Data Processing Addendum

About This Addendum

This Data Processing Addendum (“Addendum”) describes how PT Api Teknologi Indonesia (“Apipay”, “we”, “us”) processes personal data on your behalf when you use the Service, to the extent you act as a controller of that data under Indonesia’s Law No. 27 of 2022 on Personal Data Protection (“PDP Law”). This Addendum forms part of our Terms of Service and applies automatically, without a separate signature, whenever we process personal data on your behalf as described here. If you need a signed copy for your own compliance records, contact us at legal@apipay.id.

Definitions

• Controller (“Pengendali Data Pribadi”): the party that determines the purpose and means of processing personal data. Where you collect personal data from your own Customers and use the Service to process it, you act as the Controller of that data.
• Processor (“Prosesor Data Pribadi”): the party that processes personal data on a Controller’s behalf and documented instructions. Apipay acts as your Processor for personal data you submit to, or that’s generated through, the Service.
• Personal Data, Data Subject, and Processing have the meanings given to them under the PDP Law.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data processed under this Addendum.

Roles of the Parties

As between you and Apipay, you’re the Controller of personal data relating to your Customers, and Apipay is the Processor acting on your documented instructions. Our Terms of Service and Privacy Policy constitute your documented instructions for the purpose of this Addendum, together with any additional written instruction you give us.

Processing Instructions

We process personal data only to provide the Service and in accordance with your documented instructions, except where we’re required to do otherwise by Indonesian law. If we reasonably believe an instruction would violate the PDP Law or another applicable law, we’ll notify you before carrying it out.

Confidentiality

We ensure that personnel authorized to process personal data under this Addendum are bound by confidentiality obligations and only access personal data to the extent necessary to perform their role.

Security Measures

We apply reasonable technical and organizational measures to protect personal data, as described in our Privacy Policy, including encryption of API traffic, signature verification on API calls, and access limited to personnel who need it for their role.

Sub-processors

You authorize us to engage sub-processors to process personal data on your behalf, as listed by category on our Sub-processors page. We’ll give you reasonable advance notice before a new sub-processor category becomes active, so you can raise an objection on data protection grounds. We remain responsible to you for a sub-processor’s compliance with obligations equivalent to this Addendum.

Assistance with Data Subject Requests

If we receive a request directly from one of your Customers to exercise a right under the PDP Law, we’ll notify you promptly and won’t respond directly unless you ask us to. We’ll provide reasonable assistance to help you respond to a Data Subject’s request within the timeframe the PDP Law requires.

International Data Transfer

Where personal data processed under this Addendum is transferred outside Indonesia, including to a sub-processor, we take steps consistent with the PDP Law to keep that data protected to an equivalent standard, relying on your consent, a legal obligation, or another lawful basis recognized under the PDP Law. If you need additional transfer safeguards for your own compliance, such as EU Standard Contractual Clauses, contact us at legal@apipay.id to discuss your requirements.

Security Incident Notification

If we become aware of a Security Incident affecting personal data we process on your behalf, we’ll notify you without undue delay, and in any event within the timeframe the PDP Law requires, with the information reasonably available to us about the incident’s nature, the data affected, and the steps we’re taking.

Return or Deletion of Data

Upon termination of our Agreement, we’ll delete or return personal data we process on your behalf within a reasonable period, except to the extent we’re required by law to retain it, consistent with the retention terms in our Privacy Policy.

Audit

On reasonable written request, and no more than once a year unless following a confirmed Security Incident, we’ll provide you with information reasonably necessary to demonstrate our compliance with this Addendum, which we may satisfy by providing documentation rather than an on-site audit.

Liability

Liability under this Addendum is governed by the limitation of liability in our Terms of Service.

Term

This Addendum remains in effect for as long as we process personal data on your behalf under the Agreement, and the obligations that by their nature should survive (such as confidentiality and return or deletion of data) continue after termination.

Governing Law & Precedence

This Addendum is governed by the laws of the Republic of Indonesia. If there’s a conflict between this Addendum and our Terms of Service regarding a data protection matter, this Addendum prevails. Disputes are resolved as described in our Terms of Service.

Contact

Questions about this Addendum, or requests for a signed copy, can be sent to legal@apipay.id or to PT Api Teknologi Indonesia, Jl. Bintaro Raya Selatan No.8C, Kebayoran Lama Utara, Kec. Kebayoran Lama, Kota Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12240, Indonesia.