UU PDP Disclosure

This page describes how Envomate handles personal data under Indonesia’s Personal Data Protection Law (UU PDP).

Basis for processing

Processing is performed on the basis of the contract between Envomate and the tenant merchant, together with end-customer consent obtained by the tenant.

Categories of data

• Communication content exchanged through the Service.
• Contact details (phone number, name).
• Order references supplied by the tenant.

DPO (Data Protection Officer)

During the pilot period, the founder acts as the DPO (name TBD). Once a permanent DPO is appointed, their name and contact will be listed here.

Cross-border transfer

Data may be transferred to the following sub-processors and jurisdictions:

• OpenAI — United States
• Groq — United States
• Anthropic — United States
• Meta (WhatsApp Business API) — United States / Ireland
• Midtrans — Indonesia
• Xendit — Indonesia / Singapore

Breach notification

In the event of a personal data breach, Envomate will notify affected users and the DPO within 72 hours of becoming aware. Formal notification to MSKI/Kominfo will follow once required processes are in place.

Last updated: 2026-09-18