Hub IDEN

Template. Fill in the parts in [square brackets] before signing. The Indonesian version prevails.

Data Processing Agreement (template)

Version 1.0, effective 1 November 2026. This agreement supplements the DBenk Hub Terms of service (https://dbenk.com/en/terms) and applies only when the Processor processes personal data on behalf of the Controller as described below.

Parties

  1. Personal Data Controller ("Controller"): [CUSTOMER COMPANY NAME], of [ADDRESS], represented by [NAME, TITLE].
  2. Personal Data Processor ("Processor"): DBenk, represented by [NAME, TITLE].

1. Background

DBenk Hub is installed and run on the Controller's own server. In normal operation the Processor does not receive personal data of the Controller's employees or Hub users; the Hub only sends usage numbers when renewing its license. This agreement covers the situations in which the Processor may see or receive the Controller's personal data:

  • technical support at the Controller's request (shared screen session, temporary remote access, Diagnostics files or backups sent by the Controller);
  • installation or maintenance performed by the Processor at the Controller's written request;
  • a Cloud service (the Processor hosts the Controller's Hub), when available and agreed.

2. Details of processing

  • Data subjects: the Controller's employees, freelancers, and Hub users.
  • Data types: name, user name, e-mail, role; attendance status from the laptop agent (active/idle/away, device name, operating system, name of the application in front and for how long unless turned off, window description only when the Controller enables it); data of other modules the Controller uses.
  • Purpose: solely to provide the support, installation, maintenance, or hosting requested by the Controller.
  • Duration: while the support request or service lasts; temporary copies are deleted at the latest [30] days after completion.
  • Excluded: specific categories of data (health, biometrics, etc.) must not be entered in the Hub unless agreed in writing.

3. Processor obligations

  1. Process personal data only on the Controller's written instructions (including support tickets or e-mail) and tell the Controller if an instruction in its view breaches the PDP Law.
  2. Keep it confidential; only personnel who need access and are bound by confidentiality may access it.
  3. Apply appropriate technical and organisational security measures, including: personal accounts, encryption in transit, encrypted and restricted storage of Diagnostics files/backups, deletion when done, access logging.
  4. Not engage sub-processors without the Controller's prior written consent; sub-processors are bound by the same obligations. Current sub-processors: [NONE / list].
  5. Reasonably help the Controller answer data-subject requests and with impact assessments.
  6. Notify the Controller without delay and at the latest within 2 x 24 hours after becoming aware of a personal data protection failure involving the Controller's data, so the Controller can meet the 3 x 24 hours notification duty under the PDP Law.
  7. Not transfer data outside Indonesia without the Controller's written consent and protection in line with the PDP Law.
  8. When the service ends, delete or return the data as the Controller chooses, unless retention is required by law.
  9. Provide reasonable information to demonstrate compliance and allow audits with [30] days' notice, at the Controller's cost.

4. Controller obligations

  1. Ensure a lawful basis and inform employees before the presence agent is installed (template: https://dbenk.com/en/employee-notice).
  2. Give lawful instructions and share only the data needed for a support request.
  3. Manage access, roles, and backups on its own server.

5. Liability

Liability limits follow the Terms of service, except for breaches of confidentiality and security obligations through intent or gross negligence. [Additional indemnity terms, if agreed.]

6. Term and law

This agreement applies from signature until all services have ended and the data has been deleted or returned. Governed by the laws of the Republic of Indonesia; disputes follow the Terms of service.

Controller: [NAME, TITLE, SIGNATURE, DATE]

Processor: DBenk — [NAME, TITLE, SIGNATURE, DATE]