Privacy Policy

1) Who We Are

Legal entity: PT ______________________________ ("Bungkoos", "we").

Registered address: Jl. __________________, City ____________, Indonesia.

Privacy email: privacy@bungkoos.com • Support WhatsApp: +62-___________

2) Data We Collect

A. Account & Profile Data

• Name, email, phone number, password (hashed), language, timezone.
• Business profile: business name, address, tax ID (optional), logo, table info.

B. Operational Data

• Menu & catalog (item names, prices, categories, availability).
• Transactions & orders (QR order, dine-in, take-away, delivery), table number, payment method, notes.
• Cashier activity (POS), order status, timestamps, device references.
• Kitchen display data (KDS): queues, statuses, processing time.

C. Technical Data

• Server logs, IP address, device/browser type, operating system, session identifiers.
• Realtime events (e.g. join/leave table, update order status) for multi-device sync.

D. Support & Communication Data

• Support conversations, attachments, and metadata.
• Communication preferences (email, WhatsApp, in-app notifications).

E. Third-party Data (if enabled)

• Payment processors (e.g. Midtrans) — payment status, transaction IDs.
• Messaging integrations (e.g. WhatsApp Business) — delivery statuses.
• Analytics (e.g. Google Analytics) — anonymous/aggregated usage metrics.

3) How We Use Data

• Provide core features: QR ordering, realtime sync, POS cashier, and kitchen display.
• Personalize menus, tables, and workflows according to your business setup.
• Analytics and operational reports (sales, popular items, peak times).
• Security, abuse prevention, auditing, and incident handling.
• 24/7 support and service communications, updates, or policy changes.
• Legal compliance and law enforcement requests.

4) Legal Basis

We process data under one or more of the following bases (depending on applicable law):

• Contract performance — to provide services under the Terms of Service.
• Legitimate interest — e.g., to maintain security and improve services.
• Consent — for activities requiring it (e.g., optional marketing, non-essential cookies).
• Legal obligation — to comply with tax, accounting, or regulatory requirements.

5) Data Sharing

We do not sell your personal data. Data may be shared only with the following categories of partners to deliver services:

• Payment processors (e.g., Midtrans) to process transactions.
• Infrastructure providers (cloud hosting, CDN, realtime database).
• Analytics providers for aggregated usage metrics.
• Communication integrations (email, WhatsApp Business) for notifications.
• Consultants/support (security, compliance) under confidentiality agreements.

6) Data Retention

• Account data is retained as long as the account is active and up to 12 months after closure, unless earlier deletion is requested or longer retention is required by law.
• Technical logs are stored 30–180 days for security and auditing purposes.
• Transaction data is retained as required by accounting/tax regulations.

7) Security

• Encryption in transit (HTTPS/TLS) and role-based access control.
• Password hashing using industry-standard algorithms.
• Access audits and anomaly monitoring.
• Incident response procedures and scheduled backups.

While we strive for maximum security, no system is 100% secure. Please keep your credentials safe and notify us of any suspected breach.

8) Your Rights

You have rights under applicable law to:

• Access and obtain a copy of your personal data.
• Correct inaccurate or incomplete data.
• Request deletion or restriction of processing under certain conditions.
• Object to processing based on certain legitimate interests.
• Withdraw consent (for consent-based processing) without affecting prior lawfulness.
• Data portability (where applicable).

Requests can be sent to privacy@bungkoos.com. We may require ID verification before processing requests.

9) Children

Our services are not directed at children under the age of 13 (or local minimum age). We do not knowingly collect children's data. If you believe we hold data about a child, contact us for deletion.

10) Cookies & Similar Technologies

We use essential cookies for authentication and core operations, and optional cookies for analytics and user experience improvements. You can manage cookie preferences via your browser settings or our app preference center.

11) International Data Transfers

Your data may be processed in data centers outside your country. We implement appropriate safeguards (e.g., standard contractual clauses) in line with applicable regulations.

12) Changes to this Policy

We may update this policy from time to time. The latest version will be marked with the update date at the top. If material changes are made, we will provide clear notice (e.g., via email or in-app notification).

13) Contact

For questions, data access requests, or privacy complaints, contact:

Note: This document is provided as a general template and does not constitute legal advice. Please consult legal counsel to ensure compliance with applicable regulations (e.g., Indonesia PDP Law, GDPR, etc.).