Privacy Policy

Scope and responsible entity

This policy covers alur-ten.com, product selection and customer contact. AlurTEN is a brand; the responsible legal entity must be identified on this page and in the agreement. Its identity, registered address and legal contact details remain to be completed before launch. The operator acts as controller to the extent it determines purposes for enquiries and its own account or subscription administration. For customer-entered business data it normally acts as processor on customer instructions; see the Data Processing Notice.

Information and sources

Information comes primarily from you, your authorised business administrator and necessary technical records. Browsing product descriptions does not give the website access to a product tenant’s business database.

• Service requests require the product, issue category, company, contact name, email, subject and description. WhatsApp is optional. Language, submission time, website source and acceptance for this request are also recorded.
• Email and WhatsApp contact includes the details and messages you send and necessary follow-up records. Remove unrelated personal information from attachments.
• Independent product registration and subscription screens must disclose their own account, verification, authority and order fields. Following a link does not register you or authorise access to business data.
• Servers or security components may process IP addresses, request times, paths, browser details and error records. Actual production log fields, recipients and retention require verification and disclosure.

Purposes and legal grounds

Using the website is not blanket consent. Each activity needs an identified purpose, lawful ground and proportionate scope.

• Enquiries and support: the specific service consent you confirm; where applicable, necessary pre-contractual steps you request or performance of a contract. A company representative’s information does not automatically fall within the individual-contract ground.
• Verification, orders and accounting: the relevant contractual relationship or legal obligation, with additional consent where required.
• Abuse prevention, troubleshooting and security: applicable legitimate interests following a necessity and rights-balancing assessment, or legal duties, not unlimited collection.
• Marketing requires an appropriate lawful ground and a clear opt-out. A support request, enquiry or acceptance of terms does not subscribe you to marketing or authorise cross-product profiling.

Cookies, browser storage and external links

The present website code review found no advertising tracking or third-party behavioural analytics scripts; this is not a permanent statement about future configurations. Any necessary security, session or preference storage must be described by name, purpose, duration and controls before use. Non-essential tracking requires prior notice and applicable consent; refusing it should not prevent basic browsing. Product, email and WhatsApp links lead to separate services; email links may open your own mail application.

Product and tenant isolation

Trade, Service, Project and HR have separate registration, sign-in and tenant management. One registration belongs to one product. Even when the same person uses the same email for several products, accounts, tenants and business data are not shared. Website enquiries concern the product you specify; a ticket does not authorise account linking, data merging or business access across products. Minimal contact information for support is not a shared product database.

Recipients and disclosures

Access is limited to personnel who need it, contractually constrained providers and authorities legally entitled to receive information. Personal data is not sold. Support access to business data requires appropriate authority, a limited purpose and an audit record; a matching email is not authority to access another tenant. Reorganisation or compulsory disclosure requires a verified basis, limited scope and legally required notices, not expanded purposes. Provider and location arrangements are described in the Data Processing Notice.

Locations and international processing

Production infrastructure is planned for Alibaba Cloud’s Indonesia region, with Alibaba Cloud email and SMS. Contracting entities and locations for delivery, messaging routes, backups and remote support still require confirmation. Server location alone does not mean all information remains in Indonesia. WhatsApp’s own terms and policy also apply when you select it. International transfers require prior review of applicable protection levels, binding safeguards or other lawful conditions; general consent in this policy is not a substitute.

Retention and deletion

Records are kept only as needed for enquiries, contracts, security or legal requirements, not indefinitely because they may be useful. Before launch, specific periods or determinable rules must be published for tickets, accounts, accounting records, security logs and backups. This draft does not invent an implemented automatic deletion cycle. When purposes end or a valid request applies, data is deleted or irreversibly anonymised subject to law. Legal retention, dispute evidence and isolated backup exceptions require an identified basis, scope and disposal point.

Rights and requests

Send a privacy-rights request to the contact above or support@alur-ten.com, identifying the product, your relationship to it and the requested action. Do not send passwords, codes or full identity documents. Verification must be proportionate and handling must meet applicable statutory deadlines; internal procedures do not extend them.

• Subject to law, request information, access or copies, correction, completion, cessation, restriction or deletion, and portable data where the conditions apply.
• Withdraw consent for consent-based processing. This does not invalidate earlier lawful processing and may prevent the necessary service from continuing. Separate legal retention duties must not be described as perpetual consent.
• Where applicable, object to solely automated decisions with significant effects, request human review, complain to competent authorities or seek judicial remedies.
• For data controlled by an employer, merchant or project customer, we explain our role and assist the relevant controller without disclosing others’ data without authority. This does not remove our own duties. Restrictions or refusals require reasons and available remedies.

Specific personal data and children

The website is for businesses and authorised representatives, not a service directed at children. Do not send health, biometric, personal financial or children’s data through public tickets. Products that genuinely need payroll, bank details, medical leave evidence or other specially protected data require additional notices, appropriate access limits and applicable risk assessment. Children’s data requires applicable safeguards such as guardian consent; an enterprise upload does not waive protection.

Security and personal data incidents

Controls must match risk; no system can promise that breaches never occur. Production access, transmission protection, auditing, backups and response arrangements require validation. Where a personal data protection failure triggers notification, the responsible controller must comply with Article 46 of Indonesia’s Personal Data Protection Law and other applicable rules, including the applicable written-notice deadline of no later than 3 × 24 hours. An unfinished investigation does not automatically permit delay. As processor we must promptly inform and assist the customer, without replacing notifications legally owed by us.

Updates and contact

Material changes to purposes, recipients, locations or rights require appropriate notice before implementation and renewed consent where legally necessary. Continued browsing is not automatic consent to new purposes. The date is a draft revision date, not contract commencement. Contact support@alur-ten.com for privacy and data matters and sales@alur-ten.com for business enquiries. The final version requires completed entity, processing and effective-date information.