Privacy Notice

The following Privacy Notice explains how PT Olsera Indonesia Pratama (hereinafter referred to as “Olsera”) processes and protects personal data. This Privacy Notice applies to Merchants and Customers who use the services provided by Olsera. We encourage you to read this Privacy Notice and understand your privacy rights before using our services and interacting further. By agreeing to this Privacy Notice, you acknowledge that you have read and understood this Privacy Notice and agree to the use, practices, and processing of your personal data by Olsera as stated in this Privacy Notice.
By agreeing to this Privacy Notice, you consent to the actions described in this Privacy Notice. If you continue to use the services provided by Olsera after any updates to this notice, you are deemed to have agreed to such changes.
We have made changes to this Privacy Notice, updating it to align with our ongoing commitment to providing you with the best service and to ensure that our practices comply with the applicable laws and regulations in Indonesia.

Olsera may process your personal data in various situations, depending on the features and services you use through our Platform. When you register an account on the Olsera Platform through our website, you will be asked to provide personal data including your full name, mobile phone number, email address, and address. If you use the Point of Sale (POS) service on the Olsera Platform, we will also process transaction data generated from your use of such service, including transaction history, order details, payment information, and other relevant data.
Furthermore, if you use the employee attendance feature on the Olsera Platform, we will process biometric data in the form of facial images (facial image) to enable the facial recognition feature. Such biometric data will be stored and processed on cloud infrastructure managed by Amazon Web Services (AWS) with server locations in Singapore. Olsera implements adequate security measures in the management of such biometric data and ensures that it is only used for the purposes of the employee attendance feature and is not shared with any third parties beyond such operational needs.

The Personal Data we collect from you will only be processed for lawful, limited, and proportionate purposes. We will not process your Personal Data beyond the specified purposes without first obtaining your consent or without a valid legal basis in accordance with applicable laws and regulations in Indonesia. The purposes for processing your Personal Data are as follows:

1. To register, verify, and/or identify you as a user of the Olsera Platform, including ensuring account security and compliance with terms of service;
2. To operate, maintain, and improve the Olsera Platform system, as well as to provide the features and services you use;
3. To manage your account, including preference settings, account security, and transaction history;
4. To process transactions, payments, or orders made by you or your customers through the Olsera Platform; and
5. To send notifications, receipts, payment confirmations, or other notices related to your activities on the Olsera Platform.
6. To respond to your inquiries, requests, complaints, or other communications in a timely and adequate manner;
7. To provide customer service and technical support, including operational assistance and resolution of issues or system disruptions;
8. To notify you of service updates, policy changes, or new features available on the Olsera Platform;
9. To send informational or marketing materials, including promotions, special offers, campaigns, and surveys relevant to you. Marketing materials are sent only based on your consent, and you may withdraw such consent at any time through the mechanism we provide;
10. To analyze and improve service performance, including usage evaluation, user preferences, and product development, based on aggregated data and, where possible, in a form that does not individually identify you;
11. To conduct market research using aggregated statistical data that does not individually identify users;
12. To carry out internal activities such as audits, compliance, risk assessments, internal investigations, and cybersecurity purposes;
13. To ensure compliance with applicable laws, regulations, and reporting obligations applicable to Olsera;
14. To prevent, detect, and handle fraudulent acts, legal violations, or other suspicious activities on the Olsera Platform;
15. To offer or provide services from Olsera’s affiliates or partners, including services from financing institutions that are licensed and supervised by the Financial Services Authority (OJK), provided you have given your consent;
16. To provide support to Olsera’s business partners in delivering the services you require, in a limited manner and only to the extent necessary;
17. For artificial intelligence (AI)-based processing by Olsera’s technology partners, including performance analytics, service optimization, and predictive model development, carried out in a limited manner under agreements that require the protection of your Personal Data and that do not allow such data to be used independently for the commercial interests of such third parties.

If Olsera intends to process your Personal Data for purposes other than those stated above, we will first provide notice and, where required, seek your consent prior to such processing.

Olsera processes your Personal Data to fulfill the Purposes as described in this Privacy Notice. In carrying out such processing, Olsera relies on the legal bases that are relevant in accordance with the applicable laws and regulations in Indonesia. The legal bases for Olsera’s processing of Personal Data include one or more of the following:

1. Performance of Agreement (Contract)
   Personal Data processing is carried out to the extent necessary for the formation, execution, and fulfillment of an agreement between you and Olsera.
2. Legitimate Interest
   Olsera may process Personal Data to fulfill legitimate interests provided such processing does not override the rights and interests of the Personal Data Subject.
3. Fulfillment of Legal Obligations
   Personal Data processing is carried out to comply with legal obligations and/or orders from competent authorities in accordance with applicable laws and regulations.
4. Protection of Vital Interests
   In certain circumstances, Personal Data processing may be carried out to protect the vital interests of the Personal Data Subject or other parties.
5. Consent of Personal Data Subject
   In certain cases, Olsera will process Personal Data based on the consent given by the Personal Data Subject in accordance with applicable provisions.

