Skip to content
Kontrakly

Privacy policy

Effective date: 22 October 2026 · Version 1.0

In short. For the documents and other content your organisation stores in Kontrakly, your organisation is the Personal Data Controller and we are its Personal Data Processor: we process that content only on its instructions. For accounts, billing, support and our website, we are the Controller. Workspace data is stored in Indonesia (Tencent Cloud, Jakarta region). When you use the AI Assistant, the relevant text is sent to our AI provider, which may process it outside Indonesia; it is never used to train AI models. You have the rights set out in Law No. 27 of 2022 on Personal Data Protection, and you can reach our Data Protection Officer at [DPO name and email — default privacy@kontrakly.id].

1. Introduction and scope

1.1 This Privacy Policy explains how [Registered legal entity name, e.g. PT ...] ("Kontrakly", "we", "us" or "our"), a company established under the laws of the Republic of Indonesia with its registered address at [Registered address] and business identification number (NIB) [NIB number], processes Personal Data when you visit our website, request a demonstration, use the Kontrakly web application or mobile application, or otherwise interact with us.

1.2 We process Personal Data in accordance with Law No. 27 of 2022 on Personal Data Protection ("UU PDP"), Law No. 11 of 2008 on Electronic Information and Transactions as last amended by Law No. 1 of 2024 ("UU ITE"), Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions ("PP 71/2019") and their implementing regulations.

1.3 This Privacy Policy forms part of, and should be read together with, our Terms of Service and any data processing agreement concluded with our customers. If there is a conflict between this Privacy Policy and a signed data processing agreement regarding Customer Content, the data processing agreement prevails.

2. Definitions

Capitalised terms not defined here have the meaning given in our Terms of Service.

  • Personal Data: any data about an identified or identifiable natural person, whether on its own or combined with other information, directly or indirectly, through electronic or non-electronic systems, as defined in the UU PDP.
  • Specific Personal Data: the categories of Personal Data listed in Article 4(2) of the UU PDP, including health data, biometric data, genetic data, criminal records, children's data and personal financial data.
  • Personal Data Controller ("Controller"): a person or organisation that determines the purposes of, and exercises control over, the processing of Personal Data.
  • Personal Data Processor ("Processor"): a person or organisation that processes Personal Data on behalf of a Controller.
  • Data Subject: the natural person to whom Personal Data relates.
  • Customer: the company, law firm or other organisation that has entered into an agreement with us to use the Service.
  • Customer Content: all documents, templates, clauses, comments, metadata, workflow records and other data that a Customer or its Users upload to, create in or store in the Service.
  • User: an individual authorised by a Customer to access a Workspace, including members holding any of the Service's roles and external counsel invited by the Customer.
  • Workspace: the logically separated environment in the Service that belongs to a Customer.
  • AI Assistant: the feature of the Service that answers questions about, summarises and drafts documents based on the Customer Content that the requesting User is permitted to open.
  • Subprocessor: a third party engaged by us to process Personal Data on our behalf.
  • Service: the Kontrakly website, web application, mobile application, APIs and related support services.

3. Who we are and our role

3.1 Kontrakly as Processor. For Customer Content, including any Personal Data contained in documents, the Users' activity within a Workspace and the Workspace audit trail, the Customer is the Controller and Kontrakly acts as its Processor. We process this data only on the Customer's documented instructions (as set out in the Terms of Service, the data processing agreement and the Customer's configuration of the Service), and in line with Article 51 of the UU PDP. If you are a User or if your Personal Data appears in a document stored in a Workspace, please direct requests about that data to the relevant Customer first; we will assist the Customer in responding.

3.2 Kontrakly as Controller. For the Personal Data we collect for our own purposes, namely account administration, authentication, billing, customer support, security monitoring of the platform, our website, demonstration requests and marketing communications, Kontrakly is the Controller.

