Indonesia Privacy Notice (PDP Law)

This notice adds Indonesia-specific information to the Tanqory Global Privacy Policy. It applies when Indonesia's Law No. 27 of 2022 on Personal Data Protection ("PDP Law") applies to how Tanqory Inc. ("Tanqory", "we", "us") handles your personal data (Art. 2). Where this notice and the Global Privacy Policy differ for a person in Indonesia, this notice applies.

Official references:

• PDP Law (Indonesian, JDIH BPK): https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022 (the Indonesian text is binding)

---

1. Who is responsible

• Tanqory Inc. is the personal data controller for data about merchants, developers, visitors to Tanqory websites and users of Tanqory apps. Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA.
• Merchant stores: when you buy from a store that runs on Tanqory, the merchant is the controller and Tanqory is its processor under our Data Processing Addendum. Ask the merchant first about your rights; we help the merchant answer.
• Contact for Indonesia: privacy@tanqory.com. Please write "PDP request" in the subject line.

2. What we collect and why (Arts. 20 and 21)

The categories of data, purposes, recipients and retention periods are listed in the Global Privacy Policy (sections "Personal Data We Collect", "How We Use Personal Data", "Sharing of Personal Data with Third Parties" and "Data Retention and Deletion"). The legal basis we rely on for each purpose under Art. 20(2) is:

We do not ask for specific personal data (Art. 4(2)), such as health, biometric, genetic or criminal records data, to use Tanqory.

3. Your rights (Arts. 5 to 13)

You can ask us to:

• tell you who we are, why we process your data and on what legal basis (Art. 5);
• correct or update your data (Art. 6);
• give you access to, and a copy of, your data (Art. 7);
• stop processing, delete or destroy your data (Art. 8);
• withdraw consent you gave (Art. 9);
• object to a decision made only by automated processing that has legal or similarly significant effects on you (Art. 10);
• delay or restrict processing (Art. 11);
• receive your data in a commonly used, machine-readable format, or send it to another controller (Art. 13).

You may also claim compensation for a breach of the PDP Law (Art. 12).

Send requests to privacy@tanqory.com. We check your identity before we act. For correction, access, withdrawal of consent and stopping processing, we act within 3 x 24 hours of a complete, verified request, as the PDP Law requires. Other requests are answered as soon as possible and within 30 days. Requests are free, unless a request is manifestly unfounded or excessive.

4. Children

Tanqory is built for businesses and is not meant for children. You must be an adult to open a merchant account. We do not knowingly process data about children without the consent of a parent or guardian (Art. 25). If we learn that we have, we delete it.

5. Cookies and similar technologies

Strictly necessary cookies are always on. For other cookies (analytics and ad measurement) on Tanqory websites, visitors in Indonesia see our cookie notice and can switch them off at any time in the cookie settings. We also honour Global Privacy Control signals from your browser. The full list is in our Cookie Policy.

6. Transfers outside Indonesia (Art. 56)

Tanqory is a US company. Today our platform data is hosted by DigitalOcean in Singapore, and some of our service providers process data in the United States and other countries (see the subprocessor list). Where the destination does not offer protection equal to or higher than the PDP Law, we use binding contractual safeguards with the recipient. You can ask us for a copy of the safeguards that apply to your data.

7. Security and data breaches (Art. 46)

We protect personal data with the measures described in the Global Privacy Policy section "Data Security Measures". If a personal data protection failure happens, we notify the people affected and the Indonesian data protection authority in writing within 3 x 24 hours. The notice says which data was affected, when and how it happened, and what we are doing to handle and recover from it.

8. How long we keep data

We keep personal data only as long as the purposes in section 2 need, or longer if a law requires it (for example tax records). Periods are listed in our Data Retention Policy. After that we delete or destroy the data.

9. Changes and language

We will post changes to this notice here and change the "Last updated" date. For a material change we will also tell you prominently, for example by email or with a notice on our website or app. This notice is in English; an Indonesian translation will follow.

Change history