Privacy Policy

This policy explains what data we collect when you use Nawasena ERP, what that data is used for, where it is stored, and what your rights are. Nawasena ERP is made and run by PT Nawasena Karya Nusantara (a PT Perorangan, a limited company with a single owner), referred to here as "we". This policy follows Law Number 27 of 2022 on Personal Data Protection (UU PDP).

1. Our role

• For account data, billing data, and free trial sign-up data, we are the data controller.
• For the business data you record in the application, such as data on customers, suppliers, employees, salaries, and transactions, you are the data controller. We are only the processor that stores and processes that data on your instructions.
• For that reason, you are the one who tells your customers and employees that their data is recorded in this system.

2. Data we collect

When you sign up for a free trial or subscribe

• Name, email address, and phone or WhatsApp number as contact details.
• Business name, type of business, and short answers about your business. We use them to suggest plans and modules.
• Password, stored in scrambled form (hash) so that we cannot read it.
• Email verification codes, also in scrambled form.
• IP address and device type at sign-up, to prevent fake sign-ups.

For billing

• Business name, NPWP (tax ID number) if you fill it in, email, phone number, plan, invoice amount, and payment status.
• For payments through Midtrans, card numbers and bank account details are handled directly by Midtrans and are not stored by us.
• We do not ask for your bank account number, except in one situation. If there is an overpayment because of a duplicate charge or a wrong amount, and the money cannot be returned through Midtrans, we ask for a bank account number in the payer's name, only for that transaction. We use this data only for that transfer.

Business data in your application

• Everything you and your staff record. This can include personal data of other people, for example customer data, employee salaries, or attendance locations and photos.
• Each of our customers has its own database, separate from other customers.

Usage and security data

• User accounts, sign-in sessions (IP address and browser type), the audit trail, and server error logs.
• Once a day, the application sends a short health report to our central server: the application version, the number of users, the last sign-in time, and the number of documents in the last 7 and 30 days. Document contents, your customers' names, and money amounts are not sent.
• If the owner answers the question "What would you most like to fix?", the answer is included in this report. It contains the options ticked and, if "Other" is chosen, a short sentence typed by the owner (at most 120 characters). This question can be skipped. Please do not write people's names or numbers in that field.

Nawa AI

Nawa AI only runs if the business owner switches it on. Nawa only answers questions about how to use the application, your own business data, financial analysis, and your business's taxes. To answer, Nawa only reads the reports that the user asking is allowed to open. Nawa cannot create, change, or delete data.

When it is on, your questions and the business data needed to answer them are sent through our central server to Alibaba Cloud Model Studio in Singapore, which runs the Qwen AI model. On the central server, we only record how much it is used, not the content of the questions. Chat history is stored in your own application's database and can only be opened by the user who asked. The Audit Trail in the application records who asked, when, from which screen, and which reports Nawa read, without the content of the questions and answers. The owner can switch Nawa AI off at any time.

3. What the data is used for

• Running the application and your account.
• Checking your email address at sign-up.
• Billing subscriptions, and sending invoices, reminders, and receipts by email.
• Keeping things secure, for example limits on sign-in attempts, two-step verification, and the audit trail.
• Monitoring the health of installations so that problems are spotted quickly.
• Contacting free trial sign-ups to follow up on their registration. You can opt out at any time by email.
• Reading the answer to "What would you most like to fix?" so that our customer service can help with that area. The question can be skipped and the answer can be changed in Settings.
• Answering your questions on WhatsApp for customer service and the Exclusive service. The basis is your own request when you contact us, or our agreement with you.
• Running Nawa AI, only with the business owner's consent.

Verification codes, password reset codes, invoices, receipts, reminders, and other system notices are sent by email. We only use WhatsApp for customer service and the Exclusive service.

We do not sell your data. We do not use your business data for advertising or to train AI models.

4. Where data is stored

• Our central system and the applications we manage for you run on servers in Indonesia.
• Traffic to our central system and to the applications we manage for you, including free trial systems, passes through the Cloudflare network before it reaches our servers. Cloudflare records IP addresses and checks every request for security, for example to stop attacks and bots. We do not switch on Cloudflare's visitor analytics or tracking features.
• If the application is installed on your own computer or server, the business data is kept there and we do not hold it.
• Backups are made every day on the same server. If you connect your own Google Drive, a copy of the backup is also sent to your Drive.
• A backup copy of our central database is also stored in the Google Drive of PT Nawasena Karya Nusantara. The central database holds, among other things, sign-up data, billing data, and daily health reports.
• For subscribed applications we manage for you, a daily backup copy is also kept in the Google Drive of PT Nawasena Karya Nusantara for 14 days. Free trial systems are not copied. The copy is locked (encrypted) before it leaves the server, so neither Google nor our server can open it. Only PT Nawasena Karya Nusantara holds the key to open it.

