Privacy Policy

Last modified on: 10 October 2026

INTRODUCTION

We appreciate your use of the Human Resources Information System (HRIS) operated by PT ENDO INDONESIA. This Privacy Policy is designed for PT ENDO INDONESIA employees and outlines our dedication to safeguarding your Personal Data in compliance with relevant laws and regulations. We are committed to maintaining the confidentiality and integrity of your Personal Data and take responsibility for its proper management. This Privacy Policy covers all employees of PT ENDO INDONESIA who utilize our HRIS platform, including websites, mobile apps, and other services administered by the Company.

Our platform offers a range of services to support your work in areas such as Human Resources, payroll management, attendance monitoring, performance assessment, employee administration, and potentially other functions in the future. These services include, but are not limited to, the HRIS Employee Portal, HRIS Payroll, HRIS Attendance, HRIS Performance, HRIS Leave Management, and any additional services that may be introduced by us going forward (collectively referred to as "Services").

ABOUT PRIVACY POLICY

We are committed to providing clear and transparent information about how and why we process your Personal Data. This Privacy Policy describes our obligations and practices regarding the handling of your Personal Data.

It is important to note that, in collecting and processing your Personal Data under this Privacy Policy, we may act on behalf of and at the direction of our clients, who are the controllers of your Personal Data, as specified in our agreement with them. In such cases, before using our Services or submitting your Personal Data, you should ensure you have given full consent to the client for processing your Personal Data through us.

By using our Services and providing consent to both the client and us as the service provider, you acknowledge and agree to the terms of this Privacy Policy. We encourage you to read this Privacy Policy carefully to understand how we manage your Personal Data and our approach to data protection.

This Privacy Policy explains in detail how we process your Personal Data, including what information we collect, the reasons for processing it, and the parties with whom it may be shared. It also describes our data handling practices to help you have a positive experience when using our services, and informs you about your rights and choices regarding your Personal Data, as well as the measures we take to protect it.

We hope this Privacy Policy clarifies our commitment to protecting your Personal Data. If you need further information or have questions, please refer to the "Contact" section of this Privacy Policy. If you do not agree with the terms outlined here, you may choose not to use our Services.

This Privacy Policy is designed to be easy to read and navigate. You can refer to specific sections as needed. For clarity, all capitalized terms in this Privacy Policy have the same meaning as defined in the applicable HRIS Platform Terms of Use between you and us.

DEFINITIONS

"Personal Data" refers to information about specific individuals who can be identified, either directly or indirectly, on their own or in combination with other data.

"Information" refers to descriptions, statements, concepts, or symbols that carry meaning, value, or messages, including data, facts, and details that can be observed, heard, or read, and are presented in various formats or media, whether electronic or non-electronic, in line with technological developments.

SCOPE AND TYPE OF PERSONAL DATA WE COLLECT

Below are the categories and types of Personal Data about You that We may process in connection with Your use of the Service (as applicable, depending on the context, circumstances of collection, and the nature of the Service or transactions involved):

1. User Identity Data: such as name, username, gender, full address, place and date of birth, highest education, occupation, and other related details.
2. User Business Data: such as business identification number, phone number, full business address, and similar information.
3. User Contact Data: such as billing address, email address, mobile number, contact list, emergency contact details, and other relevant information.
4. Location: We collect Your location data exclusively from GPS when You use Our Services. Your location is determined using GPS sensor data from Your device.
5. Log Activity: includes server records such as access date and time, features or pages accessed, application processes, system activities, and/or third-party sites or services used prior to interacting with Our Services.
6. User Device: includes information about the device You use to access the Services, such as hardware model, operating system and version, software, file names and versions, language preferences, unique device identifiers, advertising identifiers, serial numbers, device movement data, and/or mobile network information.

PROVISION OF INCOMPLETE PERSONAL DATA

If We are required by law or by the terms of a contract with the client to collect Personal Data, and You choose not to provide it or provide incomplete Personal Data when requested, We may be unable to deliver the Services or fulfill the agreement with You, including any ongoing arrangements.

HOW WE COLLECT YOUR PERSONAL DATA

Your Personal Data is obtained through several methods, including:

1. submission by the client acting as the controller of Your Personal Data;
2. direct input from You when registering or using the Service;
3. automatic collection via the Platform, and device You utilize.

The Information we gather may include unique identifiers, device type and settings, operating system, mobile network details, and application version. We also collect data such as crash reports, system activity, timestamps, and the referring URL of Your request.

This Information is collected when Your device interacts with Our servers—for instance, during app installation from the Google Play Store or when checking for automatic updates. If You use an Android device with the ENDO HRIS Platform, Your device will periodically connect to the ENDO HRIS server to share details about Your device and its connection to Our Services, such as device type, carrier information, and crash reports.

