1. Who we are and what this policy covers
Moradesk is operated by PT Moradesk Digital Indonesia, an Indonesian single-person limited liability company based in Batam. This policy covers personal data processed through Moradesk websites, accounts, software products, and related communications.
This is an umbrella policy for our products and company activities, covering more than MoraRetail. If a product or project involves different processing, additional information and relevant terms need to be provided for that service. Mentioning a service does not mean it is currently available.
2. Moradesk and customer company responsibilities
For accounts, business relationships, and direct communications, Moradesk determines the purposes of the relevant processing. For data entered into products by customer companies, those companies may determine processing purposes and instructions while Moradesk provides the system used.
Customers are responsible for authority to provide other people's data, appropriate notices, and staff access. Requests involving customer-managed data need to be coordinated with that company's administrator. A shared account does not make one company's or product's data available to other companies.
3. Data categories and sources
The data involved depends on the page, product, feature, and information you provide. Not every user is asked for every category below.
- Account and company data: names, email addresses, account identifiers, company names, memberships, roles, verification status, invitations, and product access records.
- Product data: business information, contacts, and transaction records entered by users through the relevant features. In some products, these records may include customer or supplier names and contact details.
- Communications: contact details and the questions, attachments, or correspondence you send through email or company contact channels.
- Technical and security data: session information, IP addresses, and request or activity records processed by systems or operational providers to run and secure services. Logging details depend on the system used.
- Access and payment data: trial or subscription status, access periods, and transaction references and statuses where payment features are used. Simulated payments are distinguished from real payments.
- Sources may include you, the company administrator granting access, usage activity, and providers supporting the relevant features. Do not provide unnecessary personal data.
4. Purposes of use
We use relevant data to provide the accounts and features you use, verify account identity, manage membership and permissions, store product records, respond to questions, address faults and misuse, and manage business relationships and applicable obligations.
Data from one product is not blanket permission for unrelated uses. Planned products or services do not automatically expand the purposes for data you have already provided. Additional information is needed when data use changes materially.
5. Processing grounds and your choices
Processing grounds need to fit the purpose and context, such as performing an agreement or your request, legal obligations, legitimate interests taking your rights into account, or consent where required. Visiting a website does not by itself constitute consent to every form of processing.
If a feature requires particular information and you do not provide it, that feature may not work. Consent for optional activities needs to be distinguishable from core account and service requirements.
6. Recipients and service providers
Moradesk systems use providers for functions such as hosting, databases, authentication, and email delivery. If you use a payment feature, its payment provider also processes the information required for that flow. We do not sell personal data.
Company members can access data according to the permissions granted by their company. Disclosure may also be necessary to address lawful legal requests or disputes. Not every provider receives all of your data; each function needs different information.
WhatsApp and other third-party links take you to services with their own privacy policies. Avoid sending passwords, verification codes, or unnecessary customer data through support channels.
7. Processing locations and international transfers
Processing locations depend on the infrastructure and providers used. We have not established a claim that all data is stored only in Indonesia. Processing countries, recipients, and international transfer arrangements still need confirmation before this draft is adopted as a final policy.
9. Retention and deletion
Retention needs must be assessed against collection purposes, account or project relationships, customer instructions, security, disputes, and applicable recordkeeping obligations. Category-specific retention schedules, deletion procedures, and treatment of backup copies have not yet been established as operational commitments in this draft.
Stopping use or reaching the end of a trial should not be assumed to delete all data immediately. Deletion requests need to be reviewed against the requester's authority and continuing retention requirements. This draft does not promise automatic deletion within a specified number of days.
10. Your rights and privacy requests
Depending on the circumstances and applicable law, you may request information or access, correction, cessation or restriction of processing, deletion, withdrawal of consent, and data portability, and raise objections or complaints. Some rights have conditions or exceptions.
Send requests to support@moradesk.com with the subject “Privacy request”. Describe your relationship with Moradesk, the relevant product or company, and your request. Proportionate verification of identity and authority may be required. Do not send full identity documents unless requested through an appropriate process.
If your request concerns data managed by a customer company, coordination with its authorised administrator is needed. Request-handling procedures and responsibilities still need confirmation before the final policy is adopted.
11. Security and incident reports
The application uses authentication, permission restrictions, and company access checks for relevant features. Safeguards need ongoing maintenance and review; no system can be guaranteed free of every risk.
If you suspect account misuse or unauthorised data exposure, contact support@moradesk.com. Describe what happened and when without sending credentials. Incident handling and required notifications need to follow applicable law and the facts of the incident.
12. Children and sensitive data
Our services are developed for business use. Do not upload children's data or personal data requiring special protection unless the feature, need, authority, and arrangements are appropriate. Contact us if you believe such data has been provided improperly so the situation can be reviewed.
13. Policy updates
The policy version and date need to be stated when it is adopted. Material changes to purposes, data categories, recipients, or user choices need appropriate notice and, where required, additional consent or arrangements. This draft does not establish an effective date for the final policy.
14. Contact us
PT Moradesk Digital Indonesia
Taman Sari Hijau, Blok C2 No. 10, Kelurahan Tiban Baru, Kecamatan Sekupang, Kota Batam, Indonesia
Support and privacy requests: support@moradesk.com. Company information: marketing@moradesk.com. Service hours: Monday–Friday, 07:00–17:00 WIB (UTC+7).