Pakem
ENID

Pakem Privacy Policy

Last updated: 30 October 2026

1. Who we are

Pakem is operated by Muhammad Zaid Taufiq Yasyaf, an individual, Indonesia ("Pakem", "we", "us"). Privacy contact: privacy@uncle-z.com. We have not appointed a Data Protection Officer.

2. Our two roles

  • Business customers (cafés, restaurants, chains that subscribe to Pakem) decide why and how the data of their staff, and of guests who leave feedback at their stores, is used. For that data they are the controller. Pakem processes it on their instructions as a processor, under a Data Processing Agreement ("DPA").
  • Account data of business admins, website visitors and people who contact us: Pakem is the controller.

3. Personal data we process

Category Examples Notes
Account and contact Name, work email, phone, role, store, login data Admins and staff
Billing Billing name, billing email and billing address as sent by Polar; country; tax ID if given; plan, store count, billing period; invoices and payment status Business admins. Card and bank details are entered on Polar's checkout and held by Polar. Pakem does not store them.
Shifts and time off Shift schedules, shift swaps, time-off requests and decisions
Work records Workflow step records (checklist answers, signatures, temperature and other readings, timers, approvals), food-safety and cleaning logs, training course results and expiry dates, bonus and streak records
Team notes Kudos between colleagues, shift handover notes, announcement and briefing read receipts Private to the business
Guest feedback Star rating, NPS score, comment and optional contact details that a guest leaves through a store's feedback QR code The business is the controller
Demo request Name, work email, business name, phone if given, your language, your consent, the page you sent it from, and the ad click ID (gclid) and utm_* campaign tags if you arrived from an ad Website visitors who fill in the demo form
Device and technical Device type and identifier, app version, IP address, logs

4. Why we use it and our legal basis (UU PDP Art. 20)

  • Running the service for a business: contract with the business, and the business's lawful basis for its staff and guest records.
  • Security, fraud prevention, legal obligations and handling of complaints.
  • Product analytics in aggregate, without identifying individuals.
  • Answering demo requests: your consent, given on the demo form. You can withdraw it at any time (section 9).
  • Measuring which ads and campaigns bring demo requests (the ad click ID and campaign tags sent with a request): our legitimate interest in measuring our own marketing.

5. Who we share it with

We do not sell personal data. We share it only with:

  • Processors that run the service: hosting in Kuala Lumpur, Malaysia (self-managed servers); email delivery (our own mail server, mail.uncle-z.com); web analytics (Umami, self-hosted, cookie-free).
  • Polar Software, Inc., as merchant of record: when a business buys a paid plan, Polar sells the plan, collects the payment and any applicable tax, and issues the invoice. Polar receives the buyer's name, email, billing address and payment details directly. Polar processes that data under its own privacy policy, https://polar.sh/legal/privacy-policy, as an independent controller. We do not sell it. Pakem does not receive or store card or bank details.
  • The business you work for, or whose store you gave feedback to, for the data in its workspace.
  • Authorities, when the law requires it.

6. Transfers outside Indonesia

Our servers, our mail server and our analytics run in Kuala Lumpur, Malaysia. Polar Software, Inc. is based in the United States, so billing data that Polar receives is transferred to and stored in the United States, as Polar's privacy policy describes. Buyers give this data to Polar directly at checkout. Under UU PDP Art. 56, transfers outside Indonesia need adequate protection or an equivalent safeguard. Polar's privacy policy sets out the safeguards it applies to that data.

7. How long we keep it

  • We keep personal data while the business's subscription, or your account, is active.
  • Billing records (subscription and invoice records, and the Polar payment events we keep with them): kept for 10 years from the transaction, because Indonesian tax law requires bookkeeping records to be kept for 10 years (UU KUP, Law 28/2007, Art. 28 para. 11). Then deleted. Polar keeps the records it needs as merchant of record under its own privacy policy.
  • When a subscription ends, the business can export its data. We then delete it or return it under the DPA, unless the law requires us to keep it.
  • Demo requests: kept while we follow up with you about Pakem, unless you become a customer. You can ask us to delete yours at any time (section 9), and we will.
  • You can ask us to delete your data at any time (section 9). Our team handles each request by hand and tells you when it is done.
  • Database backups are kept only on our own server, and only our administrator can read them. We keep the newest 20 automatic copies, and manual copies for 30 days. We keep no backups anywhere else. Data deleted on request may remain in a backup until that copy expires.

8. Security

  • Data is encrypted in transit (TLS).
  • Access is limited by role.
  • If a breach puts personal data at risk, we will notify the affected people and the authority within 3 × 24 hours of becoming aware of it (UU PDP Art. 46).

9. Your rights

You can ask us to:

  • access your personal data and get a copy (export);
  • correct it;
  • delete it;
  • object to or restrict processing, and to decisions made only by automated processing, where the law allows;
  • withdraw consent at any time. This does not affect processing done before the withdrawal;
  • receive your data in a structured, machine-readable format.

You can also complain to the data protection authority once it is in place.

How to ask: by email to privacy@uncle-z.com. We respond as the law requires. If you work for a business, or left feedback at its store, contact that business first, because it is the controller. We will pass your request to them and help them answer it.

10. Children

Pakem is for adult workers. Businesses must check the legal rules before they register staff under 18.

11. Website and cookies

The Pakem website uses Umami analytics, which is self-hosted and sets no cookies, and one first-party cookie, pakem_lang, that remembers your language choice. We do not use advertising or tracking cookies.

If you arrive from an ad, the page keeps the ad click ID and campaign tags from the link in your browser's local storage (not a cookie) so we can send them with your demo request if you submit one. When you send the demo form, we record that one demo request was made, with no name, email or other personal data in the analytics event. You can clear this value by clearing your browser's site data. If we start measuring ads with a Google tag, we will update this page first.

12. Changes

We will tell you about material changes in advance, before they take effect.

13. Law and language

This policy is governed by the laws of the Republic of Indonesia. The Indonesian version prevails.