If You are not signed in to a HRIS account, the Information We collect is stored using a unique identifier linked to Your current application, or device. If You are signed in, We also collect Information that is stored in Your HRIS account, which is treated as personal Information.

USE OF YOUR PERSONAL DATA

We use Your Personal Data primarily to deliver, maintain, and improve Our Services, and to comply with legal requirements. The most critical purposes for processing Your Personal Data include:

1. Ensuring the security and reliability of Our Services, including detecting, preventing, and responding to fraud, abuse, security risks, criminal activity, or misuse of Our Services, and protecting Our IT systems and networks.
2. Complying with legal obligations, such as responding to requests or directives from authorities and fulfilling regulatory requirements.
3. Registering You as a user, managing Your account, and facilitating Your access to Our Platform.
4. Providing Our Services and products, including enabling features such as attendance recording using face data.
5. Notifying You about important updates, changes, or activities related to Our Platform or connected systems.
6. Interacting directly with You to address inquiries, complaints, or operational issues.
7. Monitoring and analyzing Your activities and usage patterns to personalize and enhance Your experience.
8. Developing, maintaining, and improving Our Services, including troubleshooting, customization, and introducing new features.
9. Generating statistical and analytical data for research, product development, and service improvement.
10. Fulfilling purposes determined by the client (as the controller of Your Personal Data) according to Our agreement with them.
11. Detecting and investigating prohibited, illegal, unauthorized, or fraudulent activities as required by law.
12. Any other purposes that We inform You about, or for which We obtain Your consent if required by law.

We use automated systems and various technologies to process Your Personal Data, including analyzing content to provide personalized features and to detect abuse such as spam or malware. We may combine Information collected across Your devices to improve Our Services. Depending on Your account settings, Your activity on other sites and applications may be associated with Your Personal Data.

You may withdraw Your consent for processing Your Personal Data at any time by contacting the client (as the controller) or following the "Contact" procedure described in this Privacy Policy.

DISCLOSURE OF PERSONAL DATA TO OTHER PARTIES

We do not share, disclose, provide access, or distribute Your Personal Data to any third party. Your Personal Data is kept strictly confidential and is not provided to anyone outside PT ENDO INDONESIA.

We do not share, provide access, or disclose Your Personal Data to any third party except as required by law or regulation. If there is a legal obligation to disclose Your Personal Data, we will do so in accordance with applicable laws and only to the extent necessary. We do not provide Your Personal Data to any third party for marketing or other unrelated purposes.

We will not sell or rent Your Personal Data to any party.

YOUR RIGHTS

As a user of Our Platform, you are entitled to exercise certain rights regarding your Personal Data, including:

• Requesting corrections or updates to inaccurate Personal Data stored in the Platform.
• Obtaining a copy of your Personal Data held within the ENDO HRIS system, subject to applicable laws.

If you choose to withdraw your consent, please be aware that this may affect your ability to access or use our Services. Account termination or the end of your contractual relationship may occur, and all obligations and rights up to that point will remain in effect. We will notify you of any implications resulting from your withdrawal request so you can make an informed decision.

We reserve the right to decline requests that do not pertain to Personal Data stored in the ENDO HRIS, such as requests made by individuals who lack proper authority or legal proof, or if restricted by regulatory requirements or our internal privacy policies.

How to Submit a Request to Exercise Your Rights

To help us process your request efficiently, please provide detailed information about your reasons and include identification details to verify your identity. This may include your full name, address, phone number, a copy of your identity document, and the specific reason for your request.

All requests should be sent to our official email address: IT@endo.id. Requests submitted through other channels or lacking required information may result in delays, may not be processed, or may not receive a response within the expected timeframe.

YOUR PERSONAL DATA SECURITY

We continually strive to enhance the security of your Personal Data by utilizing up-to-date technology and adhering to relevant regulations, aiming to meet stakeholder expectations and ensure ongoing quality improvements. Safeguarding your Personal Data is a top priority, and we apply the highest standards to protect it.

While we make every effort to secure your Personal Data, we cannot guarantee the complete integrity or accuracy of data transmitted over the internet, as online communication is not entirely secure. You are responsible for keeping your account credentials, including your password and One Time Password (OTP), confidential, and for maintaining the security of your device.

By using our services, you agree to release, indemnify, and defend ENDO HRIS from any losses, risks, or consequences arising directly or indirectly from Personal Data that is intercepted, accessed, stolen, disclosed, altered, or destroyed by unauthorized third parties, due to circumstances beyond our control or in violation of this Privacy Policy and applicable laws, including those resulting from your own actions or negligence.

CONTACT