4. Personal Data we process

4.1 Data we process as Controller

  • Account data: name, work email address, job title, role, language preference, Workspace membership and authentication identifiers, received from you, from the Customer's administrator or from the Customer's identity provider through single sign-on (SSO) and SCIM provisioning.
  • Demo request data: name, work email address, company name, telephone number, team size and the message you send through our website.
  • Billing and contract data: the names, email addresses and telephone numbers of the Customer's billing and contract contacts, and tax identification details of the Customer (such as its NPWP) needed for invoicing.
  • Support and communication data: the content of messages you send to our support team and records of our correspondence with you.
  • Technical and security data: IP address, device and browser type, operating system, app version, time stamps, sign-in events and error records, used to operate and protect the Service.
  • Preference data: strictly necessary settings such as your session, selected language and display theme.

4.2 Data we process as Processor on behalf of Customers

  • Customer Content: documents, templates, clauses, comments and their metadata, which may contain Personal Data of the Customer's employees, counterparties, clients and other individuals. The Customer decides what it uploads; the Service is not designed for Specific Personal Data unless the Customer has its own lawful basis for storing it.
  • Workspace activity and audit data: records of views, edits, downloads, approvals, sharing, sign-ins and AI Assistant requests within the Workspace.
  • AI Assistant interactions: the questions Users ask, the passages of Customer Content retrieved to answer them, and the answers and drafts produced.
  • Electronic signature data: the names, email addresses and other identification details of signers that the Customer sends to its chosen electronic certification provider (PSrE).
  • Notification data: the email addresses and in-app or mobile push identifiers needed to deliver notifications that Users have enabled.

We process Personal Data as Controller only where one of the legal bases in Article 20(2) of the UU PDP applies:

  • To provide the Service and manage accounts (creating and authenticating accounts, provisioning Users, providing support, sending service notifications): performance of the agreement with the Customer, and our legitimate interests in operating the Service for the Customer's Users.
  • To respond to demonstration requests and sales enquiries: steps taken at your request before entering into an agreement, and your consent given when you submit the form.
  • To send product news and marketing communications: your explicit consent, which you may withdraw at any time using the unsubscribe link or by contacting us.
  • To invoice, collect payment and keep financial records: performance of the agreement and compliance with our legal obligations, including tax law.
  • To secure the Service, prevent fraud and misuse and investigate incidents: our legitimate interests in protecting the Service, our Customers and Users, and compliance with our obligations as an electronic system operator under the UU ITE and PP 71/2019.
  • To comply with the law and respond to lawful requests from authorities: compliance with legal obligations.
  • To improve the Service using aggregated or de-identified usage information: our legitimate interests. We do not use Customer Content for this purpose.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. We process Personal Data as Processor only for the purposes instructed by the Customer.

6. The AI Assistant

6.1 When a User asks the AI Assistant a question, the Service retrieves only the passages of Customer Content that this User is permitted to open, and sends the question and those passages to our AI provider, Anthropic, to generate an answer. Every answer cites the documents it relies on.

6.2 Customer Content and AI Assistant interactions are never used to train AI models, either by us or by our AI provider. Our AI provider processes the data solely to return the answer to us and retains it only for the limited period permitted by our agreement with it [AI provider retention period to be confirmed].

6.3 The AI Assistant does not make decisions with legal or similarly significant effects on any individual. It can only create drafts marked as AI-generated; it cannot approve, send or sign any document. Those actions are always taken by an authorised User.

7. Electronic signatures

When a Customer sends a document for electronic signature, the Service transmits the document and the signers' identification details to the certified electronic certification provider (Penyelenggara Sertifikasi Elektronik, "PSrE") chosen by the Customer. The PSrE verifies signers' identities and issues electronic certificates under its own obligations under the UU ITE and PP 71/2019, and processes identity verification data in accordance with its own privacy policy.

