Data Processing Agreement (DPA)

Last updated: September 15, 2026

1. Introduction

This Data Processing Agreement ("DPA") supplements the master services agreement between Dewata Tech ("Processor") and the Client ("Controller"). It applies whenever Dewata Tech processes Personal Data on behalf of the Client in connection with website development, hosting, analytics, lead capture, property booking systems, and related services. This page is the public version to read before we work together; the DPA binds once it is signed as an attachment to the services contract.

This DPA is structured to satisfy obligations under Indonesian Law No. 27 of 2022 on Personal Data Protection ("UU PDP"). For international clients, the DPA also references the principles of the European Union's General Data Protection Regulation (GDPR), particularly Article 28 governing the Controller and Processor relationship. Where this DPA conflicts with the master services agreement, this DPA prevails specifically for matters of data protection.

2. Definitions

For the purposes of this DPA, the following terms have the meanings set out below:

Controller: The Client, who determines the purposes and means of processing Personal Data, as defined in Article 1 paragraph 4 of UU PDP.
Processor: Dewata Tech, who processes Personal Data on behalf of and on the documented instructions of the Controller, as defined in Article 1 paragraph 5 of UU PDP.
Personal Data: Any data relating to an identified or identifiable natural person, whether directly or indirectly, of either a general or specific nature, in line with Article 1 paragraph 1 of UU PDP.
Data Subject: The natural person to whom the Personal Data relates, including website visitors, leads, villa booking guests, property clients, and the Controller's employees.
Sub-Processor: Any third party engaged by the Processor to process Personal Data on behalf of the Controller, including hosting providers, analytics platforms, and advertising platforms.
Data Breach: A security incident leading to unauthorized access, loss, alteration, or disclosure of Personal Data being processed.

3. Scope and Subject Matter

This DPA governs the processing of Personal Data carried out by Dewata Tech while delivering services to the Client. The scope of processing covers:

Website and application hosting: Storage of content, media files, and databases containing the Personal Data of the Client's visitors or customers.
Analytics and tracking: Collection of visitor behaviour data via Google Analytics 4, Microsoft Clarity, and Meta Pixel on the Client's instructions.
Lead capture and contact forms: Processing names, emails, phone numbers, company details, and inquiry messages submitted through the Client's forms.
Booking and property management systems: For villa, hotel, and real estate clients, processing of guest booking data, prospective buyers, and property inquiries.
Transactional email and notifications: Sending booking confirmations, inquiry replies, and system notifications on behalf of the Client.

The duration of processing matches the term of the services agreement, plus any retention period agreed for backup and legal compliance purposes.

4. Roles and Responsibilities

The Client acts as the Controller, determining the purposes, lawful bases, and means of processing Personal Data. The Client is responsible for the validity of Data Subject consent, transparency toward Data Subjects, and compliance with UU PDP and any other regulations applicable to the Client's business.

Dewata Tech acts as the Processor, processing Personal Data solely on the Client's documented written instructions. Dewata Tech will not use the Client's Personal Data for Dewata Tech's internal purposes, will not sell or share data with third parties beyond the approved Sub-Processors, and will not perform any additional processing without the Client's prior written consent.

5. Processor Obligations

As Processor, Dewata Tech commits to the following obligations:

Process Personal Data only on the Controller's documented written instructions, including for transfers of Personal Data to other countries, unless required to act otherwise by Indonesian law.
Keep Personal Data confidential: access to the Client's Personal Data is limited to the people who work on the project, and each of them is bound by a written confidentiality obligation. Anyone new signs the same obligation before access is granted.
Implement appropriate technical and organizational security measures as set out in Section 8 of this DPA.
Notify the Controller of a data breach no later than 24 hours after the Processor becomes aware of it, with what is known at that point: the Personal Data affected, when and how the breach happened, the approximate number of Data Subjects affected, and the handling and recovery steps. Anything not yet known follows as soon as it is, so the Controller can meet its written 3x24-hour notification duty under Article 46 paragraph 1 of UU PDP.
Assist the Controller in fulfilling its obligations to Data Subjects and supervisory authorities, including support for any required Data Protection Impact Assessment (DPIA).
Delete or return all Personal Data at the end of the service term, at the Controller's choice, unless retention is required by applicable law.

