Data Processing Agreement

Parties

This agreement is between the customer who subscribes to the hosted BizConnect.id service (the Customer), acting as Personal Data Controller (Pengendali Data Pribadi), and Aiconec (the Processor), acting as Personal Data Processor (Prosesor Data Pribadi). It forms part of the agreement between the Customer and the Processor for the hosted BizConnect.id service.

1. Definitions

• Personal DataData about an identified or identifiable natural person, as defined in UU PDP.
• Data SubjectThe natural person to whom Personal Data relates.
• ProcessingAny operation performed on Personal Data, including collection, storage, use, transfer and deletion.
• ControllerThe Customer, who determines the purposes and means of Processing.
• ProcessorAiconec, who processes Personal Data on the Customer's behalf.
• Sub-processorA third party engaged by the Processor to process Personal Data for the Service.
• ServiceThe hosted BizConnect.id service.
• WorkspaceThe Customer's ERP site on the Service, including its database and files.
• Security PageThe description of the Processor's technical and organisational measures published at /security.

2. Scope and purpose

The Processor processes Personal Data only on the Customer's documented instructions and only to provide, maintain and support the Service. The Customer's use of the Service, and the configuration of its Workspace, constitute its instructions.

The Processor does not process Personal Data for its own purposes.

3. Categories of data and Data Subjects

The Customer decides which Personal Data it enters into the Workspace. Typically this comprises:

• Data SubjectsEmployees, customers and suppliers of the Customer, and their contact persons.
• Categories of dataIdentity and contact details, employment and payroll data, and records of transactions with customers and suppliers.

4. Duration

This agreement applies for the term of the Customer's subscription and for as long afterwards as the Processor retains Personal Data under clause 11.

5. Obligations of the Processor

The Processor shall:

• process Personal Data only on the Customer's instructions, and inform the Customer if an instruction would, in the Processor's view, breach UU PDP;
• keep Personal Data confidential, and ensure that every member of staff with access to it is bound by a confidentiality obligation;
• maintain the technical and organisational security measures described on the Security Page;
• not process Personal Data beyond what the Service requires;
• assist the Customer in meeting its own obligations under UU PDP, within the limits of clauses 7 to 9.

6. Sub-processors

The Customer authorises the Processor to engage the Sub-processors listed on the Security Page. At the date of this version they are:

• RailwayHosting and object storage — Singapore
• MidtransPayment processing — Indonesia
• Google WorkspaceTransactional email
• AI model providersOnly where the Customer enables the optional AI Assistant add-on
• Kuncie / Aiconec door-access serviceOnly where the Customer enables the optional Office Lounge app

The Processor gives the Customer 30 days' written notice before adding or replacing a Sub-processor. The Customer may object in writing within that period. If the objection cannot be resolved, the Customer may terminate the affected subscription before the change takes effect. The Processor remains responsible to the Customer for the performance of its Sub-processors.

7. Data Subject requests

Data Subjects address their requests to the Customer, as Controller. If a request reaches the Processor, it forwards the request to the Customer without responding on the substance.

The Processor assists the Customer in responding to a Data Subject's request within 7 business days of the Customer asking for that assistance.

8. Personal Data breach

The Processor notifies the Customer of a Personal Data breach affecting the Workspace within 3 × 24 hours of becoming aware of it, as UU PDP requires. The notice contains the information the Customer needs for its own notification to Data Subjects and to the authority:

• the Personal Data affected, and the Data Subjects concerned;
• when and how the breach occurred;
• the steps taken to contain and remedy it;
• a contact point at the Processor.

Where not all of this is known within the period, the Processor sends what it has and follows up as the facts become clear.

9. Audits

Once in any 12-month period, on 30 days' written notice, the Customer may audit the Processor's compliance with this agreement, or appoint an independent auditor bound by confidentiality to do so. The Processor may satisfy the request with a written report describing its compliance. An audit takes place during business hours and without disrupting the Service for other customers.

10. International transfer

The Service stores Personal Data in Singapore (see "Where your data lives" on the Security Page). By using the Service, the Customer instructs the Processor to transfer Personal Data outside Indonesia for that purpose, and acknowledges that the transfer is made under the conditions of Article 56 of UU PDP.

On-premise deployment is available, under a separate contract, for Customers who need their data to stay in Indonesia.

11. Return and deletion

The Customer can export its data from the Workspace at any time during the subscription.

After the subscription is cancelled, the Workspace is retained for the platform's retention window, by default 30 days, so that the Customer can still export its data. The Customer may request earlier deletion.

When the retention window ends, the Workspace and its files are deleted. A final backup is kept and deleted 180 days after the Workspace is deleted.

Backups taken during the subscription expire under the 30-day backup retention described in the Service Level Agreement.

12. Liability

Each party's total liability to the other under this agreement is limited to the fees paid by the Customer for the Service in the 12 months before the event giving rise to the claim. This limit does not apply to liability arising from wilful misconduct.

13. Governing law and disputes

This agreement is governed by the law of the Republic of Indonesia. A dispute that cannot be settled amicably is submitted to the competent court in Jakarta.

14. Language and precedence

This agreement is made in Indonesian and English. The Indonesian version is binding; the English version is provided for convenience. Where the two differ, the Indonesian text prevails.