This agreement is part of the Terms of Service for every account. A signable copy is available from [email protected].

1. Parties and roles

The customer (the issuer) is the controller and PT Momenial Open Media is the processor of recipient data. When a customer’s account ends, its credentials stay available to their holders under section 5 of the Terms, and from then on we keep those records as controller, for that purpose only.

2. Subject matter and duration

Issuing and hosting credentials for the customer’s recipients, for as long as the credentials exist.

3. Data subjects and data (Annex I)

Data subjects	Data
Recipients and holders	Name, email or mobile number, credential fields, member or certificate number, photo, status, delivery records

Sensitive data is processed only if the customer puts it in a field, which the Acceptable Use Policy restricts to non-public fields with the holder’s agreement.

4. Instructions

The Terms, the product’s settings and the customer’s actions in it are the customer’s instructions. We tell the customer if an instruction appears unlawful.

5. Confidentiality and security (Annex II)

Staff with access are bound to confidentiality. Measures: encryption in transit and at rest on Cloudflare; scoped API keys stored hashed; a hashed employer-search index; Turnstile and rate limits on public lookups; access control and logging; immutable versions; backups.

6. Subprocessors

The list is on the subprocessors page (Annex III). We give 30 days’ notice of an addition by email and on that page. The customer may object and, if we cannot resolve it, terminate.

7. International transfers

Where the GDPR applies, the EU standard contractual clauses are incorporated by reference: module two between the customer and us, and module three through Cloudflare’s and AWS’s terms. Where UU PDP applies, transfers meet its conditions for transfers abroad (Article 56).

8. Assistance

We forward holder requests to the customer and provide self-service tools on the credential page. We notify the customer of a personal data breach without undue delay and within 48 hours of confirming it. We help with impact assessments on request.

9. Audits

On request, a completed security questionnaire and the security page. An on-site or third-party audit once a year, at the customer’s cost, with 30 days’ notice.

10. End of the agreement

The customer exports its records (CSV, JSON, Open Badges files) before closing the account. Credentials remain available to holders under the Terms; the customer may withdraw credentials first if it wants them erased. Everything else is deleted as set out in the Privacy Policy.

11. Liability, precedence and law

Liability follows the Terms. For data protection, this agreement prevails over the Terms. Indonesian law governs.