Unless otherwise specified in this Privacy Notice, your Personal Data will only be retained for as long as necessary to fulfill the purposes for which it was collected and/or for as long as retention is required or permitted under applicable laws and regulations. We will delete, destroy, and/or anonymize your Personal Data as soon as its retention is no longer necessary or consistent with those requirements.
In determining the retention period, we consider: (i) the duration of your consent to the processing of Personal Data; (ii) legal or regulatory obligations applicable to Olsera; and (iii) legitimate operational needs, including dispute resolution, audits, and enforcement of agreements. Unless otherwise specifically provided, your Personal Data will be retained for a maximum period of 10 (ten) years from the end of your relationship with Olsera, whichever is longer.
Please note that in certain circumstances, your Personal Data may be held or controlled by other parties, including government institutions or third parties cooperating with Olsera. In such cases, the retention of Personal Data is subject to the policies and provisions applicable to those parties.

Olsera is committed to maintaining transparency and compliance with applicable personal data protection regulations. Therefore, we may review and update this Privacy Notice from time to time to align with service developments, regulatory changes, and operational needs. Regarding changes to the Privacy Notice:

1. Olsera may review and amend this Privacy Notice at its own discretion to ensure that the provisions herein remain consistent with Olsera’s future developments, and/or in the event of changes to laws and regulations and/or instructions from Competent Authorities requiring Olsera to amend the provisions in this Privacy Notice.
2. Olsera will notify you of changes to the Privacy Notice through a public notice on the website and/or Olsera Platform, through a specific notification to your email address or contact registered on the Olsera Platform. Olsera encourages you to review the Olsera Platform periodically to stay informed of the latest information on how the provisions of this Privacy Notice are applied.
3. Olsera encourages you to periodically review this Privacy Notice to understand how Olsera manages and protects your Personal Information. Your continued use of the Platform after any updates will be deemed as your acceptance of the substance and provisions of the updated Privacy Notice.

Cookies are small pieces of data that may include anonymous unique identifiers. Cookies are sent to your browser from our website and stored on the device you use. This information is only applicable and stored in the browser used when accessing our website, and will not be shared across browsers or other devices. We use Functional Cookies, which are necessary for our website to function properly. These cookies support core functions such as security, network management, and accessibility. Without these Cookies, some features on our website may not function properly.

Olsera uses a service provided by Google called Google Analytics (GA). GA enables us to reach people who have previously visited our website and show them relevant advertisements when they visit other sites on the Internet within Google’s Display Network. Cookies may be used to track your sessions on our website, to serve customized advertisements from Google and other third-party vendors. When you visit this site, you may see advertisements posted on the site by Google or other third parties. Through first-party and third-party Cookies, those third parties may collect information about you when you visit this site and other sites. They may use this data to display advertisements on this site and across the Internet based on your prior visits to this website and elsewhere on the Internet. We do not collect this information or control the content of the advertisements you will see. You may be able to opt out of Google Display Network personalized ads by visiting Ad Preferences (http://www.google.com/ads/preferences/), and the Google Analytics Opt-out Browser Add-on (http://www.google.ca/ads/preferences/plugin/). Your use of our services indirectly means that you understand and agree to the collection of data for advertising remarketing using GA and Cookies from other third parties based on your prior visits to this website and elsewhere on the Internet.

The security of your Personal Data is a top priority for Olsera. We implement reasonable and proportionate technical and organizational measures to protect your Personal Data from unauthorized access, disclosure, alteration, loss, or misuse. These measures include, but are not limited to, data encryption, access controls, and periodic system monitoring in accordance with applicable information security standards.
Olsera is committed to continuously improving our security standards; however, the security of your Personal Data also depends on the security practices you apply yourself, such as keeping your account password confidential, not sharing login credentials with others, and promptly reporting to us if you become aware of or suspect any unauthorized access to your account.
In the event of an incident that may affect the security of your Personal Data, we will take the necessary steps in accordance with applicable laws and regulations, including conducting an investigation, implementing mitigation measures, and providing notification to you and/or the competent authorities within the time period required by law.

With respect to the processing of your personal data through the Olsera Platform, you have the right to:

1. update and/or correct errors and/or inaccuracies in your personal data recorded on the Olsera Platform;
2. withdraw your consent to the processing of personal data on the Olsera Platform;
3. request access to and obtain a copy of personal data stored in the Olsera Platform which will be provided in accordance with Applicable Law;
4. reject the use of personal data; and
5. request access to and obtain a copy of personal data stored in the Olsera Platform, which will be provided in accordance with Applicable Law; delete and/or destroy your personal data.

