Data Processing Addendum

In shortWhen you use autoDM, we process your subscribers’ Instagram data on your behalf. This addendum sets out what we will and will not do with that data: process it only on your instructions, keep it secure, tell you about breaches within 3 × 24 hours, help you answer subscriber requests, use only the sub-processors listed here, and delete the data when you leave. It is governed by Indonesia’s Personal Data Protection Law.

1. Background and scope

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between PT Kalachakra Wisnu Indonesia, trading as autoDM (“autoDM”, “we”), and the Customer (“you”). It applies whenever we process Subscriber Data on your behalf in providing the Service. It is intended to satisfy the requirements for a controller and processor arrangement under Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) and its implementing regulations. If you are also subject to another data protection law, this DPA is intended to be read consistently with it; tell us if you need additional terms.

If there is a conflict between this DPA and the Agreement about the processing of Subscriber Data, this DPA prevails.

2. Definitions

Controller, Processor, Personal Data, Data Subject, Processing, Personal Data Breach

Have the meanings given to the equivalent terms in the PDP Law (pengendali, prosesor, data pribadi, subjek data pribadi, pemrosesan, kegagalan pelindungan data pribadi).

Subscriber Data

Personal Data of Subscribers (Instagram users who interact with your Connected Instagram Account) that we process in order to run your Automations, as described in Annex 1.

Sub-processor

A third party engaged by us to process Subscriber Data on our behalf.

Instructions

Your documented instructions for processing Subscriber Data, consisting of the Agreement, this DPA, the configuration of your Account and Automations, and any further written instructions you give us.

3. Roles

For Subscriber Data, you are the Controller and we are the Processor. You confirm that you have a lawful basis for the collection and processing of Subscriber Data, including any consents or notices required under the PDP Law and Meta’s policies, and that your Instructions are lawful. We will inform you if we believe an Instruction infringes the PDP Law.

For data about you and your team (account, billing and usage data), we are an independent Controller and our Privacy Policy applies instead of this DPA.

4. Our obligations as Processor

We will:

1. Process on Instructions only. Process Subscriber Data only on your Instructions and for the purposes in Annex 1, unless required by applicable law (in which case we will tell you before processing, where the law allows).
2. Confidentiality. Ensure that staff and contractors with access to Subscriber Data are bound by confidentiality obligations and receive appropriate training, and limit access to those who need it.
3. Security. Implement and maintain the technical and organisational measures described in Annex 3, which are appropriate to the risks of the processing, and not materially reduce them during the term.
4. Sub-processors. Engage Sub-processors only in accordance with Section 6.
5. Data Subject requests. Promptly notify you if we receive a request from a Subscriber relating to their Personal Data, not respond on your behalf except as you instruct or as Meta’s policies require, and give you reasonable assistance (including through the export and deletion features in the Service) to respond within the time required by the PDP Law.
6. Assistance. Provide reasonable assistance, taking into account the nature of the processing and the information available to us, with your obligations relating to security, breach notification, data protection impact assessments and consultations with the authority.
7. Records. Keep a record of the processing we carry out on your behalf and make it available to you on request.
8. Deletion. Delete or return Subscriber Data in accordance with Section 9.
9. Information. Make available the information reasonably necessary to demonstrate our compliance with this DPA and allow audits as set out in Section 8.

5. Personal Data Breach

If we become aware of a Personal Data Breach affecting Subscriber Data we will notify you without undue delay and in any case within 3 × 24 hours, as required by Article 46 of the PDP Law, by email to your Account address. Our notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Subscribers and records affected, the likely consequences, and the measures taken or proposed to address it and mitigate its effects. We will provide further information as it becomes available and cooperate reasonably with your own notifications to Subscribers and the authority. Our notification is not an acknowledgement of fault or liability.

6. Sub-processors

6.1 Authorisation

You give us general authorisation to engage the Sub-processors listed in Annex 2 (and on our Service Providers page, which we keep current). We will enter into a written contract with each Sub-processor imposing data protection obligations no less protective than those in this DPA, and we remain responsible for their performance.

6.2 Changes

We will give you at least 14 days’ notice by email or in the Service before adding or replacing a Sub-processor. You may object on reasonable data protection grounds within that period. If you object we will discuss the concern in good faith; if we cannot resolve it, you may terminate the Agreement for the affected part of the Service without penalty, and we will refund any prepaid fees for the period after termination.

7. International transfers

We store Subscriber Data in Indonesia. The Sub-processors in Annex 2 that process data outside Indonesia (Meta, for Instagram API operations; Anthropic, for AI-enabled Plans only) do so under written agreements that require appropriate safeguards, in accordance with Article 56 of the PDP Law. We will not otherwise transfer Subscriber Data outside Indonesia without taking such safeguards and informing you.

8. Audits

On written request not more than once per year (or more often following a Personal Data Breach or where an authority requires it), we will make available the information reasonably needed to demonstrate compliance with this DPA, including summaries of our security measures and the current certifications of our hosting provider. If that information is not reasonably sufficient, you may conduct, or appoint an independent auditor bound by confidentiality to conduct, an audit of our relevant systems and procedures, at your cost, during business hours, on at least 30 days’ notice, and in a way that does not unreasonably interfere with our operations or compromise other Customers’ data. We may require a reasonable fee for audits exceeding two business days.

9. Deletion and return

You can export and delete Subscriber Data at any time using the features in the Service. When your Account is closed, or on your written request, we will delete all Subscriber Data within 30 days and purge it from backups within 90 days, unless the law requires us to retain it. Subscriber Data obtained from Instagram is also deleted promptly when you disconnect the relevant Instagram account or when Meta sends us a deletion request for a Subscriber. On request we will confirm deletion in writing.

10. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement. Nothing in this DPA limits any liability that cannot be limited under the PDP Law.

11. Term and changes

This DPA is effective for as long as we process Subscriber Data on your behalf and until all Subscriber Data has been deleted under Section 9. We may update this DPA to reflect changes in law or the Service by giving at least 14 days’ notice; changes will not materially reduce our obligations to you without your agreement.

12. Governing law

This DPA is governed by the laws of the Republic of Indonesia and the dispute resolution provisions of the Agreement apply.

Annex 1: Details of processing

Annex 2: Authorised Sub-processors

The current list is maintained at autodm.kalachakra.io/legal/service-providers.

Annex 3: Technical and organisational measures

• Access control. Role-based access; least-privilege principle; multi-factor authentication for staff access to production systems; access reviewed when roles change and removed promptly on departure.
• Encryption. TLS 1.2 or higher for all data in transit; encryption at rest for databases and backups; Instagram access tokens stored encrypted; passwords hashed with a modern algorithm.
• Infrastructure. Hosting in IdCloudHost data centres in Jakarta certified to ISO/IEC 27001; network segmentation and firewalls; environment separation between production and development.
• Logging and monitoring. Centralised application, access and security logs retained for 12 months; availability monitoring; alerting for anomalous activity.
• Resilience. Automated daily backups retained for up to 90 days; documented restore procedure tested periodically.
• Secure development. Code review before deployment; dependency vulnerability scanning; secrets kept outside source code; patching of known vulnerabilities within a risk-based timeframe.
• Vendor management. Sub-processors assessed before engagement and bound by written data protection terms.
• People. Confidentiality obligations in employment and contractor agreements; data protection training at onboarding and periodically.
• Incident response. Documented procedure for detecting, assessing, containing and notifying Personal Data Breaches within the timeframes in Section 5.
• Platform compliance. Meta Business Verification completed; handling of Meta data deletion requests automated.