Privacy Policy

Terms used in this Privacy Policy have the same meaning as defined in the Grafisa User Agreement, unless otherwise specified below.

• "Personal Data" means data about an individual who is identified or identifiable, whether directly or indirectly, as referred to in the PDP Law.
• "Personal Data Controller" means the party that determines the purposes of and exercises control over the processing of Personal Data, in this case Grafisa.
• "Personal Data Processor" means a third party that processes Personal Data on behalf of and in accordance with the instructions of Grafisa, including payment service providers and cloud/hosting service providers.
• "Processing" means any activity performed on Personal Data, including acquisition, collection, processing, storage, rectification, use, display, announcement, transfer, dissemination, disclosure, or erasure.
• "Personal Data Subject" means a User (Client and/or Designer) whose Personal Data is processed by Grafisa.

Grafisa collects as little Personal Data as possible and only to the extent necessary to operate the Platform, in accordance with the principles of purpose limitation and data minimisation as set out in Article 8.1 of the User Agreement. The categories of Personal Data collected include:

2.1 Data Provided Directly by the User

• Identity data: full name, email address, telephone number, date of birth, and profile photo.
• Verification data: National Identity Number (NIK), Taxpayer Identification Number (NPWP), and other identity documents required for the verification process as set out in Article 3.3 of the User Agreement.
• Designer profile data: portfolio, skills, service categories, package prices, and work history.
• Transaction data: details of Briefs, Orders, communications between Clients and Designers within the Platform, and Order history.
• Financial data: Designers' bank account numbers for the purpose of disbursing Designer Fees, and Clients' payment instrument information processed through a third-party payment service provider.
• Communication data: messages sent to Grafisa customer service, including via [email protected] or the Resolution Center.

2.2 Data Collected Automatically

• Device and technical data: IP address, device type, operating system, browser type, and other device identifiers.
• Usage data: activity logs on the Platform, pages accessed, time and duration of visits, and interactions with Platform features.
• General location data derived from the IP address, to the extent necessary for security and personalisation of the Service.

2.3 Data from Third Parties

As set out in Article 3.3 of the User Agreement, Grafisa may verify the identity of Users through third-party data sources, including identity verification service providers and payment service providers, to the extent permitted by applicable law.

Grafisa processes Users' Personal Data on the basis of one or a combination of: (i) the User's consent; (ii) the performance of the User Agreement that forms the basis of the relationship between Grafisa and the User; (iii) compliance with legal obligations applicable to Grafisa; and/or (iv) the legitimate interests of Grafisa that do not override the rights of the Personal Data Subject, in accordance with the PDP Law. Personal Data is used for the following purposes:

• To provide, operate, and maintain the Platform, including matching Clients with Designers, facilitating Briefs, and processing Orders.
• To verify the identity of Users as set out in Articles 3.2 and 3.3 of the User Agreement.
• To process payments and disbursements of Designer Fees through the escrow system and payment service provider.
• To deliver notifications, transaction confirmations, and other service communications to the User's registered email address in accordance with Articles 3.4 and 13.1 of the User Agreement.
• To provide customer service and resolve Disputes through the Resolution Center as set out in Article 12.4 of the User Agreement.
• To maintain the security of the Platform and prevent fraud, account misuse, and breaches of the User Agreement, including conducting audits as set out in Article 3.6.
• To comply with legal and tax obligations, including the issuance of tax invoices as set out in Article 6 of the User Agreement.
• To display User testimonials on the Platform, only after first obtaining the User's consent as set out in Article 13.3 of the User Agreement.
• To conduct internal analysis and product development in order to improve the quality of the Platform's Services.

Grafisa does not sell Users' Personal Data to any party. Grafisa shares Personal Data with third parties only in the following circumstances:

4.1 Between Platform Users

To facilitate Client-Designer collaboration, Grafisa shares certain necessary Personal Data (for example, name, profile photo, and Brief details) between the Client and the Designer involved in the same Order. Confidential Information exchanged between Users is subject to the provisions of Article 7 of the User Agreement.

4.2 Third-Party Service Providers (Data Processors)

Grafisa uses a payment service provider certified under PCI-DSS (Payment Card Industry Data Security Standard) to process payment instrument data, as set out in Article 8.2 of the User Agreement. Grafisa does not store payment card data directly on its systems. Grafisa may also use cloud/hosting service providers, identity verification service providers, and analytics service providers, all of which are required to process Personal Data in accordance with Grafisa's instructions and to maintain an equivalent level of security.