6. Sub-Processors

The Controller authorises the use of Sub-Processors in the signed contract or DPA attachment, not through this page. The list below shows the Sub-Processors we currently use; the contract attachment names the ones that apply to the Client's project:

Vercel Inc. (United States, with a global edge network): hosting and deployment for the Client's Website and Next.js applications, on projects that use Vercel.
Supabase, Inc. (Singapore, United States): database, authentication, and storage for applications that use it.
Sanity.io (United States, EU): CMS for website and blog content.
Cloudflare, Inc. (global): hosting for the Client's Website on projects that use Cloudflare, and Workers for the villa booking engine payment bridge.
Resend (United States): transactional email from Client applications.
Google LLC (global): Google Analytics 4, Google Tag Manager, and Google Ads.
Meta Platforms, Inc. (global): Meta Pixel, Conversions API, and WhatsApp.
TikTok (global): TikTok Pixel and Events API.
Microsoft Corporation (global): Microsoft Clarity for session replay and heatmaps.
For booking engine clients only: Beds24, STAAH, or Cloudbeds depending on the tool chosen, and the Midtrans, Xendit, or DOKU payment gateway. These tool and gateway accounts are in the Client's name.
For AI chatbot clients only: the AI model provider used by the project, namely OpenAI, Anthropic, or Google (Gemini).
Hostinger International Ltd. (global): hosting for the Client's Website and business email, on projects that use Hostinger.

Dewata Tech will notify the Controller in writing at least thirty (30) days before adding or replacing a Sub-Processor. The Controller may object in writing on reasonable data protection grounds. If the objection cannot be resolved, the Controller may terminate the affected service without penalty. Each Sub-Processor processes data under the data processing terms that provider publishes. For large providers such as Google, Meta, TikTok, and Microsoft, those terms are set by the provider and we cannot change them.

7. Data Subject Rights

Dewata Tech will assist the Controller in fulfilling Data Subject rights as set out in Articles 5 to 15 of UU PDP, including:

The right to information about the identity, lawful basis, purpose of the request and use of Personal Data, and the accountability of the requesting party.
Right of access: receiving a copy of the Personal Data being processed in a readable format.
Right to rectification: requesting correction or updating of inaccurate or incomplete Personal Data.
Right to erasure: requesting the deletion of Personal Data in accordance with UU PDP provisions.
Right to restriction of processing and the right to object to processing, including automated profiling.
Right to data portability: receiving Personal Data in a structured, commonly used, and machine-readable format.

If a Data Subject contacts Dewata Tech directly with a request relating to their rights, Dewata Tech will forward the request to the Controller within one (1) business day, unless the Controller's written instructions specify otherwise. Dewata Tech provides the data extracts and, where the platform in use offers them, the access logs the Controller needs to meet UU PDP deadlines, which for some requests are only 3x24 hours from receipt by the Controller, for example access (Article 32 paragraph 2) and ending processing (Article 40 paragraph 2).

8. Security Measures

Dewata Tech applies technical and organizational security measures appropriate to the level of risk and the scale of the service:

Encryption of data in transit with HTTPS (TLS 1.2 or later) for the website, API, and webhook traffic we manage.
Encryption of data at rest as provided by the hosting, database, and CMS providers the project uses.
Multi-factor authentication (MFA) is enforced on the admin accounts we manage: hosting panels, the CMS, databases, and code repositories. On accounts in the Client's name, such as Beds24, STAAH, Cloudbeds, or a payment gateway, we recommend it and help switch it on.
Access is limited to the people who work on the project, with permissions matched to the work. Access logs are available where the platform in use provides them; not every platform records each access to Personal Data.
Backups exist only where the service the Client takes includes them, with the schedule written in the contract: daily on Care Standard, weekly on Care Lite, and booking engine configuration backups while Jaga or management runs. Without one of those services, we keep no backups beyond what the hosting or database provider supplies.
HTTP security headers, namely Content Security Policy, Strict-Transport-Security, X-Frame-Options, and X-Content-Type-Options, as standard on the Next.js websites we build. If one is missing, we add it at no charge when the Client asks.
Security updates follow the service in place: platform security updates through the website's annual fee, and library updates through the Care Plan. Server operating systems and runtimes are managed by the hosting provider.
Uptime monitoring and error alerts from the hosting provider. Logs are reviewed when an incident occurs or when the Controller asks.

