Privacy Policy — TPFx People

1. Introduction

1. Trijaya Pratama Futures (“TPFx”) operates TPFx People, a Human Resource Information System (HRIS) mobile application designed exclusively for the internal use of registered TPFx employees. This Privacy Policy explains how we collect, use, store, protect, and disclose information when you use the TPFx People application on your Android or iOS device.

By downloading, installing, or using TPFx People, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy. This application is intended solely for TPFx employees and authorized personnel. If you are not a current employee or authorized user of TPFx, you are not permitted to use this application.

This Privacy Policy applies to the TPFx People mobile application available on Google Play Store and Apple App Store.

2. Information We Collect

We collect the following categories of information in connection with your use of TPFx People:

2.1 Account and Identity Information

• Full name, employee ID, and job title
• Work email address (in the format: name@tpfx.internal)
• Department, branch, and supervisor information
• Employment status, join date, and work schedule
• Personal data including date of birth, gender, and marital status (as registered in the company HR system)

2.2 Attendance Data

• Date and time of check-in and check-out
• Duration of work per session
• Attendance status (on-time, late, absent/alpha)
• Historical attendance records within the selected date range

2.3 Leave and Absence Requests

• Type, duration, and reason for leave requests (Annual Leave, Sick Leave, Emergency Leave, and others)
• Supporting documents uploaded by the employee (e.g., medical certificates, invitations)
• Approval status and approver identity (Manager, HRD)
• Submission timestamp

2.4 Work Visit Records (Field Sales/Marketing)

• Prospect name, phone number, company name, and address
• Visit purpose and objectives
• Visit status (Scheduled, In Progress, Completed)
• Deal or interest outcome

2.5 Device and Technical Information

• Device type, operating system version, and app version
• Session login and logout logs
• App usage activity for diagnostic and security purposes

3. Location Permission

3.1 Why We Need Location Access

TPFx People requests access to your device’s location (GPS) for the following strictly limited purposes:

• Attendance Verification: To confirm that you are physically present at an authorized work location (office, branch, or designated work area) when performing a check-in or check-out. Location data is used solely at the moment of attendance submission and is not tracked continuously.
• Work Visit Logging: When recording a new field visit (“Kunjungan Baru”), your location may be used to automatically populate the visit address field to reduce manual input errors.

3.2 How We Use Your Location

• Location is accessed only during active attendance or visit-logging sessions.
• We do not track your location continuously or in the background.
• We do not use your location data for advertising, analytics, or any purpose beyond attendance verification and visit documentation.
• Location data is transmitted securely to TPFx internal servers and is accessible only to authorized HR personnel and system administrators.

3.3 Your Rights Regarding Location

• You may revoke location permission at any time through your device’s application settings (Settings → Apps → TPFx People → Permissions → Location).
• Revoking location access will disable the attendance check-in/check-out feature. You will need to contact your HR department for alternative attendance recording procedures.

4. Camera Permission

4.1 Why We Need Camera Access

TPFx People requests access to your device’s camera for the following purposes:

• Face Recognition Registration: Upon first login, you may be prompted to register your facial biometric data to enable secure, automated attendance verification. This is optional — you may choose to skip and complete this registration at a later time.
• Face Verification for Attendance: If you have registered your facial biometric, the camera will be used during check-in/check-out to verify your identity and ensure accurate attendance recording.
• Profile Photo Update: You may use the camera to take and update your employee profile photo within the application.
• Document Attachment: When submitting a sick leave request, you may use the camera to photograph and upload supporting documents (e.g., medical certificates), with a maximum file size of 2MB per attachment.

4.2 How We Use Camera Data

• Camera access is activated only when you initiate a relevant action (face registration, attendance, photo update, or document upload).
• We do not access the camera passively, automatically, or in the background.
• Facial biometric data captured during registration and verification is stored in encrypted form on secure TPFx internal servers and is not shared with any third parties.
• Facial data is used exclusively for employee attendance authentication within the TPFx People application.

4.3 Your Rights Regarding Camera Access

• You may revoke camera permission at any time through your device settings (Settings → Apps → TPFx People → Permissions → Camera).
• Revoking camera permission will disable face verification, face registration, and the ability to attach photos to documents. Standard attendance and document text-based features will remain available.

 

5. Personal Data Permission

5.1 Categories of Personal Data Processed

In operating TPFx People as an internal HRIS tool, we process the following personal data of registered employees:

5.2 Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual necessity: Processing is required to fulfill the employment relationship and administer HR operations (attendance, leave, payroll data).
• Legitimate interest: We have a legitimate interest in maintaining accurate HR records, managing workforce attendance, and ensuring workplace productivity.
• Consent: For biometric data (facial recognition), we rely on your explicit, freely given consent, which you may withdraw at any time.
• Legal obligation: We may process personal data where required by applicable Indonesian laws, including Law No. 13 of 2003 on Manpower and Government Regulation No. 35 of 2021.

