Privacy Policy
This Privacy Policy explains how Alurco ("Alurco", "we") collects, uses, stores and protects personal data when you use the Alurco service (the "Service"), in line with Law No. 27 of 2022 on Personal Data Protection ("PDP Law"). Terms with a capital letter have the meaning given in the Terms of Service.
1. Our role
- Alurco is the controller of your Account data, sign-in and security data, support tickets and donations.
- The Customer is the controller of the Customer Data inside its Company, such as employee records, attendance, claims and documents. Alurco processes that data on the Customer's behalf.
If you are an employee of a Customer, the Customer is responsible for telling you how it uses your data. You can contact the Customer, or us, to exercise your rights (section 8).
2. Data we collect
Data you give us
- Account data: name, email, phone number, language, profile photo, and your password (stored only as a secure hash).
- Company data at registration: company name, legal name, entity type, tax number (NPWP), address and contact details.
- Support tickets and their attachments; donation amounts and messages.
Data collected when you use the Service
- Sign-in history: time, IP address, device and browser, result.
- Acceptance of these documents: version, time, IP address and device, kept as evidence.
- Activity and security logs of business actions (who did what, and when). They hold identifiers and counts, not the content you entered.
- Location and network at clock-in and clock-out, when the Customer uses attendance with GPS or office-network checks.
Customer Data
Data entered by the Customer and its Members. It can include employee personal data such as identity numbers, family, education, bank accounts, salaries, documents and photos.
We do not ask for and do not store card or bank credentials. Payments are made on the payment provider's page.
3. How we use data
| Purpose | Legal basis |
|---|---|
| Provide your Account, Companies and the features you use | Agreement |
| Security, fraud prevention and incident handling | Legitimate interest, legal obligation |
| Service emails (verification codes, approvals, invitations) | Agreement |
| Support | Agreement |
| Study usage and data to improve the Service and build features | Legitimate interest |
| Bookkeeping, tax and lawful requests | Legal obligation |
When we study data to improve the Service, we look at how features are used and produce aggregated or de-identified statistics that do not identify any Customer or person.
We never sell, rent or trade personal data or Customer Data. We do not share it for anyone's marketing and do not use it for advertising.
4. Who we share data with
Only with providers that help us run the Service, under agreements that oblige them to protect the data and use it only on our instructions:
- infrastructure providers that host our servers, database, file storage and email delivery;
- Cloudflare, for network delivery and protection against attacks;
- Midtrans, for processing donations and payments.
We may also disclose data when the law or a binding order of a competent authority requires it, or to protect the rights and safety of our users and the Service.
5. Where data is stored
Data is stored on Alurco's servers in Singapore. Where data is processed outside Indonesia, we apply the safeguards required by the PDP Law.
6. How long we keep data
| Data | Kept for |
|---|---|
| Customer Data | While the Company uses the Service, then as in section 10 of the Terms of Service |
| Account data | While your Account exists |
| Sign-in history | 90 days |
| Activity and security logs | 90 days |
| Email delivery records | 180 days |
| Acceptance of these documents | While your Account exists |
| Support tickets and donations | While the Company uses the Service, or longer if the law requires |
After a Company stops using the Service, the Customer may ask for an export within 30 days. The data is then deleted within 90 days, except records the law requires us to keep. Backups are overwritten in their normal cycle.
7. Security
- Encrypted connections (HTTPS), and encrypted requests and responses in the mobile app.
- Passwords stored as one-way hashes; sign-in codes stored only as hashes and valid for a short time.
- Strict separation between Companies, and permissions checked on the server for every action.
- Files stored privately and opened through links that expire quickly.
- Logs never contain passwords, sign-in codes, keys or request content.
No system is completely secure. If a personal data breach affects you, we will notify you and the authority as the PDP Law requires. Liability for incidents caused by third parties, providers outside our control, or users themselves is set out in section 7 of the Terms of Service.
8. Your rights
Under the PDP Law you may:
- ask how your data is used, and get a copy of it;
- correct or update inaccurate data;
- ask us to stop processing, delete or destroy your data;
- withdraw consent where processing is based on consent;
- object to decisions based solely on automated processing;
- receive your data in a commonly used format.
You can update most Account data yourself in your profile. For anything else, email us (section 12). We reply within the periods set by the PDP Law. For Customer Data, we pass the request to the Customer or act on its instructions.
9. Cookies
The web application uses only cookies needed for sign-in, security and your language choice. We do not use advertising cookies.
10. Children
The Service is not intended for anyone under 18. We do not knowingly create Accounts for them.
11. Changes
We may update this Privacy Policy. Each version has a number and an effective date, and you will be asked to accept the new version in the Service. Material changes are announced at least 14 days before they take effect.
12. Contact
Email [email protected] for questions about privacy or anything else.