Syntherion Privacy Policy

The personal data controller is:

• Name: PT Syntherion Global Nusantara
• Address: Jl. Rancagoong, Kampung Cipaku, Kel. Sukawangi, Kec. Warungkondang, Kabupaten Cianjur - 43261, Indonesia (ID)
• Privacy contact email: privacy@syntherion.co.id
• Data Protection Officer: Abdilah Sammi (abdilah.sammi@syntherion.co.id)

a. Data you provide directly

• Name, email address, phone number, company name, and job title
• Account information (username and encrypted password)
• Contents of messages or contact forms, demo requests, or newsletter subscriptions
• Payment and billing information (where applicable), processed by our third-party payment provider, Paylabs (paylabs.co.id)
• Any other data you send when communicating with us

b. Data collected automatically

• IP address, device type, operating system, and browser type and version
• Pages visited, visit duration, links clicked, and referring sites
• Approximate location data (city/country level) based on IP address
• Cookie data and similar tracking technologies (see Section 8)

c. Data from third parties

• Data from business partners or publicly available sources

We do not knowingly request specific personal data (for example health, biometric, or religious belief data) unless necessary and you have given your consent.

We process your personal data for the following purposes:

We do not sell your personal data. We may share it with:

• Service providers (data processors) who help our operations, such as cloud infrastructure providers (Amazon Web Services/AWS and Tencent Cloud), email, payment (Paylabs), and customer support. They may only process data on our instructions and must keep it confidential.
• Our affiliates, to the extent necessary to provide the Services.
• Professional advisors (legal, accounting, audit) bound by confidentiality obligations.
• Competent authorities, where required by law, court order, or valid legal process.
• Parties involved in corporate transactions (merger, acquisition, or asset sale), with notice to you if control over your data changes.
• Other parties with your consent.

To provide the Services, we use third-party cloud infrastructure arranged as follows:

• Database: stored on Amazon Web Services (AWS) in the Jakarta, Indonesia region.
• File storage (for example, documentation photos): stored in an Amazon S3 bucket in the Jakarta, Indonesia region. These files are delivered through the Amazon CloudFront content delivery network, so temporary copies (cache) may be located at CloudFront edge locations in various countries.
• Application hosting: our application servers run on Tencent Cloud in the Jakarta, Indonesia region. Data you send or receive through the applications and website is processed on those servers. Permanent storage of your personal data is in the database and S3 bucket on AWS Jakarta as described above.

Accordingly, all of our primary infrastructure (database, file storage, and application servers) is located within Indonesia (Jakarta region). Temporary copies of files may be located at CloudFront edge locations in various countries to ensure fast content delivery. We ensure that any data processing and transfer are carried out with adequate safeguards in accordance with applicable laws and regulations, including through agreements with service providers, access controls, and encryption in transit. By using the Services, you acknowledge these arrangements.

We may add or replace cloud providers and server locations from time to time. Any material change will be reflected in an update to this Privacy Policy.

We retain your personal data for as long as necessary for the purposes described in this Policy, for as long as your account is active, or for as long as required by law (for example, for tax and accounting purposes). Once no longer needed, data will be securely deleted or anonymized.

We implement reasonable technical and organizational measures, including encryption in transit, role-based access controls, security monitoring, and regular backups. However, no method of transmission or storage is completely secure. In the event of a personal data protection failure, we will notify you and the relevant authorities in accordance with applicable law.

We use cookies and similar technologies for:

• Essential cookies: to make the site function (for example login sessions and security)
• Preference cookies: to remember your settings

You can manage or disable cookies through your browser settings. We do not currently use analytics cookies. Disabling certain cookies may affect the functionality of the Services.

Under Law No. 27 of 2022 on Personal Data Protection and related regulations, you have the right to:

• Obtain information about the identity, legal basis, and purposes of the processing of your data
• Access and obtain a copy of your personal data
• Complete, update, and/or correct errors in your data
• Delete or destroy your personal data
• Withdraw consent you have given
• Object to decisions based solely on automated processing
• Delay or restrict the processing of personal data
• Claim compensation for violations in the processing of your data in accordance with law
• Obtain and/or use your data in a commonly used format (data portability)

To exercise these rights, contact us at privacy@syntherion.co.id. We will respond within the timeframe set by applicable regulations and may ask you to verify your identity first.