5.3 Data Retention

• Attendance and leave records are retained for a minimum of 5 (five) years from the date of creation, in accordance with Indonesian employment and tax regulations.
• Biometric/facial data is retained for the duration of active employment and deleted within 30 (thirty) days of employment termination or upon employee request.
• Account data is retained for the duration of active employment. Upon termination, account access is revoked within 30 days.
• Visit records are retained for 2 (two) years from the date of entry.

6. How We Use Your Information

We use the information collected through TPFx People solely for the following internal HR management purposes:

• Processing and recording daily employee attendance (check-in/check-out)
• Verifying employee identity through face recognition during attendance
• Managing employee leave and sick leave requests and approvals
• Recording and monitoring field sales/marketing visit activities
• Providing employees access to their own HR profile, attendance history, and leave balance
• Enabling HR managers and supervisors to review team attendance and manage workforce data
• Sending internal notifications related to attendance, leave approval status, or system updates
• Maintaining audit trails for compliance and HR governance purposes
• Improving application security and performance through anonymized diagnostic data

We do not use your personal data for marketing, advertising, profiling for non-HR purposes, or sharing with third-party commercial entities.

7. Data Sharing and Disclosure

7.1 Internal Access

Your personal data within TPFx People is accessible only to:

• The employee themselves — for their own profile, attendance history, leave records, and visit logs
• Direct supervisors/managers — for reviewing team attendance and approving leave requests
• HR Department personnel — for workforce administration and reporting
• System administrators — for technical maintenance and security monitoring

7.2 Third-Party Disclosure

We do not sell, rent, or disclose your personal data to third parties for commercial purposes.

We may share data only in the following limited circumstances:

• Legal compliance: When required by applicable Indonesian laws, court orders, government regulations, or lawful requests from competent authorities (e.g., BAPPEBTI, Ministry of Manpower, or law enforcement agencies with proper legal authority)
• Business operations: With trusted technical service providers (e.g., cloud hosting, application infrastructure) who process data strictly on our behalf, under binding data processing agreements, and are prohibited from using your data for any other purpose
• Corporate restructuring: In the event of a merger, acquisition, or transfer of business assets, your data may be transferred to the successor entity, subject to equivalent privacy protections

7.3 Cross-Border Data Transfer

All employee personal data is stored on servers located within the Republic of Indonesia. We do not transfer personal data outside of Indonesia without ensuring adequate protection measures are in place, consistent with applicable data protection laws.

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encrypted data transmission using HTTPS/TLS protocols
• Encrypted storage of biometric (facial recognition) data
• Role-based access control (RBAC) — limiting data access strictly to authorized roles
• Regular security monitoring and vulnerability assessments
• Secure credential management with JWT-based session authentication
• Partial masking of sensitive data (e.g., employee email addresses displayed with partial redaction in the employee directory)

Despite these measures, no method of electronic transmission or storage is 100% secure. We are committed to promptly notifying affected users and relevant authorities in the event of a data breach, as required by law.

9. Your Rights as a Data Subject

As an employee and data subject, you have the following rights with respect to your personal data processed through TPFx People, consistent with Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP):

• Right to Access: You may request a copy of your personal data we hold through the app’s “My Profile” section or by contacting HR.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data in certain circumstances (e.g., biometric data upon withdrawal of consent). Note that certain data may be retained as required by law or legitimate business records.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., biometric data), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Data Portability: You may request a copy of your data in a structured, commonly used format.
• Right to Object: You may object to processing in certain circumstances.
• Right to Account Deletion: You may request permanent deletion of your TPFx People account through Settings → Account → Delete Account. This will permanently remove your account and associated application data, subject to legal retention requirements.

To exercise any of these rights, please contact: HR Department, PT. Trijaya Pratama Futures Email: support@tpfx.co.id | Phone: (+62) 21 252 75 77 Monday – Friday, 09:00 – 17:00 WIB

10. Children’s Privacy

TPFx People is an enterprise internal HR application intended exclusively for adults who are current employees of PT. Trijaya Pratama Futures. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that a minor has provided personal data without appropriate authorization, we will take immediate steps to delete such information.

11. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will:

• Update the “Last Updated” date at the top of this document
• Notify users through an in-app notification or announcement
• Post the updated Privacy Policy on our official website: www.tpfx.co.id/privacy-policy

Your continued use of TPFx People after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this policy periodically.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Indonesia, including but not limited to:

• Law No. 27 of 2022 on Personal Data Protection (UU PDP)
• Law No. 13 of 2003 on Manpower
• Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions
• BAPPEBTI regulations applicable to derivatives trading companies

Any disputes arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts in Jakarta, Indonesia.

13. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data processing practices, please contact us at:

1. Trijaya Pratama Futures Sahid Soedirman Center, 20th Floor, Unit A/E Jl. Jenderal Sudirman No. 86, Karet Tengsin Tanah Abang, Central Jakarta, DKI Jakarta 10220 Indonesia

Email: support@tpfx.co.id Call Center: (+62) 21 252 75 77 Office Hours: Monday – Friday, 09:00 – 17:00 WIB Website: www.tpfx.co.id

© 2026 PT. Trijaya Pratama Futures. All rights reserved.