1. Operator and scope
PT. One Media Global, Tanah Tinggi Barat, Ternate Selatan, Kota Ternate, Maluku Utara 97715, Indonesia, operates Bakasir. Privacy inquiries can be sent to [email protected]; service help to [email protected]. The company determines processing of its own account, billing, website, support and security data. Merchants normally determine purposes for their customer and staff records and Bakasir processes those records to provide the configured service. These roles require confirmation in the final data-processing agreement.
2. Information involved
We may handle account identity and contact details, role and login events, business settings, catalog and uploaded media, sales and payment references, purchase and accounting records, customer and employee information, support messages, device and browser identifiers, audit logs and technical diagnostics. The exact fields depend on enabled features and what the merchant enters. Do not submit unnecessary sensitive data in free-text fields or files.
3. Purposes and legal bases
Processing supports account administration, requested business workflows, billing, support, backups, fraud prevention, security and configured notifications. Depending on the activity, the lawful basis may be performance of a contract, a legal obligation, a legitimate interest recognised by applicable law, or consent where required. Marketing messages and optional analytics must have separate controls where consent is required. The final processing register must map each purpose to its actual basis.
4. Providers and integrations
Configured authentication, payment, email, hosting, storage, push and analytics providers may receive only information required for their functions. A merchant enabling an optional integration may send its own data to that provider under its terms. Before publication, Bakasir must publish verified subprocessors, hosting regions, transfer locations and required cross-border safeguards. This draft does not assert a provider or country that has not been confirmed.
5. Cookies and local storage
Essential browser storage supports authentication, security, locale, theme and application state. Offline POS can keep restricted business data on a device until it syncs; merchants must secure and retire those devices. Optional analytics or marketing technologies require controls that match the deployed configuration. An informational cookie banner is not a substitute for consent where consent is legally required.
6. Retention and deletion
We propose retaining personal data only while needed for the stated purpose or a legal duty. Business records, audit logs, support cases and backups have different schedules; no single deletion period is promised until the production schedule is approved and verified against the backup system. Plugin deactivation does not automatically delete records. Account-erasure requests are assessed against lawful record-retention duties and backup lifecycle. The final policy must publish category-specific periods or objective criteria.
7. Access, correction and other requests
Send requests for access, correction, deletion, restriction, withdrawal of consent or other applicable rights to [email protected]. We will verify the requester before disclosing or changing data and explain any lawful exception. For merchant-controlled customer or employee records, we may refer the person to the merchant and help the merchant respond as required by our agreement. Never email a password or unnecessary identity document.
8. Security and incident handling
Authentication, role permissions, tenant isolation, logging and backups are intended to protect data, but no system is risk-free. Report a suspected exposure at [email protected] or through the security form. We will assess, contain and document incidents and make notifications required by Indonesian law. The response owners, timelines and evidence process require an approved incident runbook before production.
9. Children and changes
Bakasir is intended for businesses and their authorised workers, not direct use by children. Merchants must not enter children's information without a lawful basis and appropriate safeguards. We propose email notice to the owner before material privacy-policy changes and publication of an effective date and archived version. The notice workflow must be implemented before relying on this promise.
