Privacy Policy

1. Who controls your data

PT. Digital One Global is the controller of the personal data described in this policy. Our registration numbers and office address are at the top of this page.

Write to [email protected] for anything to do with your personal data, including any request described in section 9. That address reaches the people who handle these requests, and we track the response clock against it.

2. What we collect

We collect the data we need to sell you a plan, deliver it, and keep the service secure:

• Account data: your name, your email address, and your phone number if you give us one. Sign-in is handled by our authentication provider, which stores your credentials. We never see or store your password.
• Order data: the plans you buy, the destination, the amount, the payment method, the payment status, and your transaction history.
• eSIM data: the identifiers of the eSIM issued for your order, including its ICCID and, where the operator supplies them, its IMSI and MSISDN, together with its activation state and how much data it has used.
• Wallet data: your balance and every entry written to its ledger.
• Referral data: your referral code, and the link between you and someone you invited, or who invited you.
• Application data: if you apply for a job or join our talent pool, the CV and other files you upload, the answers you give, and the contact details you provide.
• Support data: what you write to us when you ask for help.
• Technical data: access logs used to keep the service secure and to prevent abuse, and, for a job application, a salted hash of the IP address the submission came from. We do not store the raw IP address.
• Preferences: the language, display currency and theme you choose. These are held in your browser, not in our database.

3. Why we use it, and on what legal basis

Each purpose has a basis under Article 20 of the Personal Data Protection Law:

• To process your order and deliver your eSIM. Basis: performing our contract with you.
• To hold your wallet and keep its ledger. Basis: performing our contract with you.
• To answer your support requests and handle a refund. Basis: performing our contract with you, and our legitimate interest in helping customers.
• To meet tax, accounting and other legal obligations, and to keep the records we must be able to show. Basis: compliance with a legal obligation.
• To prevent fraud, keep the service secure, and stop abuse. Basis: our legitimate interest in protecting the service and our customers.
• To assess a job application, including reading a CV and grading a written test. Basis: your consent, which we ask for and record when you submit.
• To contact you about a role, where you applied for one or joined our talent pool. Basis: your consent.

4. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires:

• Order, payment and eSIM records: while your account is open, and afterwards for as long as Indonesian tax and bookkeeping rules require, which is currently up to 10 years.
• Wallet balance and ledger: the same period, because the ledger is part of our accounting record.
• Account data: while your account is open. When you close it, we delete the account and the data attached to it, except what we must keep for tax and accounting.
• Technical logs: only as long as we need them to investigate a security issue, then they are removed.
• Job application and CV: 18 months from your last submission. The record is then archived, which takes it out of the active pool. You can ask us to erase it sooner, at any time.
• A published testimonial that carries your name: until you ask us to remove it, or until you close your account and ask us to remove it at the same time.

5. Who we share it with

We do not sell your personal data, and we do not share it for advertising. We do not run advertising or analytics trackers on this site.

We share data only with the providers that make the service work. Each receives the minimum it needs for its own function:

• Our authentication provider, which manages your sign-in and stores your credentials.
• Our database and hosting providers, which store the service's data and serve this website.
• Our payment provider, which processes the Rupiah charge. It receives your name, your email address, the order reference and the amount.
• The eSIM provider, which issues the plan. It receives the order reference and the package, and does not receive your name or email address.
• Our email provider, which delivers your order, wallet and account messages.
• Our exchange-rate provider, which receives currency codes only, and never personal data.
• Our file-storage provider, which holds uploaded application files in a private store.
• A model provider, which processes the text of a CV and of a written test to help our hiring team read them. This applies only if you apply for a job.

6. Where your data goes

Some of our providers operate outside Indonesia, so your personal data may be transferred to and processed in another country.

Article 56 of the Personal Data Protection Law allows a transfer abroad where the receiving country has protection at least equal to ours, where there are sufficient and binding protections, or where you consent. We rely on the second of these: our providers are bound by contract to protect the data they process for us, and to process it only on our instructions.

We send each provider the minimum it needs. Where a provider can be chosen, we prefer one that processes data inside Indonesia or in a jurisdiction with comparable protection.

