Data Processing Addendum

This addendum applies where your Content includes personal data. You are the controller. PT GLOBAL RAYA ORIS WIJAYA is the processor. It supplements the Terms of Service.

Effective 6 September 2026 · version 1.2

01. Scope and instructions

We process personal data contained in your Content only to provide the Service, and only on your documented instructions, which include your use of the API, the MCP server and the web application. We will tell you if an instruction appears to breach applicable data protection law. Subject matter: object storage and link generation. Duration: the term of your account. Data subjects and categories: determined by you.

02. Confidentiality and personnel

Our personnel are bound by confidentiality obligations and access personal data only where needed for support, security or billing. Access is role-based, logged and reviewed.

03. Security measures

TLS in transit; encryption at rest; presigned links with a default one-hour expiry; hashed API keys with customer-controlled rotation; multi-factor authentication for production access; audit logging; backup with a 90-day maximum retention; documented incident response.

04. Sub-processors

You authorise the sub-processors in the table below. We impose data protection obligations on them no less protective than this addendum, and we remain responsible for their performance. We will give at least 30 days notice by email before we add or replace one. You may object on reasonable data protection grounds. If we cannot resolve the objection you may terminate the affected part of the Service without penalty.

Armitage Labs OÜ acts as merchant of record. It collects your payment details directly, as an independent controller for that purpose. We never receive or store your card number.

This list is complete on the effective date of this version.

05. International transfer

Our sub-processors operate outside Indonesia, so personal data is transferred internationally. Articles 55 and 56 of Law No. 27 of 2022 apply to those transfers.

We assess the level of personal data protection in the country of each sub-processor. Where we cannot establish that the level is at least equivalent to Indonesian law, we rely on adequate and binding safeguards in our contract with that sub-processor, as Article 56 paragraph (3) allows. Our contract with Cloudflare, Inc. includes the European Commission Standard Contractual Clauses, which bind it to those safeguards. Armitage Labs OÜ processes personal data inside the European Economic Area.

As controller, you are responsible for having a lawful basis under Articles 55 and 56 for the transfer that your use of the Service instructs, including any consent your data subjects must give. On request we will describe the safeguards that apply to a given transfer.

06. Assistance, incidents and audit

We will help you respond to data subject requests and to regulators, at your cost where the effort is substantial. If we become aware of a personal data breach affecting personal data in your Content, we will notify you without undue delay and in any case within 24 hours of becoming aware, with the facts known at that time and further detail as it reaches us. You are the controller: you remain responsible for telling your data subjects and the competent authority inside the period your own law sets, which under Law No. 27 of 2022 is 3 x 24 hours. On written request, no more than once a year, we will provide the information reasonably needed to demonstrate compliance; an on-site audit requires reasonable notice and confidentiality terms.

07. Return and deletion

You can export your Content at any time through the API or the web application. On termination we delete personal data from live systems within 30 days and from backups within 90 days, unless the law requires us to keep it longer, in which case we keep it only for that purpose.