Privacy Policy
Last updated: 11 November 2026
This page is also available in Bahasa Indonesia. If the two versions differ, the Bahasa Indonesia version prevails.
1. Who we are
HiTalenta is an HR and payroll platform for Indonesian companies, from clock-in on your team's phones to a bank-ready payroll file. It is developed by PT Generasi Anak Muda Berkarya ("HiTalenta", "we").
HiTalenta has two parts: a web dashboard where a company's Admin, HR, Finance and managers work, and a mobile app where employees clock in, request leave, overtime and reimbursements, and see their payslips. This policy explains how we handle personal data under Law No. 27 of 2022 on Personal Data Protection (UU PDP).
2. Our role
- Data about employees and job applicants is entered by the company that uses HiTalenta ("the Client"). The Client is the data controller: it decides why and how that data is used. HiTalenta is the data processor and handles it only on the Client's instructions, under our subscription agreement.
- Data we decide on ourselves — the contact details of the Client's administrators, people who contact our sales or support team or our official partners, and visitors to our website — HiTalenta is the data controller.
If you are an employee or applicant, your employer's own privacy notice also applies. Contact your employer first about your data; we will help them answer you.
3. Personal data we process
| Category | Examples | Provided by |
|---|---|---|
| Account | Name, work email, phone, role, password (stored as a hash), authenticator setup, the phone the account is registered to | Client, user |
| Employment | Employee ID, job title, department, manager, start and end dates, contract | Client |
| Identity and tax | NIK, NPWP, PTKP status and number of dependants, date of birth, documents such as ID card | Client |
| Pay | Salary, allowances, overtime, absence deductions, bank account, BPJS numbers, PPh 21 withheld, payslips | Client |
| Attendance | Clock-in and clock-out times, location at clock-in, a selfie when the work schedule asks for one, the reason, photo and distance of a clock-in outside the work area, attempts with a fake location | Employee via the app |
| Requests | Leave, sick leave with a doctor's note, overtime, reimbursement claims with attachments | Employee, Client |
| Recruitment | CV, contact details, education, work history, current salary, answers to the job's application form | Applicant via the public apply page |
| Payslip email | The personal email an employee enters to send their payslip to themselves | Employee |
| Technical | IP address, browser and device type, sign-in and audit logs | Automatically |
| Support | Messages, screenshots and contact details you send us | You |
Some of this is specific personal data under UU PDP, such as financial data, health information in doctor's notes and data about employees' children. We protect it with the measures in section 8.
4. Why we use it and our legal basis
- To provide the service the Client subscribed to: attendance, leave, payroll, reimbursement, recruitment and approvals (performance of a contract).
- To meet legal obligations, such as calculating PPh 21 and BPJS contributions and keeping records the law requires (legal obligation).
- To keep the service secure: preventing fraud such as one employee clocking in for another, detecting misuse and investigating incidents (legitimate interest).
- To support and inform you: answering questions and sending service emails such as invitations, password resets and payslips (contract or legitimate interest).
- With consent where the law requires it. You can withdraw consent at any time; this does not affect processing already done.
We do not sell personal data, use it for advertising, or make decisions with legal effect about anyone by automated means alone. Payroll figures are calculated automatically and are always reviewed and approved by the Client.
6. Where data is stored
Our servers and files are in a data centre in Jakarta, Indonesia. Some providers, such as network security services, may handle data in transit outside Indonesia. When that happens we make sure the protection meets UU PDP requirements for transfers outside Indonesia.
7. How long we keep it
- Client data is kept while the subscription is active. After it ends, the Client can export its data for 30 days; then we delete it and confirm in writing.
- Attendance selfies are deleted automatically after 90 days.
- Records the law requires us or the Client to keep, such as tax and payroll records, are kept for the period the law sets.
- Our own data (accounts, support) is kept while needed for the purposes above, then deleted or anonymised.
8. How we protect it
- Encryption in transit (TLS) and at rest; NIK, NPWP and bank account numbers are additionally encrypted field by field.
- Each Client's data is separated from every other Client's at the database level.
- Role-based access, so each user sees only what their role allows; HR does not see salaries.
- Sign-in with an authenticator app for Admin, HR and Finance, and one phone per employee account.
- Audit logs for sensitive actions such as payroll approvals and access changes; fake-location clock-in attempts are rejected and logged.
If a personal data breach happens, we inform the Client within 24 hours so it can meet its obligations. For data we control, we notify the people affected and the authority within 3 x 24 hours, as UU PDP requires.
9. Your rights
Under UU PDP you can ask to:
- be told how your data is used, and get access to or a copy of it;
- correct data that is wrong or incomplete;
- delete it, or stop or limit its processing;
- withdraw consent you gave;
- object to decisions made solely by automated processing;
- receive your data in a common format, or have it sent to another provider;
- claim compensation if your rights are breached.
For employee and applicant data, send your request to your employer (the controller). For data we control, email [email protected]. We answer within the time UU PDP sets, generally 3 x 24 hours, and may need to verify who you are first.
11. Children
HiTalenta is for employees and job applicants aged 18 or over. Information about employees' children, such as for tax status, is entered by the Client and protected as specific personal data.
12. Changes to this policy
We will post any change here with a new date. If the change is significant, we will tell Clients by email or in the dashboard before it takes effect.
13. Contact
PT Generasi Anak Muda Berkarya. Email: [email protected]. You can also complain to the authority responsible for personal data protection in Indonesia.