on it as controller. We aim to answer within 30 days.

9. Security

We protect personal data with encryption in transit, hashed passwords, access limited by role, audit trails for sensitive actions and regular review of our security. No system is completely secure, so we cannot promise absolute security.

10. Children and changes

The Service is meant for businesses and the adults who run them or buy from them. It is not directed to children under 13 and we do not knowingly collect their data.

We may update this Policy. The effective date and version at the top show which version applies. If a change is significant we will tell you through the Service or by email in advance.

11. Contact

For questions, requests or complaints about this Policy or your personal data, contact PT. Biissa Maju Bersama at admin@biissa.com.