7. Cookies and browser storage

We use a small number of cookies, and none of them is for advertising:

• A language cookie, so the site opens in the language you picked. It lasts one year. If you clear it, the site falls back to Indonesian.
• A display currency cookie, so prices stay in the currency you picked. It lasts one year, and falls back to Rupiah.
• A page-size cookie, so the store's grid matches your screen. It lasts one year.
• A referral cookie, set only when you arrive through someone's invitation link, so we can credit them after you sign up. It lasts 30 days, and only our server can read it.
• Sign-in cookies set by our authentication provider. These are what keep you signed in; without them you cannot stay logged in.
• Your theme choice, which is stored in your browser's local storage rather than in a cookie.

8. How we protect it

Your password is handled entirely by our authentication provider. We never receive it, so we cannot store it or lose it.

Card details never reach us. Our payment provider hosts its own card form on its own domain, and we receive only the result of the payment. We do not store a card number, not even the last four digits.

We restrict access to personal data to the staff who need it for their work, and administrative actions on customer records are written to an audit log.

Files you upload when applying for a job are stored privately. They are read back only through a route that checks who is asking, and they are never publicly readable.

We transmit personal data over encrypted connections.

9. Your rights

The Personal Data Protection Law gives you the right to:

• Ask what personal data we hold about you, and how it has been used.
• Ask us to correct or complete data that is wrong or out of date.
• Ask us to delete data we no longer need for the purpose we collected it for.
• Withdraw consent you gave, for example for our talent pool, without it affecting anything you were entitled to before.
• Ask us to limit or stop processing your data.
• Object to a use based on our legitimate interest.
• Receive your data in a format you can use, and ask us to send it to another controller where that is technically possible.
• Complain to the supervisory authority for personal data protection.

10. How quickly we answer

Write to [email protected]. We answer a request to see, correct, delete, limit or stop processing within 3x24 hours of receiving it, as Articles 30, 32, 40 and 41 of the Personal Data Protection Law require. If we need longer for a genuinely complex request, we tell you why and how long.

We may ask you to confirm you are the person the data is about before we act, so that we do not give one person's data to another. We will not ask for more than we need to check that.

11. If personal data is exposed

If personal data is exposed, we notify you and the supervisory authority in writing within 3x24 hours of becoming aware, as Article 46 requires.

The notice says what was exposed, when and how it happened, and what we are doing to handle it and to prevent it happening again.

12. Children

Sentadu is for adults. We do not knowingly collect personal data from anyone under 18, and we do not direct the service at children.

If you believe a child has given us personal data, write to [email protected] and we will delete it.

13. Job applications and your CV

What we store: your name, your contact details, the links you give us, the answers you give, and the files you upload, such as a CV, portfolio or certificates.

Why: to assess your application, and, if you agree, to contact you about roles that may fit.

Consent: we ask for it before we store your CV, and we record when you gave it. You can withdraw it at any time, and we then stop using the record to assess you.

How long: 18 months from your last submission. The record is then archived, which means it stays in our database but leaves the active pool and is no longer used to assess you for new roles. You can ask us to erase it at any time.

Erasing it: we delete the database record and every file you uploaded. One detail we state plainly: our audit log keeps a record that an erasure took place, and that entry includes the name and email address it concerned. We keep it because we must be able to show that we honoured the request.

Who sees it: our hiring team. Uploaded files are stored privately and are never publicly readable.

Automated review: we use a model provider to help read a CV and to score a written test. It produces a summary and a score for our team. A person makes the hiring decision, and the model's output is never presented to you as the decision.

Applying does not need a Sentadu account, and an application is not linked to your account unless you already have one.

14. Changes to this policy

We may change this policy. The current version is always on this page, with the date it took effect at the top.

If a change affects how we use personal data you have already given us, we tell you before it takes effect, as Article 21(2) requires, and give you the chance to object.

The Indonesian version of this policy governs. The English version is provided so that you can read it in your own language.

15. Contact

For anything about your personal data, write to [email protected].

Our office address and registration details are at the top of this page. For a question about an order rather than your data, [email protected] reaches the support team faster.