Privacy Policy

This Privacy Policy (the "Policy") explains how PT Sepersepuluh Pajak Artificial Intelligence ("10Tax", "we", "us", or "our") collects, uses, stores, and protects personal information and data in connection with the 10Tax Tax AI Platform (the "Platform").

10Tax is the data controller for all personal information processed through the Platform.

10Tax recognizes the particular sensitivity of data processed in the context of tax services, including information that may be commercially confidential or subject to professional confidentiality obligations.

This Policy must be read together with our Terms and Conditions (Appendix A) and the privacy policy set out at https://www.10tax.ai/privacy.

We collect the following categories of information:

10Tax acknowledges that queries submitted to the Platform and the associated data may contain confidential and sensitive business information.

All user queries, inputs, and data are treated as strictly confidential. 10Tax will not disclose, share, or grant access to such data to any third party except: (a) where required by law or court order; (b) with the prior written consent of the Customer; or (c) to authorized processors operating under a binding confidentiality agreement.

USER QUERIES AND DATA ARE NOT USED TO TRAIN, FINE-TUNE, OR IMPROVE AI MODELS FOR OTHER CUSTOMERS OR THIRD PARTIES. Each Customer's data is logically segregated and used solely to provide the Platform service to that Customer.

10Tax does not access, review, or analyze the content of a Customer's queries except as strictly necessary to: (a) provide the Platform service; (b) investigate technical issues reported at the Customer's request; or (c) comply with valid legal process.

We process personal information and data for the following purposes:

10Tax implements comprehensive and appropriate technical and organizational measures for data protection, including:

By subscribing to and using the Platform, the Customer consents to the collection and processing of data as described in this Policy.

The Customer warrants that it has obtained all necessary consents from its Authorized Users and, where applicable, from data subjects whose information may be entered into the Platform.

The Customer may withdraw consent by terminating the subscription in accordance with the Terms and Conditions. Withdrawal of consent does not affect the lawfulness of processing prior to the withdrawal.

Subscription and billing information is retained for the duration of the subscription and for a period of five (5) years thereafter, as required for tax and accounting purposes.

Uploaded Documents (i.e., invoices and tax invoices) are retained by 10Tax for the duration of the Customer's active subscription. During the subscription period, the Customer may delete Uploaded Documents at any time using the deletion feature available within the Customer's Platform account; 10Tax will not proactively delete Uploaded Documents during an active subscription. Upon termination or expiry of the subscription, all Uploaded Documents will be permanently deleted within ninety (90) days from the date of such termination or expiry. Deletion is performed manually by 10Tax through 10Tax's internal interface, unless a retention obligation exists under applicable law.

Technical and security logs are retained for twelve (12) months from the date of creation.

Where 10Tax is required by law to retain data beyond the periods stated above, such data will be retained for the minimum period required and will remain subject to this Policy.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, 10Tax will notify the competent supervisory authority within seventy-two (72) hours of becoming aware of the breach.

10Tax will notify affected Customers without undue delay after becoming aware of a breach involving Customer data.

The breach notification will include: (a) the nature of the breach; (b) the categories and approximate number of affected data subjects; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach and mitigate its effects.

Customer data may be stored and processed both within and outside the territory of the Republic of Indonesia.

Where data is transferred to or processed in a jurisdiction outside the Republic of Indonesia, 10Tax will ensure that appropriate safeguards are in place, including but not limited to: (a) contractual clauses requiring the recipient to maintain equivalent data protection standards; (b) ensuring that the recipient jurisdiction provides an adequate level of data protection; or (c) obtaining the Customer's express consent.

10Tax will inform the Customer of international data transfers and the safeguards applied upon request.

10Tax has appointed a Data Protection Officer ("DPO") who may be contacted regarding any matters relating to data protection and privacy.

Contact details:

10Tax may engage third-party data processors to assist in providing the Platform service (e.g., cloud infrastructure providers, payment processors).

All third-party processors are bound by: (a) a written data processing agreement; (b) strict confidentiality obligations; (c) an obligation to implement appropriate technical and organizational security measures; and (d) a restriction on the use of data solely for the purpose of providing services to 10Tax.

10Tax remains responsible for the acts and omissions of its third-party processors to the extent required by applicable law.

A current list of third-party processors will be made available to Customers upon written request.

The Customer and its Authorized Users have the following rights with respect to personal data:

Requests to exercise these rights must be addressed to the Data Protection Officer. 10Tax will respond to valid requests within thirty (30) days.

If the Customer believes that 10Tax is not complying with this Policy or applicable data protection law, the Customer may lodge a complaint with: (a) 10Tax's Data Protection Officer in the first instance; and/or (b) the competent data protection supervisory authority.

10Tax may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Customers will be notified of material changes to this Policy at least thirty (30) days before such changes take effect, by email notification to the Customer's registered contact.

Continued use of the Platform after notice of changes constitutes acceptance of the revised Policy.

For questions or concerns regarding this Privacy Policy, please contact:

This Privacy Policy is drawn up in the Indonesian language. In the event this Privacy Policy is translated into another language, the Indonesian-language version will prevail in the event of any conflict or inconsistency between the Indonesian version and the translated version.