Privacy

How Arus handles personal data, and what you can ask for. Written against Indonesia's Personal Data Protection Law, UU 27/2022.

This notice describes what the software actually does today. It has not yet been reviewed by counsel, and the contractual terms between ACS Dashboard System and its clients sit alongside it rather than in it.

Who is responsible

ACS Dashboard System decides what is recorded here and why, and is the controller of it. Arus supplies and runs the software on their instruction, as their processor. If you work at an outlet, your employer's own agreement with ACS Dashboard System governs why your work is audited at all.

What is held about you

Your account: Your name, your email address, and a hashed password. Nobody, including Arus, can read your password back.
Your sessions: For each device you sign in from: its IP address, what browser it reported, and when it was last used. You can see this list and end any of them under your account.
Where you can act: Which outlets you reach and at what level of authority.
Your work: The audits you ran, the notes you wrote, the corrective actions assigned to you, and a record that you uploaded a given photo.
Photographs: Photographs are of waste bins and their contents, taken as evidence for an audit. They are not photographs of people, and location data is stripped from every image before it is stored.

Why it is held

To run the waste auditing service ACS Dashboard System has contracted to provide, and to hold evidence of how separation was performed at an outlet on a given day. Your account exists because your employer or ACS Dashboard System asked for it so you could do your job; it is not something you signed up to.

How long it is kept

Audit photographs: Destroyed 180 days after the inspection they belong to is closed. A photograph proving a corrective action was fixed is counted from the day that action closed instead. A scheduled job destroys them; it is not done by hand.
Change records: Twenty-four months. These record who changed a figure and when, and are what makes a disputed number answerable.
Audits and corrective actions: Kept as long as ACS Dashboard System needs them as evidence of service. If you leave, they stay — with you no longer named in them.
Your account: Until it is offboarded or erased. Sessions end when they expire or when you sign the device out.

Who else processes it

These companies run parts of the service on our behalf. Each of them processes data outside Indonesia, which is a cross-border transfer under Article 56.

Supabase: The database and the photograph store, hosted in Singapore.
Vercel: The application itself, and its server logs.
Google: Receives an audit photograph, and the checklist item it concerns, to produce the independent second opinion. It is not told who took the photograph or what the inspector decided.
Resend: Sends sign-in and password-reset emails. It sees your email address.

What you can ask for

A copy of it: Download everything held about you, as a file, from your account page. You do not need to ask anyone.
A correction: Change your own name on your account page. For your email address, ask an admin.
Erasure: Ask an admin. Your name and address are replaced and your access ends. The audits you ran are kept, because they are ACS Dashboard System’s evidence to its client, but they no longer name you.
To object, or to complain: Speak to ACS Dashboard System first. You may also complain to the Indonesian supervisory authority once it has been established.

If something goes wrong

If personal data here is exposed or lost, ACS Dashboard System will tell the people affected and the supervisory authority within 3×24 hours of becoming aware, as Article 46 requires.