9. Data Transfer and Storage

The primary storage locations for Personal Data are:

Hosting: usually Cloudflare (Workers or Pages) or Vercel, occasionally Hostinger, picked per project and named in the contract, with the region set per project.
Application database: Supabase, in the region set per project.
CMS content: Sanity, on United States or EU infrastructure.
Logging and analytics: Google Analytics, Microsoft Clarity, Meta, and TikTok store data on each provider's global infrastructure.

Because primary storage sits outside Indonesia, cross-border transfers of Personal Data follow Article 56 of UU PDP: the receiving country offers an equal or higher level of protection, or adequate and binding safeguards are in place, or the Data Subject consents. The safeguard we rely on is each provider's contractual data processing terms. A Client subject to GDPR may ask for the transfer basis, for example the Standard Contractual Clauses (SCCs) in a provider's terms, to be named in the contract attachment.

10. Term and Termination

This DPA takes effect on the signing of the master services agreement and remains in force for as long as Dewata Tech processes Personal Data on the Client's behalf. The DPA terminates automatically when the master services agreement ends, except for provisions that by their nature survive termination, such as confidentiality and audit rights.

On termination, Dewata Tech will provide a complete export of Client Personal Data in JSON, CSV, or SQL dump format on request, within fourteen (14) business days. Once the export is received and confirmed by the Client, Dewata Tech will delete all Personal Data from production systems within thirty (30) days, and from the backups we manage no later than the end of that backup's retention period, unless retention is required by Indonesian law. A written statement of deletion is supplied to the Client on request.

11. Liability and Audit Rights

The Client, as Controller, has the right to audit Dewata Tech's compliance with this DPA, subject to the following conditions:

Written notice at least fourteen (14) business days before the audit takes place.
Audits are carried out on business days, outside critical operational windows, and must not disrupt service to other Clients.
Third-party auditors must be bound by confidentiality and must not be a direct competitor of Dewata Tech.
Audit frequency is limited to a maximum of one audit per year, except following a data breach incident.
The audit scope is limited to compliance with this DPA and UU PDP / GDPR, and may not exceed those needs.

As an alternative to an on-site audit, Dewata Tech can complete the Client's compliance questionnaire with supporting documents. Dewata Tech does not yet hold a third-party security audit report. Each party's liability for breaches of this DPA follows the liability provisions of the master services agreement, while remaining within the limits and exceptions provided by UU PDP and the applicable provisions of GDPR.

12. Data Protection Contact

Dewata Tech has not appointed a separate data protection officer. Questions, requests, or notices relating to this DPA and the processing of Personal Data are handled directly by Dewata Tech's founders through this data protection contact:

Company name: PT Dewata Artificial Intelligence (Dewata Tech)
Data protection contact email: weida.dewatatech@gmail.com
Phone and WhatsApp: +62 851-7975-5016
Office address: Jl. Sakura Gg. I No.3, Dangin Puri Kangin, Denpasar Utara, Bali 80233, Indonesia
Response hours: Monday to Saturday, 09:00 to 18:00 WITA (Central Indonesia Time)

For data breach incidents or urgent requests relating to Data Subject rights, send a WhatsApp message prefixed "DATA PRIBADI MENDESAK" (urgent personal data). Outside business hours, urgent requests get a response by the next business day at the latest. A data breach affecting Client data is reported to the Client within 24 hours of us becoming aware of it, in line with Section 5.