Neobiz Privacy Policy — Indonesia (English)
English version. In the event of any inconsistency between the two versions, the Indonesian version prevails — see §C (Language).
Version: id-2026-07-1 · Effective date: 27 July 2026
This policy has two parts, because Neobiz holds two different roles under the PDP Law (Law No. 27 of 2022):
- §A — Neobiz as Data Controller (Pengendali). Data about merchants and their operators.
- §B — Member-facing notice base. Data about your customers/members. You are the Pengendali; Neobiz is your Prosesor under the DPA. §B is a template for the notice you must give your own members.
§A — Neobiz as Data Controller
A1. Who we are
PT Neobiz Global Technology, Roseville SOHO and Suite Unit 06-10, Sunburst CBD BSD Lot. I.8, Jl. Kapten Soebianto Djojohadikusumo, Kelurahan Lengkong Gudang, Kecamatan Serpong, Kota Tangerang Selatan, Banten 15321, Indonesia, is the Pengendali Data Pribadi for the data in this Part A. Contact: hello@neobiz.id.
Neobiz is not required to appoint a Data Protection Officer, as the conditions requiring appointment do not apply cumulatively to its processing. Data-protection enquiries are handled at the contact address above.
A2. Data we process and why
| Category | Examples | Purpose | Lawful basis (PDP Law Art. 20) |
|---|---|---|---|
| Account & identity | Name, business name, email, phone, role | Provide and secure the Service; authenticate operators | Performance of a contract |
| Billing | Plan, invoices, payment token, NPWP/tax IDs | Take payment; meet tax and accounting obligations | Contract; legal obligation |
| Usage & telemetry | Feature usage, logs, device/browser, IP | Operate, secure and improve the Service | Legitimate interests |
| Support | Tickets, correspondence, diagnostics | Provide support | Contract; legitimate interests |
| Audit & compliance | Terms-acceptance records, operator action logs, consent-attestation records | Evidence of agreement and compliance; dispute defence | Legal obligation; legitimate interests |
| Marketing | Contact details, preferences | Product and marketing communications | Consent |
A3. Sharing and subprocessors
We share Account Data with the providers listed at
../subprocessors.md (hosting, email, messaging, analytics, payment
processing, AI providers, support tooling). We also disclose where required by law or lawful
authority request, to protect rights and safety, and in connection with a corporate transaction.
We do not sell Account Data.
A4. Location and international transfers
Account Data is hosted in Indonesia. Where we transfer personal data abroad, we do so only on a basis permitted by the PDP Law — an adequacy determination, an appropriate binding instrument, or your consent — and we will provide transfer information to the authority where required.
A5. Retention
We keep Account Data for the term of the agreement and then for twenty-four (24) months, except where longer retention is required for tax, accounting, legal-hold or dispute purposes. Terms-acceptance and consent-attestation records are retained for the period necessary to evidence the agreement, which may outlast the account.
A6. Your rights
Under PDP Law Chapter V you may request information about, and access to, your personal data; request rectification; request erasure; withdraw consent; object to automated decision-making that has legal effect; request restriction of processing; request portability; and seek redress. Marketing messages carry an unsubscribe mechanism.
Contact hello@neobiz.id. We respond within the period required by law. You may also complain to the supervisory authority.
A7. Security
We maintain measures appropriate to the risk — see DPA Annex B. Where a personal data breach occurs, we will notify affected individuals and the authority within the period required by the PDP Law.
A8. Cookies and the website
We use only cookies and similar technologies that are strictly necessary to operate the Service, keep you signed in, and maintain security. We do not use advertising cookies or third-party analytics on the Service. If that changes, we will update this policy and, where required, obtain your consent first.
A9. Children
The merchant-facing Service is for businesses and is not directed to children.
A10. Changes
We may update this policy. Material changes will be notified. The version and effective date appear at the top.
§B — Member-facing notice base (you are the Pengendali)
This part is a template for you, the merchant, to publish to your own customers. Under the DPA §3.5 you must use this base — retaining the clauses marked [CORE — required] — or an equivalent notice meeting the PDP Law.
Why the core clauses are locked: they are what make your processing lawful and what our Prosesor position depends on. You may add to this notice and brand it — removing a core clause exposes both of us.
{{MERCHANT_BUSINESS_NAME}} — Privacy Notice
[CORE — required] Who we are. {{MERCHANT_BUSINESS_NAME}}, {{MERCHANT_ADDRESS}}, is
the Pengendali Data Pribadi for your personal data. Contact: {{MERCHANT_CONTACT}}.
[CORE — required] What we collect and why. We process your name, contact details, booking and order history, loyalty activity, and the content of messages you exchange with us, in order to provide our services, manage your bookings and orders, operate our loyalty programme, and — where you have agreed — send you marketing.
[CORE — required] Lawful basis. We rely on performance of a contract with you, compliance with legal obligations, our legitimate interests in operating our business, and — for marketing — your consent, in accordance with Article 20 of the Personal Data Protection Law.
[CORE — required] Who we share it with. We use Neobiz as our technology provider, which processes your data on our instructions as our Prosesor. We also use messaging providers to deliver messages and a payment provider to take payment.
[CORE — required] Your choices. You may withdraw consent to marketing at any time — reply STOP, use the unsubscribe link, or contact us. This does not affect service messages about your bookings or orders.
[CORE — required] Your rights. Under the Personal Data Protection Law you may request
information about and access to your data, request correction or erasure, withdraw consent,
object to automated decision-making, request restriction or portability, and seek redress.
Contact us at {{MERCHANT_CONTACT}}. You may also complain to the supervisory authority.
Retention. We keep your data for {{MERCHANT_RETENTION}} unless a longer period is required
by law.
Changes. We will notify you of material changes to this notice.
§C — Language
This policy is published in both the Indonesian and English languages. In the event of any inconsistency between the two versions, the Indonesian (Bahasa Indonesia) version prevails.
Contact: hello@neobiz.id · PT Neobiz Global Technology, Roseville SOHO and Suite Unit 06-10, Sunburst CBD BSD Lot. I.8, Jl. Kapten Soebianto Djojohadikusumo, Kelurahan Lengkong Gudang, Kecamatan Serpong, Kota Tangerang Selatan, Banten 15321, Indonesia.