5. Other parties that process data

The following providers only receive the data needed for their task.

Some features use your own accounts with other services, namely your own Google Drive for backups, your business's own Midtrans account if guests pay their bills online, and browser notification services. For those services, the data relationship is between you and that provider.

6. Sending data abroad

Some of the providers above are outside Indonesia, namely in Singapore (Nawa AI, and website backups at Hostinger), the European Union (email), and the United States and other countries (customer service and Exclusive service chats on WhatsApp, which Meta processes, central database backups as well as encrypted backup copies of the subscribed applications we manage, in Google Drive, and traffic that passes through the Cloudflare network). Requests to our central system and the applications we manage may pass through Cloudflare servers outside Indonesia. We only send the data needed for that service, and we choose providers that protect data to a standard equal to or higher than UU PDP, or that are bound by an agreement to protect it. Nawa AI sends nothing before the business owner agrees.

7. How long data is kept

• Account data and business data are kept for as long as you subscribe.
• If your subscription is not renewed, the application keeps running fully during a 14-day grace period. After that the application becomes read-only. You can still open, print, and export data.
• Applications we manage can still be opened read-only for 90 days after the grace period ends. After that the application is shut down and its data is deleted. Before deleting, we contact the owner by email.
• The free trial lasts 7 days. After that you can only view data until you subscribe. If you do not subscribe, the trial system and all its data are deleted 2 days after the trial ends. We do not keep a copy.
• Data of people who signed up but did not subscribe, including the answer to "What would you most like to fix?", is kept for at most 365 days from their last sign-up.
• Our billing records are kept for 10 years because of our tax obligations.

8. Security

• All connections to the applications we manage use HTTPS.
• Passwords are stored in scrambled form (hash).
• After you subscribe, two-step verification is required for the owner (Commissioner), directors, and our staff accounts that sign in to your system. The owner can also require it for other roles in Settings. During the free trial it is not required for anyone.
• Access is limited by role. Every change to data is recorded in the audit trail.
• Sign-in attempts are limited to prevent password guessing.
• Each customer's database is separate, and backups are made every day.

No system is completely secure. If a personal data breach happens, we notify you and the relevant authority no later than 3 x 24 hours after we become aware of it.

9. Your rights

Under UU PDP, you have the right to an explanation about your data, to see it and ask for a copy, to correct data that is wrong, to ask for data to be deleted, to withdraw consent, to ask for processing to be postponed or restricted, and to receive data in a machine-readable format.

How to make a request

1. Send an email to ptnawasenakaryanusantara@gmail.com with the subject "Permintaan Data Pribadi" (Personal Data Request).
2. Include your name, account email, business name, and what you are asking for.
3. We make sure the request really comes from you, for example by replying to your account email.
4. We answer no later than 3 x 24 hours after we have confirmed your identity.

If you are a customer or employee of a business that uses Nawasena ERP, send your request to that business, because they are the controller of your data.

Getting a copy of your business data

The business owner can get a full copy of the business data at any time. Open Settings, go to the Database Backup section, create a backup, then download the file. Reports can also be downloaded as Excel or PDF.

Deleting your account

First download a copy of your data. Then send an email from the owner's email address with the subject "Hapus Akun" (Delete Account). Once we have confirmed it, the application is shut down and the data is deleted no later than 30 days afterwards. Our billing records are still kept for the required retention period.

10. Cookies and this website

The nawasenakaryanusantara.com website does not use cookies, forms, advertising, or tracking tools. Its fonts, styles, and scripts are loaded from the website's own server. This website is hosted by Hostinger. Like most web servers, Hostinger's servers keep standard access logs for security, including visitors' IP addresses.

The Nawasena ERP application uses a session cookie so that you stay signed in, a form security cookie, a "Remember me" cookie if you tick it, and a system address cookie that is set when sign-up is complete. If your browser is asked to pass a security check, Cloudflare sets a security cookie that only records that the check was passed. The system address cookie only contains your system's name and address, and lasts one year. We do not use advertising cookies or third-party trackers.

11. Children

This service is for businesses. Accounts may only be created by people aged 18 or over. If you record data about children in the application, for example underage employees, you must have permission from their parent or guardian.

12. Changes to this policy

This policy may change. Each change gets a new version number and effective date. For important changes, we notify business owners by email at least 14 days before they take effect.

13. Contact

PT Nawasena Karya Nusantara
Roseville SOHO & Suite S1105, Jl. Sunburst CBD Lot 1.8, Serpong, Kota Tangerang Selatan, Banten 15321
Email ptnawasenakaryanusantara@gmail.com
WhatsApp +62 817 9555 599