Our Services are not intended for children under 18 years of age, and we do not knowingly collect personal data from children without the consent of a parent or guardian. If you become aware that your child has provided data to us, please contact us so that the data can be deleted.

Our Services and applications may contain links to third-party sites or services. We are not responsible for the privacy practices of those parties. We encourage you to read their privacy policies.

In addition to the general terms above, the following terms apply to users of our applications.

a. GuardSync (Guard Tour Application)

GuardSync is used to record and monitor security guard patrol activities at specific sites. Application users consist of Officers (security guards) and Supervisors. The data we process includes:

• Account and assignment data: name, employee ID, email address, role (Officer/Supervisor), and the list of sites assigned to you.
• Patrol session data: patrol start and end times, the site where the patrol takes place, and session status.
• Checkpoint visit data: results of QR Code checkpoint scans, visit time, area condition (AMAN/safe, WASPADA/alert, or DARURAT/emergency), and notes you enter.
• Documentation photos: photos are taken directly through the application camera (not from the gallery) and may be watermarked to preserve authenticity. Photos may unintentionally include images of other people or certain areas at the site.
• Location data (GPS): coordinates are sent during a patrol session and when submitting a visit report, only if you grant location permission. GuardSync does not perform background location tracking.
• Daily logbook data: activity entries such as routine monitoring, incoming/outgoing goods records, facility damage, potential hazards, and incidents, along with their status (active, closed, accepted).
• Review and audit data: follow-up status of reports by Supervisors (REVIEWED, ESCALATED, RESOLVED) and the history of changes for audit purposes.
• Technical data: authentication tokens (stored in the device's secure storage), network connection status, and security logs.

Purposes of processing: verifying patrol visits, documenting field conditions, providing visibility to Supervisors, storing patrol history and incident reports, and maintaining the security and accountability of operations.

Who can see your data: Supervisors at the same site, as well as organization administrators (companies that use GuardSync, for example security service companies or site managers) through the web portal. Patrol data is work-activity data and may therefore be viewed and used by your employer for operational purposes and compliance evaluation.

Roles of the parties: PT Syntherion Global Nusantara acts as the Personal Data Controller for data processed through GuardSync. All processing is carried out internally by Syntherion, using third-party cloud infrastructure as described in Sections 4 and 5. Requests regarding your data rights may be submitted directly to us at privacy@syntherion.co.id or through your employer, and we will follow up on them.

GuardSync security: connections to the server use SSL pinning to prevent interception (MITM); tokens are stored using Keychain (iOS) or KeyStore (Android); refresh tokens are rotated each time they are renewed; and QR payloads are signed and validated by the server.

b. Application Permissions

The application may request access permissions on your device. We only request permissions that are necessary:

• Camera: to scan checkpoint QR Codes and take documentation photos.
• Location: to capture GPS coordinates during a patrol session and when submitting reports; not tracked in the background.
• Network: to send and receive data from the server. The application requires an internet connection for its main operations.

You can manage or revoke permissions through your device settings, but some features, such as QR scanning, documentation photos, or location recording, may not work.

c. Application Technical Data

We may collect crash reports, performance data, and application version information to improve the stability and security of the application. This data is collected and processed internally by Syntherion, without using third-party crash reporting or analytics services.

d. Account and Data Deletion

You may request deletion of your account and data by contacting privacy@syntherion.co.id. Deletion of account data and patrol data may depend on the retention policy of your employer organization. Certain data will still be retained as required by law or for audit purposes (for example compliance records and incident report history).

We may update this Privacy Policy from time to time. Material changes will be announced through the site or by email, and the "Last updated" date above will be adjusted. Continued use of the Services after a change takes effect means you accept the updated policy.

If you have questions, complaints, or privacy-related requests:

PT Syntherion Global Nusantara

Email: privacy@syntherion.co.id

Address: Jl. Rancagoong, Kampung Cipaku, Kel. Sukawangi, Kec. Warungkondang, Kabupaten Cianjur - 43261, Indonesia (ID)

Data Protection Officer: Abdilah Sammi

DPO email: abdilah.sammi@syntherion.co.id