Data processing agreement

1. Parties and roles

This agreement is between the business customer that accepted the Terms of Service (the "Customer") and PT. Degresh Teknologi Dinamis ("Degresh"), reachable at hello@degresh.com.

For personal data in the Customer's spaces, the Customer is the personal data controller and Degresh is the personal data processor acting on the Customer's behalf (Article 51 of the PDP Law). The Customer is responsible for having a lawful basis to process that data and for informing its data subjects.

2. Details of processing

Subject matter:

providing the Degresh Finance service to the Customer

Duration:

while the Customer uses the service, plus the deletion period in section 8

Nature and purpose:

storing, calculating, displaying, exporting and sending service emails, only to run the service for the Customer

Types of data:

names and email addresses of members and invitees; names, descriptions and amounts of transactions about staff, clients, suppliers or others that the Customer records; attachments; and security records and the activity log

Data subjects:

the Customer's space members, and the staff, clients, suppliers and others recorded in the Customer's books

The service is not designed for specific personal data such as health or biometric data. The Customer should not store it unless truly necessary.

3. Degresh's obligations

• Process the data only on the Customer's documented instructions: the Terms of Service, this agreement, and the Customer's use of the app. Degresh tells the Customer if it believes an instruction breaks the law.
• Not use the data for any other purpose: not to build features, train any model, share it or sell it.
• Keep the data confidential, and make sure everyone working for Degresh is bound by confidentiality. The app gives Degresh staff no access to the Customer's spaces.
• Help the Customer answer data subject requests and, where needed, prepare a personal data protection impact assessment.
• Keep a record of the processing carried out on the Customer's behalf.

4. Service providers (subprocessors)

The Customer gives Degresh general permission to use the service providers listed on the Service providers page. Details of the infrastructure providers are available to the Customer on request. Degresh tells the Customer by email at least 14 days before adding or replacing a provider that processes Customer data. The Customer may object on reasonable grounds within that period; if no solution is found, the Customer may stop using the service.

Degresh requires every provider to protect the data at least as well as this agreement does, and remains responsible to the Customer for that provider's work.

5. Security measures

• Every connection uses HTTPS.
• Passwords are stored as one-way hashes; two-factor secrets are encrypted; single-use recovery codes are available.
• Sign-in attempts are limited and accounts are locked for a while after repeated failures; sessions can be viewed and ended.
• Access in every space is controlled through five role levels and can be limited to specific accounts; postings above a threshold can require a second person's approval.
• Every change is recorded in an activity log that cannot be changed or deleted through the app, with the actor, time, IP address and the values before and after.
• Posted entries are never edited, only corrected by reversal or void.
• Files are kept in private, versioned object storage that can only be reached through the app.
• Data is backed up regularly.

6. Breach notice

If Degresh becomes aware of a personal data protection failure that involves Customer data, it notifies the Customer without undue delay, and no later than 24 hours after becoming aware, so the Customer can meet its 3×24-hour notice duty under Article 46 of the PDP Law. The notice describes the data affected, when and how it happened, and the handling and recovery steps, and is updated as new information becomes available.

7. Requests from authorities

If a court or government agency asks for Customer data, Degresh checks that the request is lawful, tells the Customer unless the law forbids it, and hands over only the data that is lawfully required.

8. Return and deletion of data

At any time, and when the agreement ends, the Customer can export its data: reports to PDF and Excel, journal lines and the account list to CSV, and attachments can be downloaded. At the Customer's request, Degresh deletes Customer data from live systems within 30 days, and copies in backups are kept for a limited period for recovery and then overwritten. Degresh confirms the deletion in writing on request. The exception is records the law requires Degresh to keep: bookkeeping records and the security and audit log are kept for as long as Indonesian law requires (for bookkeeping, 10 years under the tax rules), used only for security, legal duties and resolving disputes, and then deleted.

Degresh may hold off deletion while access to a space is frozen under the Terms of Service.

9. Audit help

Degresh provides the information needed to show compliance with this agreement, including answering security questionnaires. The Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, at most once a year unless after an incident, with 30 days' written notice and at the Customer's cost. An audit does not include access to other customers' data.

10. Relation to the Terms of Service

The limits of liability in the Terms of Service apply to this agreement. Where they conflict on personal data protection, this agreement prevails. This agreement is governed by the laws of the Republic of Indonesia. Customers who need a signed copy can contact hello@degresh.com.