Olsera will not disclose or share your Personal Data with other parties without a valid legal basis. In order to fulfill the purposes described in this Privacy Notice, Olsera may only disclose your Personal Data to the following parties, in a limited and proportionate manner and in accordance with the applicable laws and regulations in Indonesia:

1. Affiliates and entities within the Olsera business group, including employees, contractors, or representatives who have specific access needs to Personal Data for operational, administrative, and service delivery functions. Access is granted only on a need-to-know basis and is subject to binding confidentiality obligations;
2. Third-party service providers, including providers of information technology, cloud computing, data analytics, payment processing, customer service, communications, and other infrastructure providers that support the operations of the Olsera Platform. Such service providers are only permitted to process your Personal Data in accordance with Olsera’s instructions and are not authorized to use it for any purposes beyond the agreed scope;
3. Business partners and strategic partners, including financing institutions, financial institutions, payment service providers, and other partners who collaborate with Olsera in providing services to you. Disclosure is made only to the extent necessary for the performance of the services you use and under agreements that require the protection of Personal Data;
4. Technology partners, including parties that provide artificial intelligence (AI)-based solutions, analytics, or other data processing used to improve service quality and feature and product development. Disclosure to technology partners is made in a limited manner and only for predetermined purposes;
5. Professional advisors, such as legal consultants, auditors, accountants, or other advisors, to the extent necessary for compliance, audit, risk management, or other professional purposes, and subject to professional confidentiality obligations;
6. Parties involved in corporate transactions, including in the event of a merger, acquisition, restructuring, or asset transfer. In such circumstances, Olsera will take reasonable steps to ensure that your Personal Data continues to receive adequate protection, and you will be notified if there is any material change in the control of your Personal Data;
7. Legal Compliance, to comply with legal obligations, execute lawful orders or requests from governmental or law enforcement authorities, and to protect the rights, assets, and legitimate interests of Olsera as well as public safety. Olsera will disclose your Personal Data only to the extent required by law and, where permitted, will endeavor to notify you prior to such disclosure; and
8. Other parties for the protection of legitimate rights and interests, including in efforts to prevent, detect, and address unlawful acts such as fraud, system abuse, or other suspicious activities, to the extent that such disclosure is necessary and proportionate.

Olsera ensures that any disclosure of Personal Data is carried out with adequate protection measures in place, including confidentiality and data security obligations, in accordance with applicable legal provisions.
Except as required or permitted under applicable laws and regulations, court orders, or as provided in this Privacy Notice, Olsera will not disclose, share, lease, sell, or trade your Personal Data to any third party without a valid legal basis or without notifying you.
Where disclosure of Personal Data to third parties is necessary to fulfill the Purposes, Olsera will ensure that such parties are bound by obligations to maintain confidentiality and protect your Personal Data in accordance with protection standards equivalent to those applied by Olsera. Such third parties are only permitted to access and process Personal Data for the purposes determined by Olsera and not for any other purposes beyond that.
In the event of a failure in the protection of Personal Data, including but not limited to a security breach resulting in the disruption of the confidentiality, integrity, and/or availability of Personal Data, whether occurring intentionally or unintentionally, causing destruction, loss, alteration, disclosure, or unauthorized access to Personal Data managed by Olsera, Olsera will provide notification to you and the competent authorities in accordance with applicable legal provisions.
Such notification will be made in writing no later than within 3 x 24 (three times twenty-four) hours from the time the incident becomes known, or within such other period as stipulated by applicable laws and regulations, and shall include at minimum the following information:

1. The type and/or category of Personal Data affected;
2. The time and sequence of events of the data breach or violation;
3. The steps that have been and/or will be taken by Olsera to address and recover from the impact of the incident.

In the provision of services, Olsera uses cloud infrastructure managed by Amazon Web Services (AWS) with server locations in Singapore. Therefore, your Personal Data is stored and processed in Singapore as part of the overall operation of the Olsera Platform.
Furthermore, in certain circumstances, your Personal Data may also be accessed or processed by Olsera’s affiliates, partners, or third-party service providers located in other countries, to the extent necessary for legitimate and limited operational needs as described in this Privacy Notice.
Olsera ensures that any transfer of Personal Data outside Indonesian territory is carried out in accordance with the Personal Data Protection Law and its implementing regulations. With respect to the use of AWS servers in Singapore, we wish to note that Singapore has a comprehensive legal framework for personal data protection through the Personal Data Protection Act (PDPA), ensuring that your Personal Data receives an adequate level of protection in that destination country.
In the event of a transfer of Personal Data to another country that does not yet have a level of personal data protection equivalent to Indonesia, Olsera will take the necessary additional steps, including but not limited to the implementation of standard contractual clauses or other protection mechanisms recognized under applicable laws and regulations, to ensure that your Personal Data remains adequately protected.

In certain circumstances, Olsera may process Personal Data through an automated decision-making mechanism. Nevertheless, the Personal Data Subject retains the right to raise an objection if the decision produced is entirely derived from such an automated process.

By agreeing to this Privacy Notice, you:

1. warrant and are responsible for ensuring that the personal data you provide in written or other form for the use of the Olsera Platform is genuinely yours and was not obtained from other parties without lawful authorization.
2. agree that you are personally responsible for reviewing this Privacy Notice periodically to stay informed of the latest changes or developments to this Privacy Notice through the Olsera Platform and/or via the email and/or contact registered on the Olsera Platform.
3. are deemed to have read, understood, and agreed to the applicable provisions of this Privacy Notice, including any changes we make from time to time.
4. By using Olsera’s services, you are deemed to have understood and agreed to all provisions stated herein. In particular, you also grant permission for the use of your personal data at every stage of personal data processing.

If you have any questions regarding this Privacy Notice, please contact us via email at: privacy@olsera.co.id.