4.3 Legal Obligations and Competent Authorities

Grafisa may disclose Personal Data where required by law, a court order, or an official request from a competent authority, including the Ministry of Communication and Digital Affairs in connection with the reporting of data security incidents as set out in Article 8.4 of the User Agreement.

4.4 Corporate Transactions

If Grafisa is involved in a merger, acquisition, or sale of assets, Users' Personal Data may be transferred to the successor party, remaining subject to this Privacy Policy or an equivalent privacy policy of which Users will be notified in advance.

Grafisa implements reasonable technical and organisational measures in line with industry standards to protect Personal Data from unauthorised access, disclosure, loss, or alteration, as set out in Article 8.3 of the User Agreement. Such measures include, among others, encryption of data in transit, restricted access controls over financial data, and processing of payment data through PCI-DSS-certified partners.

Users understand that no electronic system is absolutely free of risk. Grafisa is not responsible for data security incidents arising from a User's negligence in safeguarding their own account credentials, as set out in Articles 3.2 and 8.5 of the User Agreement.

5.1 Data Security Incident Notification

In the event of an incident resulting in unauthorised access to Users' Personal Data, Grafisa will deliver written notification to the affected Users no later than 3x24 (three times twenty-four) hours after the incident becomes known, and will report it to the Ministry of Communication and Digital Affairs in accordance with the applicable provisions of the PDP Law.

5.2 Reporting by Users

A User who knows of or suspects unauthorised access to their account or a security vulnerability in the Platform must promptly report it to Grafisa via [email protected], no later than 1x24 (one times twenty-four) hours after becoming aware of it, before disclosing it to any other party or the public.

Grafisa stores Users' Personal Data for as long as necessary to fulfil the purposes described in this Privacy Policy, including for as long as the User's account is active, and thereafter to the extent necessary to comply with legal and tax obligations, resolve Disputes, and enforce the User Agreement. Personal Data that is no longer required will be deleted or anonymised in accordance with Grafisa's internal retention policy, unless a legal obligation requires longer retention.

In accordance with the PDP Law, Users as Personal Data Subjects have the following rights in relation to their Personal Data:

• The right to obtain information regarding the clarity of identity, the legal basis of interest, the purpose of the request for and use of Personal Data, and the accountability of Grafisa.
• The right to complete, update, and/or rectify errors and/or inaccuracies in Personal Data.
• The right to access and obtain a copy of their Personal Data.
• The right to terminate processing of, erase, and/or destroy Personal Data, to the extent not contrary to the provisions of laws and regulations.
• The right to withdraw consent to the processing of Personal Data that has been given.
• The right to object to decision-making based solely on automated processing, including profiling, that produces legal effects or has a significant impact.
• The right to suspend or restrict the processing of Personal Data proportionately.
• The right to sue and receive compensation for violations in the processing of Personal Data in accordance with the provisions of laws and regulations.

Users may exercise these rights by submitting a request via [email protected]. Grafisa will act on valid requests within the time periods set out in the PDP Law, while taking into account Grafisa's obligation to retain certain data for legal compliance or the resolution of ongoing Disputes.

The Grafisa Platform uses cookies and similar technologies to maintain Users' login sessions, remember preferences, analyse usage patterns, and enhance the security of the Platform. Users may manage their cookie preferences through the settings of the browser they use; however, disabling certain cookies may affect the functionality of the Platform.

As set out in Article 12.5 of the User Agreement, the Grafisa Platform is intended only for individuals aged at least 18 (eighteen) years or legal entities. Grafisa does not knowingly collect Personal Data from individuals below that age. If Grafisa becomes aware that Personal Data of a child has been collected without valid consent, Grafisa will take steps to delete such data.

As set out in Article 13.3 of the User Agreement, Grafisa may display User testimonials on the Platform, which may include the User's name and photo. Grafisa will first request the User's consent before displaying such testimonials, names, and/or photos.

Where Grafisa uses third-party service providers that process or store Personal Data outside the territory of Indonesia (for example, cloud/hosting services), Grafisa will ensure that the recipients of such Personal Data have a level of Personal Data protection equivalent to or higher than that set out in the PDP Law, in accordance with the applicable provisions on cross-border data transfers.

Grafisa may amend, update, or modify this Privacy Policy from time to time in accordance with operational needs or changes in laws and regulations. Changes will be notified by posting on the Platform and/or by email to the User's registered address, as set out in Article 13.1 of the User Agreement. Continued use of the Platform after the changes take effect shall be deemed the User's acceptance of the updated Privacy Policy.

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Indonesia, including the PDP Law and its implementing regulations. All Claims in connection with this Privacy Policy are subject to the dispute resolution mechanism set out in Article 12.4 of the User Agreement.