PT Semua Jadi Instan
Sejadi Privacy Policy
This is an English translation of the Indonesian policy. If the two differ, the Indonesian version prevails.
1. About this policy
This policy explains how PT Semua Jadi Instan ("Sejadi" or "we") processes personal data on the sejadi.co.id and relay.sejadi.co.id websites, and in Sejadi's services for businesses, including the WhatsApp messaging and one-time passcode (OTP) service (Relay). It follows Law Number 27 of 2022 on Personal Data Protection ("UU PDP").
Sejadi products that have their own privacy policy are governed by that policy: Relove and Tautly.
Who we are. PT Semua Jadi Instan, Ciputra World, Jalan Mayjen Sungkono Nomor 89, Blok U Nomor 15 & 16 Office Lantai 15, Kelurahan Gunung Sari, Kecamatan Dukuh Pakis, Kota Surabaya, Jawa Timur 60224, Indonesia. Email: corp@sejadi.co.id.
2. Data we collect
| Source | Data | Sejadi's role |
|---|---|---|
| The contact form on sejadi.co.id, which prepares an email in your email app; we receive the data only if you send that email | Name, email, company or brand name (optional), WhatsApp number (optional), services needed, estimated budget, and message | Controller |
| Client accounts on the Sejadi dashboard, if the client uses it | Name, email and role of the client's staff, sign-in records, and the company's billing details | Controller |
| The WhatsApp service for clients | Phone numbers of the client's end users, message content and status (sent, delivered, read, failed), OTP codes stored only as hashes, and IP address and device ID if the client sends them | Processor, on the client's instructions |
| The client's WhatsApp assets from Meta, when the client connects its account through Embedded Signup | WhatsApp account ID, Messaging account ID, phone number ID, display name, and business access token | Controller (the client's business data) |
We do not ask for national ID numbers (NIK), health data, personal financial data, or other specific personal data. If messages a client sends contain such data, the client is responsible for its legal basis.
3. What we use data for, and the legal basis
| Purpose | Data | Legal basis under Article 20(2) UU PDP |
|---|---|---|
| Replying to contact form enquiries and preparing offers | Contact form data | Your request before a contract is made (letter b) |
| Running client accounts, the service, and billing | Client account data | Performance of a contract (letter b) and legal obligations, such as tax (letter c) |
| Keeping the service secure and preventing abuse, such as mass OTP sends nobody asked for | Sign-in records, IP addresses, and sending records | Legitimate interests (letter f) |
| Sending WhatsApp messages and OTP codes on the client's instructions | WhatsApp service data | The client's legal basis as controller; Sejadi processes on the client's instructions |
We do not sell personal data and do not use it for advertising.
4. The WhatsApp service: Sejadi as processor
- For the WhatsApp service, our clients (the businesses that use the service) are the controllers of their end users' phone numbers and messages. Sejadi is a processor: we process that data only to send messages, check OTP codes, and record delivery status, on the client's instructions (Article 51(1) UU PDP). The details are set out in a data processing agreement with each client.
- Messages are sent through Meta's WhatsApp Business Platform (Cloud API), from the client's own WhatsApp account and number. Meta processes that data as the client's processor, under the Cloud API terms the client accepts when connecting its account (Meta).
- If you receive a code or message from one of our clients, send any request about your data to that business. We will help the client answer it.
- We do not use our clients' end-user data for our own purposes.
5. Who else receives data
- Google Cloud runs Sejadi's servers and databases in the Jakarta region (asia-southeast2), as Sejadi's processor.
- Meta (WhatsApp Business Platform) receives the destination number and message content to deliver them, as the client's processor.
- Microsoft 365, our email service, receives and stores the emails you send to corp@sejadi.co.id, including emails from the contact form, as Sejadi's processor.
- SMS providers, only if a client later uses SMS as a fallback. This service is not active yet; we will name the provider here before it starts.
- Competent authorities, when the law requires it.
We do not sell or rent personal data to anyone.
6. Where data is stored, and transfers abroad
- Data that Sejadi stores is kept in Google Cloud data centres in Jakarta.
