Version 1.0 · Effective 1 October 2026
This Privacy Policy explains how PT HOMEX GLOBAL INTEGRATOR ("HomeX", "we") processes personal data through the HomeX app, the demo.homex.co.id and homex.co.id websites, and the Supplier and HQ portals (together, the "Platform"). It is based on Indonesian Law No. 27 of 2022 on Personal Data Protection ("PDP Law") and its implementing regulations.
1. Data controller
The personal data controller is PT HOMEX GLOBAL INTEGRATOR, an Indonesian legal entity whose Director is Chen Quanhua. Data protection contact: service@homex.co.id, phone +6281118891032.
2. A business-only platform
HomeX is a business-to-business (B2B) building-materials procurement platform. Accounts are only granted to businesses registered in Indonesia, namely Suppliers and Member HomeX (stores and contractors), after approval by HomeX HQ. The Platform is not intended for individuals acting for personal purposes. The personal data we process belongs to people who represent or work for those businesses, such as officers, account admins, and contact persons.
3. Data we collect
• User account data: full name, job title, email address, phone number, app language, password (stored as a hash), and two-step verification settings when enabled.
• Company data: full legal name, short name, entity type, office address (street, kelurahan, kecamatan, city, province, postal code), NIB, NPWP, and PKP status.
• Registration documents: copies of the NIB, NPWP, deed of establishment/amendment, and other documents HQ requests, as images or PDF. These documents may contain names and identity data of company officers.
• Supplier bank details (and Mitra Tukang bank details where recorded): bank name, account holder name, and account number.
• Transaction data: carts, orders, invoices, delivery notes, pickup codes, Virtual Account (VA) payments, returns, bills and credit facilities, coupons, Member levels, and price and stock history.
• Delivery data: recipient name, phone number, delivery or dropship address, vehicle type, and the coordinates used to calculate distance and shipping fees.
• Mitra Tukang data: name, phone number, skills, service area, affiliated store, and job history on the Platform.
• Communications: emails and messages you send us, and notification delivery records.
• Technical and log data: IP address, device type and user agent, access times, and audit logs of sign-ins and account changes. The Android app only requests internet access; we do not access device location, contacts, camera, or microphone without your action (for example, when you choose a file to upload).
4. Purposes of processing
• Register, verify, and approve business accounts, and manage users within a company.
• Display the catalogue, prices, and Member levels; review Supplier products and price changes.
• Process orders, VA payments, central-warehouse handling, delivery, pickup by code, returns, and settlement to Suppliers.
• Connect Members with Mitra Tukang for installation work.
• Issue invoices and tax documents, keep books, and meet legal obligations.
• Keep accounts secure, prevent fraud and misuse, and resolve questions and disputes.
• Send operational notices (registration status, orders, bills, security). Promotional messages are only sent with consent and can be stopped at any time.
• Improve and develop the Platform using usage data that is aggregated where possible.
5. Legal basis
Under Article 20 of the PDP Law, we process data on the basis of: (a) performance of the contract with your business, namely the Terms of Service and the Registration Agreement; (b) compliance with legal obligations, including tax, bookkeeping, and lawful requests from authorities; (c) legitimate interests, including security, fraud prevention, and service improvement, balanced against your rights; and (d) consent, where required, such as for promotional messages. Consent can be withdrawn at any time without affecting processing carried out before withdrawal.
6. Who receives data
We do not sell personal data and do not use it for third-party advertising. Data is shared only as far as needed with:
• A licensed third-party payment gateway, to create and match Virtual Account payments (company name, order number, amount, and billing contact). HomeX does not receive banking PINs, banking passwords, or card data.
• Logistics partners and drivers, for delivery (recipient name, phone, address, and shipment contents).
• Hosting, cloud, email, and messaging providers that process data on our instructions.
• Google Maps Platform, for geocoding and distance calculation between the warehouse and delivery addresses.
• The relevant Suppliers and Members, only as needed to fulfil orders, returns, or Mitra Tukang jobs.
• Professional advisers (auditors, tax consultants, legal counsel) bound by confidentiality.
• Government or law-enforcement authorities where required by law.
• A party that acquires all or part of the HomeX business, with notice to you as required by the PDP Law.
Parties that process data on our behalf are bound by agreements requiring confidentiality and data security.
7. Transfers outside Indonesia
Some service providers may store or process data outside Indonesia. In that case we ensure the transfer complies with Article 56 of the PDP Law: to a country with an equal or higher level of protection, under adequate and binding safeguards, or with your consent.
8. Retention
• Account and company data are kept while the account is active and afterwards for as long as needed for the purposes above.
• Orders, invoices, payments, bills, and the company NIB and NPWP are kept for up to 10 (ten) years in line with tax and company-document obligations (including the General Tax Provisions Law and the Company Documents Law).
• Registration documents are kept for the duration of the business relationship and afterwards as required by law.
• Security and audit logs are kept for up to 2 (two) years, unless needed longer for an incident investigation or legal proceedings.
• Rejected registration requests are kept for up to 1 (one) year for verification purposes, unless the law requires otherwise.
When the retention period ends, data is deleted, destroyed, or anonymised.
9. Your rights as a data subject
Under the PDP Law you have the right to: be informed about processing; access and obtain a copy of your data; correct inaccurate data; request deletion or destruction of data; withdraw consent; object to decisions based solely on automated processing; request that processing be suspended or restricted; and receive your data in a commonly used format. Send requests to service@homex.co.id. We may ask you to verify your identity and authority. We respond to access and correction requests within 3 x 24 hours and to other requests within the periods set by the PDP Law. Some requests may be limited where they conflict with legal obligations, such as keeping tax records.
10. Account deletion
A user login can be deleted in the app (Account → Hapus akun) or through the public page https://demo.homex.co.id/account-deletion without installing the app. Requests made on the public page are confirmed through a link sent to that email address, valid for 24 hours. Once confirmed, the login is deactivated and the user's name, email, and phone are anonymised. If the requester is the company's only admin, HQ reviews the request before the login is closed so the company account is not left without a manager. Orders, invoices, payments, and the company NIB and NPWP are kept as required by law, as described in Section 8. Deletion of a business's data as a whole can be requested at service@homex.co.id and is processed once open obligations are completed.
11. Security
We apply reasonable technical and organisational measures, including encrypted connections (HTTPS/TLS), hashed password storage, role-based access, two-step verification for HQ staff, audit logs, and regular backups. No system is entirely risk-free; keep your password and pickup codes confidential. If a personal data protection failure occurs, we notify affected data subjects and the competent authority within 3 x 24 hours as required by Article 46 of the PDP Law.
12. Children and individuals
The Platform is not directed at children or individuals. Users must be at least 18 years old and authorised to act for their business. We do not knowingly collect children's data. If we learn that children's data has been collected, we delete it.
13. Consistency with Google Play
The Data safety information for the HomeX app on Google Play follows this policy: the data collected is personal information (name, email, phone, address), financial information (purchase history and, for Suppliers, bank account), uploaded document files, and app activity and technical logs. Data is encrypted in transit, is not sold, is not used for advertising, and users can request deletion as described in Section 10. If app features change the data collected, this policy and the Data safety information are updated together.
14. Changes
We may update this policy. The version and effective date are shown at the top. Material changes are announced in the app or by email before they take effect.
15. Contact
PT HOMEX GLOBAL INTEGRATOR · Email: service@homex.co.id · Phone: +6281118891032.
16. Language
This policy is made in Indonesian, English, and Simplified Chinese. If the versions differ, the Indonesian version prevails.