Data Processing Agreement

1. Roles and scope

The Tenant is the Controller of Personal Data for Customer data entered or collected through Slotwise. Artha Code Studio (“we”) is the Processor, processing that data on the Tenant’s behalf. This agreement applies from the moment the Tenant accepts it and for as long as we process Customer data.

For the personal data of the Tenant itself and its staff, we are the controller and the Privacy Policy applies. If the two conflict on the processing of Customer data, this agreement prevails.

2. Details of processing

3. Tenant instructions and no other use

We process Customer data only on the Tenant’s documented instructions: this agreement, the Terms of Service, the Tenant’s configuration and use of features, and other reasonable written instructions. If we believe an instruction breaches the law, we tell the Tenant.

We do not sell Customer data, do not use it for our own marketing or purposes, do not combine it with other tenants’ data to build profiles, and do not disclose it except as this agreement allows or the law requires.

4. Tenant duties as controller

• Have a valid lawful basis and, where needed, valid consent from Customers, including explicit consent for health data, parent or guardian consent for children’s data, and consent for marketing messages.
• Tell Customers the purposes of processing, including that Slotwise is a processor.
• Keep data accurate and give staff only the access they need.
• Respond to Customers’ requests about their data rights.

5. Confidentiality

We make sure the people authorised to process Customer data are bound by confidentiality and access data only as needed. Access to Tenant data for support is done at the Tenant’s request or to protect the security and function of the Service, and is logged.

6. Security

We apply technical and organisational measures appropriate to the risk, including encrypted connections, separation of data between tenants at database level (row-level security), hashed passwords, role-based access control, audit logging and backups. We review these measures regularly and improve them as risks change.

7. Sub-processors

The Tenant gives general authorisation for us to use the sub-processors listed in the Privacy Policy (hosting and email delivery). We bind sub-processors to equivalent data protection obligations and remain responsible to the Tenant for their performance.

We notify the Tenant at least 30 days before adding or replacing a sub-processor. Within 14 days the Tenant may object on reasonable data protection grounds. If there is no solution, the Tenant may end the subscription, will not be charged for later periods, and receives a refund of the unused fees of the current period if we can no longer provide the Service without that sub-processor.

Providers the Tenant chooses and enables itself, such as payment providers and the Tenant’s own WhatsApp Business account, are not our sub-processors. The Tenant’s relationship with them is governed by the Tenant’s agreement with them.

8. Help with data subject requests

We provide features that help the Tenant, such as search, export, correction and anonymisation of Customers. If we receive a request directly from a Tenant’s Customer, we forward it to the Tenant within 5 business days and do not answer it ourselves unless the Tenant asks or the law requires. We reasonably help the Tenant meet such requests within the legal time limits.

9. Incident notification

If we become aware of a data protection failure affecting Customer data, we notify the Tenant without undue delay and within 48 hours of becoming aware, so the Tenant can still meet the 3 x 24 hour limit in the PDP Law. The notice describes the nature of the incident, the data and approximate number of data subjects affected, the likely consequences and the steps taken. We cooperate in the investigation and recovery, and do not announce an incident naming the Tenant without the Tenant’s consent, unless the law requires.

10. Cross-border transfers

We transfer Customer data outside Indonesia only where the destination country offers an equivalent or higher level of protection, or where an adequate and binding agreement and safeguards are in place, as the PDP Law requires.

11. Return and deletion

Moving to the Free plan does not end the service. After the account is closed or the agreement ends, the Tenant can export Customer data for 30 days. After that we delete or anonymise Customer data from live systems, and backup copies are removed within 90 days after that. We keep data only where the law requires, and on written request we confirm to the Tenant that deletion has been done.

12. Information and audit

On request, we provide reasonable information to show compliance with this agreement. The Tenant may audit, or appoint an independent auditor bound by confidentiality, at most once in 12 months, with at least 30 days’ notice, during business hours, and without disrupting the service or exposing other tenants’ data. The Tenant bears the cost of the audit unless it finds a material breach by us. We may first answer the request with a relevant third-party report or certification. We also cooperate with examinations by competent authorities.

13. Liability

Each party is responsible for its own breaches of this agreement. The liability cap and its exceptions follow section 12 of the Terms of Service: the cap does not apply to a personal data protection breach caused by us, gross negligence or wilful misconduct.

14. General

This agreement is governed by the law of the Republic of Indonesia and disputes follow the Terms of Service. It is made in Indonesian and English, and the Indonesian version prevails if they differ. We notify changes to this agreement at least 30 days in advance and ask the Tenant to accept the new version.

Artha Code Studio, PNI F17 No. 41, Cibitung, Muktiwari, Kabupaten Bekasi, Jawa Barat. Email: [email protected].