8. Cookies and similar technologies

8.1 We use only strictly necessary cookies and local storage, to keep you signed in, protect against cross-site request forgery, and remember your chosen language and display theme. These cannot be switched off without breaking the Service, and do not require consent.

8.2 We do not use advertising cookies or third-party tracking. If we introduce privacy-friendly analytics in the future, we will update this Privacy Policy and, where required, ask for your consent before setting any non-essential cookies.

9. Disclosure and Subprocessors

9.1 We do not sell Personal Data. We disclose Personal Data only to the following:

  • Subprocessors that help us provide the Service, under written agreements that require them to protect the data to a standard no lower than this Privacy Policy and to process it only on our instructions.
  • The Customer that controls the Workspace, including its administrators, who can see Users' activity in the Workspace audit trail.
  • Professional advisers, such as lawyers, auditors and tax consultants, under duties of confidentiality.
  • Authorities, when required by law, a court order or a lawful request from a competent government agency, limited to what is required.
  • A successor entity in the event of a merger, acquisition or transfer of all or part of our business, subject to the requirements of Article 48 of the UU PDP, including notice to affected Data Subjects.

9.2 Our current Subprocessors are:

  • Tencent Cloud — cloud hosting, databases, search and object storage (Tencent Cloud Object Storage). Location: Indonesia (ap-jakarta region).
  • Anthropic — AI processing for the AI Assistant. Location: outside Indonesia, including the United States.
  • [Email delivery provider] — delivery of transactional and notification emails. Location: [location to be confirmed].
  • Electronic certification providers (PSrE) chosen by each Customer — electronic signature and signer identity verification. Location: Indonesia.
  • [Any additional Subprocessors, for example mobile push notification services, to be confirmed.]

9.3 We will give Customers prior notice of any new Subprocessor as set out in the data processing agreement, so that they can object on reasonable data protection grounds.

10. Where data is stored and cross-border transfers

10.1 Customer Content, Workspace data and account data are stored in Tencent Cloud's Jakarta region (ap-jakarta), within the territory of the Republic of Indonesia.

10.2 Personal Data is transferred outside Indonesia only where necessary to provide the Service, in particular when a User uses the AI Assistant (to our AI provider) and, depending on its location, to our email delivery provider. In accordance with Article 56 of the UU PDP, before any such transfer we ensure that the recipient's country has a level of protection equal to or higher than the UU PDP or, where it does not, that adequate and binding safeguards are in place, such as contractual commitments on confidentiality, security, purpose limitation, the prohibition on training models and deletion. Where neither condition can be met, we will transfer the data only with the consent of the Data Subject or of the Customer as Controller.

10.3 Customers that do not wish any Customer Content to leave Indonesia may disable the AI Assistant for their Workspace.

11. Retention

We keep Personal Data only for as long as necessary for the purposes for which it was collected, or as required by law:

  • Customer Content and Workspace data: for the duration of the subscription. After the subscription ends, the Customer has 30 days to export its data; we then delete it from active systems within [30] days, and from backups within [90] days, unless the law requires us to keep it longer.
  • Workspace audit trail: for the period configured by the Customer, by default [seven (7) years], and in any case deleted with the rest of the Workspace at the end of the subscription unless the Customer has asked us to keep it.
  • Account data: for as long as the account is active, and for up to [12 months] after it is closed, for security and dispute purposes.
  • Demo request data: for 24 months after your last contact with us, unless you become a Customer contact.
  • Billing and contract records: for ten (10) years, as required by Indonesian company document and tax retention rules.
  • Technical and security logs: for up to [12 months].

When the retention period ends, we delete or destroy the Personal Data, or anonymise it so that it can no longer identify any individual, in accordance with Articles 43 and 44 of the UU PDP.

12. Security

12.1 We protect Personal Data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, logical separation of each Customer's Workspace, role-based access controls enforced on every request, single sign-on support, audit logging, restricted and logged staff access, and regular backups.

