Legal documents
Privacy Policy
Which personal data is processed, why, where, and your rights under the PDP Law.
Effective 1 October 2026 · Version 1.1
This Privacy Policy explains which personal data is processed when you use RANCAQ as managed by PT Rofasys Mitra Prima ("we"), why, where, and what your rights are. It is based on Law No. 27 of 2022 on Personal Data Protection ("PDP Law") and complements the Terms of Service.
The Indonesian version of this document is the governing version; this English version is a translation.
This policy does not apply to RANCAQ installations that customers run on their own servers (self-host); data in those installations is managed entirely by the customer.
Our role
The PDP Law distinguishes the Controller (who decides the purpose of processing) from the Processor (who processes on the controller's behalf). Our role depends on the kind of data:
| Data | Controller | Our role |
|---|---|---|
| Data the customer enters into its workspace: employee data, tickets, comments, attachments, assets | The customer (the company that owns the workspace) | Processor |
| Registrant account data and service usage data: sign-up, sign-in, security | Us | Controller |
If you are an employee using RANCAQ at your company, your company is the controller of your data inside the workspace. Requests about that data are best made to your company; we help the company fulfil them.
Data we process
| Category | Examples | Purpose |
|---|---|---|
| Account identity | Name, work email, company name | Creating and managing accounts and workspaces |
| Credentials | Password | Signing in. Passwords are never stored in their original form — only as a bcrypt hash |
| Workspace content | Tickets, comments, attachments, asset data, organisation structure | Running the service desk on the customer's instructions |
| Audit log | Who changed what, and when | Accountability and workspace security |
| Technical data | IP address, browser type, access time | Security, abuse prevention, and limiting sign-in attempts |
| Service email | Recipient address and content of system email (activation, password reset, invitations, ticket notifications) | Sending the email the service needs to work |
| Feedback | Messages you send through the feedback feature | Improving and developing RANCAQ |
We do not sell personal data and do not use it for advertising.
Legal basis
In line with the PDP Law, we process personal data on the basis of:
- performance of a contract — running the service you signed up for;
- legitimate interest — keeping the service secure and preventing abuse;
- legal obligation — where regulations require us to keep or disclose data;
- the customer's instructions — for data we process as a processor.
Cookies and browser storage
RANCAQ uses a single strictly necessary technical cookie: the session cookie that keeps you signed in. Page scripts cannot read it, and it ends when the session expires or you sign out. Your language and theme choices are stored in your browser's local storage.
There are no advertising, third-party analytics, or tracking cookies. The RANCAQ information site itself sets no cookies; the Cloudflare network may set technical cookies for traffic security.
Data location and third parties
Workspace and account data is stored on servers located in Indonesia.
We use the following third parties to run the service:
| Third party | Function | Data that may be processed |
|---|---|---|
| Cloudflare | Delivery network and tunnel connecting users to our servers; Turnstile to tell humans from robots on the sign-up form | IP address and technical request data; traffic passing through its network |
| Google (Google Workspace) | Sending system email and notifications | Recipient email address and email content |
Cloudflare may process IP addresses and technical data, and Google may process recipient email addresses and system email content, outside Indonesia. We only use third parties that apply data protection equal to or higher than the PDP Law, as required for transfers of personal data outside Indonesian jurisdiction.
How long data is kept
- Accounts: while the account is active, or until the last workspace the account belongs to is deleted.
- Trial workspaces that are not continued: permanently deleted 30 days after the trial ends.
- Activation, password reset, and invitation links: expire after 24 hours, 1 hour, and 7 days. Links are not stored in their original form, and system email content is removed from the database once the email is sent.
- Backups: database backups are kept for at most 14 days; deleted data disappears from backups after that period.
Security
Measures we apply include:
- encrypted connections (TLS) between the browser and the service;
- passwords stored as bcrypt hashes, and tokens in email links stored as hashes;
- isolation between customers at the database level (row-level security), so one workspace cannot read another workspace's data;
- an audit log of significant changes in every workspace;
- limits on sign-in and sign-up attempts to hold back abuse.
No system is entirely free of risk. That is why we also keep a procedure for personal data protection failures (see below).
Your rights
Under the PDP Law, your rights include to:
- obtain information about the processing of your personal data;
- access and obtain a copy of your personal data;
- complete, update, or correct inaccurate data;
- ask for processing to stop, and for data to be deleted or destroyed;
- withdraw consent you have given;
- object to decisions based solely on automated processing;
- suspend or restrict processing;
- obtain and use your personal data in a commonly used format;
- sue and receive compensation for violations in the processing of your personal data.
Send requests to [email protected] from your account's email address. We may ask you to verify your identity before processing a request, and we respond within the time limits set by the PDP Law. For data inside a company's workspace, we forward the request to that company as the controller.
Personal data protection failures
If a personal data protection failure occurs, we notify the affected parties and the competent authority no later than 3 × 24 hours after becoming aware of it, as required by the PDP Law. The notice covers the data affected, when and how it happened, and the steps taken to handle and recover from it.
Children
RANCAQ is intended for organisations and their employees, not for children. We do not knowingly process children's personal data.
Data Processing Agreement
This section applies between us and the customer for data we process as a processor. It forms part of the Terms of Service without a separate signature; customers with a written agreement may set out more detail there.
- Subject matter and duration. We process personal data in the customer's workspace for as long as the customer uses the service, solely to run RANCAQ.
- Instructions. We process data only on the customer's instructions — meaning the use of features by workspace users and the written agreement — unless the law requires otherwise.
- Confidentiality. People we give access to customer data are bound by confidentiality, and access is granted only when needed to run or restore the service.
- Security. We apply the security measures described in the Security section above.
- Subprocessors. The customer approves the subprocessors listed in the Data location and third parties section. We notify workspace admins before adding or replacing a subprocessor, and the customer may object.
- Assistance. We reasonably help the customer respond to data subject requests and meet its obligations under the PDP Law.
- Incident notice. We notify the customer without undue delay, and no later than 3 × 24 hours, after becoming aware of a personal data protection failure involving customer data.
- End of processing. When the service ends, we delete customer data as described in How long data is kept, unless the law requires longer retention.
- Information. On written request, we provide reasonable information to demonstrate compliance with this section.
Changes to this policy
We may update this Privacy Policy. We announce significant changes by email to workspace admins or in the application at least 14 days before they take effect. The effective date at the top of this page always shows the latest version.
Contact
Questions and requests about personal data:
PT Rofasys Mitra Prima
Gedung Graha MIR Lantai 6 Zona A1, Jl. Pemuda No. 9, Jakarta Timur, DKI Jakarta, Indonesia
Email: [email protected]