Version 1.0 · effective from the date of publication. The plain-language summary is on the data and privacy page; if the two differ, this policy prevails.
1. Controller
PT Global Payment Gateway (trading as Arkipo), NIB 2412240053279, Graha Merdeka, Jalan Merdeka, Sumerta Kelod, Denpasar Timur, Denpasar, Bali 80239, Indonesia, is the controller of the personal data described here. Data protection requests: [email protected].
2. What we collect
- Contact and request data when you use a form, write to us or request KYB: name, role, company, email, phone or messenger handle, the content of your message, and the page, referrer and campaign parameters (utm, gclid) of your visit.
- Verification data during KYC and KYB: identity documents, company registration documents, directors and beneficial owners, source of funds where the law requires it, screening results.
- Transaction data: invoices, beneficiary details, payment orders, bank confirmations, references, amounts, timestamps and, where a funding route involves a licensed partner, the partner's documents for the conversion.
- Technical data: IP address, browser and device information, and, only with your consent, analytics and advertising identifiers (see section 7).
3. Why we process it and on what basis
- To answer your request and prepare the agent agreement (pre-contractual steps and performance of a contract).
- To verify clients, screen counterparties and keep records (legal obligations under anti-money-laundering and sanctions rules).
- To execute payment orders and deliver documents (performance of a contract).
- To keep the website secure and prevent abuse (legitimate interest).
- To measure the website and advertising (consent).
4. Who receives data
Our bank and partner banks and payment institutions, to execute transfers; licensed conversion partners, where you use that funding route (under your own contract with them); our identity-verification and screening providers; the hosting and email providers that run this website and our mailboxes; professional advisers under confidentiality; and public authorities where the law requires. We do not sell personal data and do not publish partner names.
5. International transfers
Some providers process data outside Indonesia. Where that happens we rely on contracts that oblige the provider to protect the data to the standard described here and on the safeguards available under the applicable law.
6. How long we keep it
- Verification and transaction records: at least five years after the end of the relationship, as anti-money-laundering rules require.
- Requests that do not lead to a relationship: up to twelve months after the last contact.
- Technical logs: up to twelve months. Analytics data: as set in the analytics tool, with consent, and deleted when consent is withdrawn.
7. Cookies and analytics
The website sets one essential cookie that remembers your language and theme. Analytics (Google Analytics 4) and advertising measurement (Google Ads) are loaded in consent mode: no analytics or advertising cookie is set until you click “Accept” in the cookie notice. You can change your choice at any time by clearing the site's cookies in your browser; the notice will appear again. Form submissions carry campaign parameters only so that we know which channel a request came from.
8. Your rights
You can ask what data we hold about you, correct it, ask for deletion where no legal retention period applies, object to processing based on legitimate interest, withdraw consent, and receive a copy of the data you gave us in a structured format. Write to [email protected]; we answer within 15 days. You can also complain to the supervisory authority competent for personal data protection in Indonesia.
9. Security
Documents are encrypted in transit and at rest; access is limited to staff who need it for compliance or operations and is logged; staff log in with two-factor authentication. If a security incident affects your data, we inform you without undue delay.
10. Children
The services are for businesses and adults. We do not knowingly collect data from persons under 18.
11. Changes
We may update this policy. The version in force is always the one published at this address; previous versions are available on request.