12.2 No electronic system is perfectly secure. You are responsible for keeping your credentials confidential and for notifying us promptly at [Support email — default support@kontrakly.id] if you suspect unauthorised access to your account.

13. Personal data breach notification

13.1 If a failure of Personal Data protection (kegagalan Pelindungan Data Pribadi) occurs in respect of data for which we are the Controller, we will notify the affected Data Subjects and the personal data protection agency in writing no later than 3 x 24 hours after we become aware of it, as required by Article 46 of the UU PDP. The notice will describe the Personal Data disclosed, when and how it was disclosed, and the measures taken to handle and recover from the failure. Where required, we will also notify the public.

13.2 If the failure affects Customer Content or other data we process as Processor, we will notify the affected Customer without undue delay, and in any case in time to allow the Customer to meet its own 3 x 24 hours notification obligation, and will give the Customer the information and assistance it reasonably needs.

14. Your rights

Subject to the conditions and exceptions in the UU PDP, you have the right to:

  • Information (Article 5): obtain information about our identity, the legal basis and purpose of processing, and our accountability.
  • Correction (Article 6): complete, update or correct errors and inaccuracies in your Personal Data.
  • Access (Article 7): access and obtain a copy of your Personal Data.
  • Erasure (Article 8): end the processing of, delete or destroy your Personal Data.
  • Withdrawal of consent (Article 9): withdraw consent you have given for processing, without affecting the lawfulness of processing before withdrawal.
  • Objection to automated decisions (Article 10): object to decisions based solely on automated processing, including profiling, that have legal consequences or a significant effect on you. We do not make such decisions.
  • Restriction (Article 11): delay or restrict processing in proportion to the purpose of processing.
  • Compensation (Article 12): sue for and receive compensation for violations of the processing of your Personal Data, in accordance with the law.
  • Portability (Article 13): obtain and use your Personal Data in a structured, commonly used and machine-readable format, and have it transmitted to another Controller where technically possible.

15. How to exercise your rights

15.1 Send your request to our Data Protection Officer at [DPO name and email — default privacy@kontrakly.id]. We may need to verify your identity before acting on the request.

15.2 We will respond within the time limits set by the UU PDP, which for most requests (including access, correction, withdrawal of consent and restriction) is 3 x 24 hours from receipt of a complete request. If we refuse a request, we will tell you why, as permitted by Articles 15 and 33 of the UU PDP.

15.3 If your request concerns Personal Data in a Customer's Workspace, we will refer it to the Customer as Controller and help the Customer respond.

16. Children

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect Personal Data of children as Controller. Customers that store children's data in Customer Content are responsible for meeting the specific requirements of Article 25 of the UU PDP.

17. Data Protection Officer

We have appointed a Data Protection Officer (Pejabat Pelindungan Data Pribadi) in accordance with Article 53 of the UU PDP: [DPO name and email — default privacy@kontrakly.id].

18. Electronic system operator registration

Kontrakly is registered as a private-scope electronic system operator (Penyelenggara Sistem Elektronik Lingkup Privat) with the Ministry responsible for communications and digital affairs under registration number [PSE registration number].

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will publish the updated version on this page with a new effective date and version number and, for material changes, notify Customers' administrators and affected Users by email or in the Service at least 30 days before the changes take effect, unless a shorter period is required by law.

20. Language

This Privacy Policy is made in Indonesian and English, in accordance with Law No. 24 of 2009 and Presidential Regulation No. 63 of 2019. If there is any inconsistency or difference in interpretation between the two versions, the Indonesian version prevails.

21. Contact and complaints

  • Data Protection Officer: [DPO name and email — default privacy@kontrakly.id]
  • Support: [Support email — default support@kontrakly.id]
  • Post: [Registered legal entity name, e.g. PT ...], [Registered address]

If you are not satisfied with our response, you may lodge a complaint with the personal data protection agency established under the UU PDP or, until that agency is operational, with the Ministry responsible for communications and digital affairs.