Privacy Policy

1. About This Policy

This Privacy Policy explains how [COMPANY NAME], the operator of Seedo ("Seedo", "we"), collects, uses, stores, and protects personal data in accordance with Indonesian Law No. 27 of 2022 on Personal Data Protection (PDP Law) and related regulations.

This policy applies to:

• visitors to the Seedo website;
• Clients and account users (business owners, admins, and agents) who register for and use the Service.

2. Our Role: Controller and Processor

Seedo has two distinct roles:

• As a Data Controller, we process personal data of website visitors and Client account data (such as name, email, and billing data) for our own purposes. Sections 3–11 of this policy govern that processing.
• As a Data Processor, we process End User data (visitors and customers of our Clients who chat through the widget, WhatsApp, Instagram, and other channels) solely on behalf of and under the instructions of the Client.

For End User data, the Client is the Data Controller that determines the purposes and means of processing. The Client is responsible for the legal basis of processing, privacy notices to End Users, and fulfilling their rights. If you are an End User who has chatted with one of our Clients, please read that business's privacy policy and submit your request directly to that business. We will forward any requests we receive to the relevant Client.

3. Data We Collect

Data you provide:

• account data: name, email, phone number, company name, job title, and password (stored hashed);
• billing data: billing address, tax ID, and transaction history (card data is processed directly by our payment provider and not stored by us);
• communications with us: support questions, emails, and forms you submit.

Data collected automatically:

• device and log data: IP address, browser type, operating system, pages visited, access times;
• Service usage data: features used, settings, and activity statistics;
• cookies and similar technologies (see Section 7).

Data from third parties: for example profile data when you sign in with Google, or data from partners and payment providers.

4. How We Use Data

We use personal data to:

• create and manage accounts and provide the Service;
• process payments and issue invoices;
• provide customer support and send important Service notices;
• maintain security, prevent fraud, and investigate abuse;
• analyze and improve the Service;
• send product and promotional information, which you can opt out of at any time;
• comply with legal obligations and enforce our Terms of Service.

5. Legal Bases

We process personal data on one or more of the following legal bases under the PDP Law:

• performance of a contract with you (our Terms of Service);
• your consent, for example for marketing or non-essential cookies;
• legitimate interests, such as security and product development;
• compliance with legal obligations, for example tax obligations.

6. Sharing of Data

We do not sell personal data. We only share data with:

• sub-processors and service providers that help us run the Service, such as cloud/data center, email, analytics, customer support, payment, and AI model providers, bound by confidentiality and security obligations;
• Third-Party Services connected by the Client (such as WhatsApp or Instagram), according to the Client's instructions;
• competent authorities, where required by law or court order;
• business successors, in case of a merger, acquisition, or asset transfer, subject to this policy.

7. Cookies

Our website and widget use cookies for:

• essential cookies: keeping login sessions and security;
• functional cookies: remembering preferences such as language and visitor chat history;
• analytics and marketing cookies: understanding site usage and measuring advertising effectiveness.

You can manage or delete cookies in your browser settings. For the chat widget installed on a Client's website, the Client is responsible for informing its visitors and obtaining cookie consent as required by applicable law.

8. International Data Transfers

Data may be stored or processed on servers outside Indonesia by our sub-processors. In such cases we take reasonable steps to ensure the data remains protected to an equivalent standard, in line with the PDP Law. For End User data, the Client as Controller is responsible for ensuring such transfers have a valid legal basis.

9. Data Retention

We keep account data while your account is active and as long as needed for the purposes in this policy. After an account is terminated, Client data may be deleted after 30 days, unless longer retention is required to meet legal obligations (such as tax records), resolve disputes, or enforce agreements. Retention of End User data is determined by the Client through the Service settings.

10. Data Security

We implement reasonable technical and organizational security measures, including HTTPS/TLS encryption, role-based access control, regular backups, and system monitoring. However, no system is completely secure. You are responsible for keeping your password confidential and limiting agent access as needed.

11. Your Rights

Under the PDP Law, you have the right to:

• be informed about the processing of your personal data;
• access and obtain a copy of your data;
• correct inaccurate data;
• request deletion or destruction of your data;
• withdraw consent you have given;
• object to processing for direct marketing;
• object to decisions based solely on automated processing.

Send requests to [email protected]. We will respond within the period set by regulation and may ask you to verify your identity. Requests concerning End User data will be forwarded to the relevant Client as the Data Controller.

12. Children

The Service is intended for businesses and not for children under 18. We do not knowingly collect children's personal data. If a Client uses the Service to interact with children, the Client is responsible for obtaining parental or guardian consent as required by law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The date of the latest update is shown at the top of this page. Material changes will be notified by email or in the dashboard.

14. Contact

For privacy questions or requests, contact:

[COMPANY NAME] — Data Protection Officer
[REGISTERED OFFICE ADDRESS]
Email: [email protected]