- For the WhatsApp service, we set the Cloud API's local storage to Indonesia, so stored message content stays in Indonesia (Meta). While processing a message, Meta may handle its content in data centres abroad for up to 60 minutes, and local storage does not cover phone numbers. Meta keeps message data for at most 30 days.
- When data we control is processed outside Indonesia, for example by our email provider, we make sure the destination country offers a level of data protection equal to or higher than UU PDP, or that adequate and binding safeguards are in place, such as data protection terms in our contract with that provider (Article 56 UU PDP). For the WhatsApp service, Meta processes data on behalf of the client as controller, under the Cloud API terms the client accepted.
7. How long we keep data
| Data | Retention |
|---|---|
| Contact form entries | 2 years after the last message, then deleted |
| OTP records and message status, including the destination number | 30 days, then deleted |
| Security logs | 30 days |
| Client account data | While the client is active, then 1 year after the service ends |
| Billing and tax documents | 10 years from the end of the financial year, under Article 28(11) of the General Tax Provisions Law (UU KUP) and Article 11 of Law Number 8 of 1997 on Company Documents |
When the retention period ends, data is deleted or anonymised so that it can no longer identify anyone.
8. Security
- Our sites and API can only be reached over encrypted connections (HTTPS).
- Phone numbers are stored encrypted, OTP codes are stored only as hashes, and neither is ever written in full to logs.
- Staff access to systems is limited to what each role needs, uses two-step verification, and is logged.
9. If a personal data breach happens
- If we, as controller, suffer a failure of personal data protection, we notify you and the personal data protection authority in writing within 3 × 24 hours. The notice states what data was exposed, when and how it was exposed, and how we are handling and recovering from it (Article 46 UU PDP).
- When we act as a processor for a client, we notify the client as soon as possible so that it can meet the same obligation.
10. Your rights
Under Articles 5 to 13 of UU PDP, you have the right to:
- Get information about who we are, the legal basis and purpose of processing, and who is responsible (Article 5).
- Complete, update, and correct inaccurate data (Article 6). We do this within 3 × 24 hours of receiving the request (Article 30).
- Access and get a copy of your data (Article 7). We provide it within 3 × 24 hours of receiving the request (Article 32).
- End processing and ask for your data to be deleted or destroyed (Article 8).
- Withdraw consent you have given (Article 9).
- Object to decisions based solely on automated processing, including profiling, that have legal effects or significantly affect you (Article 10).
- Delay or restrict processing in proportion to its purpose (Article 11).
- Sue for and receive compensation for violations in the processing of your data (Article 12).
- Get your data in a commonly used, machine-readable format, and transfer it to another controller (Article 13).
For WhatsApp service data, send your request to the business that messaged you, because that business is the controller of the data. We will help that business answer your request.
11. How to ask for your data to be deleted
- Email corp@sejadi.co.id with the subject "Permintaan hapus data" (data deletion request).
- Give your name, and the email or WhatsApp number you used to contact us, so we can find your data. Do not send your NIK or identity documents.
- We confirm the request came from you, then delete the data and tell you when it is done, within 14 working days of receiving the request.
- Data we must keep by law, such as tax documents, is kept until that obligation ends, then deleted.
If you received a WhatsApp message from one of our clients, you can also send your request to the same address. We will forward it to that business.
12. Cookies
When this policy was written, the sejadi.co.id and relay.sejadi.co.id websites did not load any third-party analytics or advertising trackers. If you sign in to the Sejadi client dashboard, it uses a session cookie needed to keep you signed in. If we later use analytics tools, we will update this policy and ask for your consent where required.
13. Changes to this policy
We may change this policy. The latest version is always on this page with its effective date, and we notify clients of important changes by email.
Effective from: 31 October 2026.
14. Contact
PT Semua Jadi Instan, Ciputra World, Jalan Mayjen Sungkono Nomor 89, Blok U Nomor 15 & 16 Office Lantai 15, Kelurahan Gunung Sari, Kecamatan Dukuh Pakis, Kota Surabaya, Jawa Timur 60224, Indonesia. Email: corp@sejadi.co.id.
If you object to how we process your personal data, please contact us first. You can also complain to the personal data protection authority under UU PDP.