Privacy notice: four additional clauses

PT Nara Inovasi Indonesia acts on requests for data from law enforcement only through a formal written request addressed to PT Nara Inovasi Indonesia, carrying its legal basis and the identity of the official making it. We do not act on requests made verbally, through informal conversation, or through unofficial channels.

Every request that reaches us is first assessed against the laws in force in Indonesia, including Law Number 27 of 2022 on Personal Data Protection. That assessment covers whether the request has a valid legal basis, whether the party making it holds the authority to do so, and whether the scope of the data is reasonable against the purpose stated.

The data we hand over is limited to the data relevant to that request. We do not hand over data outside the scope requested, and we do not hand over the whole contents of an account where only a part of it is needed.

Every request we receive, every assessment we make, and every set of data we hand over is recorded in an internal log, together with its date, its legal basis, and the party that made it. We keep that record as part of our accountability.

So far as the law does not forbid us from doing so, we tell the brand concerned that such a request has been made.

While a brand's subscription is running, we keep that brand's data so that the platform can work as it should.

When a brand ends its subscription, a window of 90 days opens, counted from the date the subscription ended. Within that window the brand may request an export of its own component data in CSV format. The export is issued manually by our operator at the brand's request, and is not a self-service download.

What the export includes is the brand's own component data. What it does not include is the passport page in rendered form, templates, theme configuration, QR images together with their print blocks, passport addresses and their resolver paths, hangtag artwork, and report documents. Those parts are assets of the Mula platform and remain with the platform.

After the 90 day window ends, the brand's data is deleted from our production systems. There are four exceptions, and all four are named here. First, data we are required to keep in order to meet tax and bookkeeping obligations under the laws in force, for example invoices, transaction records, the brand's tax number (NPWP), and transfer proofs; that data is kept for the period required, typically ten years, and is not used for any other purpose. Second, the names, email addresses and telephone numbers of the people who used the account, which we keep for up to 12 months after the account closes, or longer if there is a dispute. Third, reports we have already released to the brand or to a party the brand named; a released report cannot be recalled, because copies of it have been outside our control since the moment it was issued, so what we delete is the data that produced it, not the report already in circulation. Fourth, published passports covered by the Passport Archive: they remain available at the same addresses for the archive period, and may still show maker names or regions under the brand's attestation. Beyond these four, no brand data is kept after the 90 day window ends.

A passport address cannot be reused by another brand, even after a subscription has ended and its data has been deleted.

A complaint about personal data protection may be sent by electronic mail to team@mula.asia. A complaint may also be made in writing to PT Nara Inovasi Indonesia, Next Office, Menara Agrinas Palma Lantai 15 Unit 15-03, Jl. H. R. Rasuna Said Kavling VI No. 9 Blok X2, RT 9/RW 4, Kuningan Timur, Kecamatan Setiabudi, Kota Jakarta Selatan, Daerah Khusus Ibukota Jakarta 12950.

We give a first response within 3 working days of a complaint being received. Where resolving it takes longer, we report how the handling is progressing together with an estimate of when it will be resolved. We work to resolve a complaint within 14 working days.

Under Law Number 27 of 2022 on Personal Data Protection, a data subject has the right to:

1. obtain information about their own personal data that we process, including the purpose of the processing and its legal basis;
2. obtain access to and a copy of their own personal data;
3. correct or update their own personal data where it is inaccurate or incomplete;
4. end the processing of, delete, or destroy their own personal data, so far as this does not conflict with retention obligations under the law;
5. withdraw consent previously given;
6. object to a decision taken solely by automated means; and
7. bring a claim and receive compensation for a breach in the processing of their own personal data.

A request to exercise these rights is made through the complaint channel above. We may ask for reasonable further information to establish the identity of the person making it before the request is processed.

The personal data we handle for brand accounts is: the names, electronic mail addresses, and telephone numbers of the people who use the account; the brand's legal name, address, and tax number (NPWP); the names and regions of makers and suppliers the brand records, with a maker's name shown only under the brand's attestation; and the transfer proofs the brand uploads, with their date and amount. A proof can contain the sender's account number, and we keep it as it was uploaded. We process transfer proofs to perform our contract with the brand and to meet bookkeeping and tax obligations, keep them for the period those obligations require, typically ten years, and use them only for payment, tax, and dispute handling. We store no card data, and there is no payment service provider in this path. The data we handle is not used to train artificial intelligence models.

Data is held in cloud data centres located in Singapore, namely Supabase and Vercel. That transfer of data outside Indonesian territory is carried out with the protections required by Law Number 27 of 2022 kept in place.

Where a complaint is not resolved, the data subject has the right to bring it to the authority responsible for personal data protection.

The brand is responsible for the truth, the accuracy, and the lawfulness of content uploaded to a passport page, including product descriptions, material composition, supporting documents, images, and maker attribution. The brand is responsible for making sure that it holds the right to upload that content and that the content infringes neither the rights of others nor the laws in force.

Maker attribution can be displayed only while the brand holds an attestation over that record that remains valid. The name of a person under 18 is never displayed, and the attribution falls to the name of a workshop, a group, or a collective.

Mula does not verify the truth of every piece of content uploaded. The evidence tier shown beside a claim states how far that claim is supported by documents, and is not a statement by Mula that the claim is true.

PT Nara Inovasi Indonesia has the right to disable content that breaches the law or the terms of service, together with a notice to the brand concerned setting out the reason for disabling it and the steps open to the brand. In urgent circumstances, for example an order from an authority or a real risk of harm to another party, content may be disabled first and the notice given afterwards.

A third party who considers that content on a passport page breaks the law, infringes their rights, or carries their name without consent may make a report through the same complaint channel, team@mula.asia. A report should carry the address of the passport page concerned, the part of the content at issue, the ground of the objection, and how to reach the person reporting. Reports that arrive are handled under the same response deadlines as those set out in the Complaint Channel and Data Subject Rights section.

A maker whose name appears on a passport page may withdraw their consent at any time, either through the brand that recorded them or through the complaint channel above. A withdrawal of consent takes effect on the public passport page within 24 hours of the withdrawal being received.

When a maker's request to delete their record is completed, we revoke the public attribution and anonymise the record so that it no longer identifies the person: the name is replaced by a neutral marker, technique notes are cleared, and the region is kept only at the level shown on the passport. We keep a record of the request and an audit log, without the former name, to show that the request was fulfilled.