Privacy Policy
VillaTax, PT Asiah Legal Jaya Last updated: July 2026
VillaTax is operated by PT Asiah Legal Jaya, an Indonesian limited liability company registered under entity number 1446293. This Privacy Policy describes how we collect, process, store, and protect your personal data when you use our Indonesian tax compliance SaaS platform, accessible at villa-tax.operium.store.
We are committed to processing your data with transparency, rigour, and in strict compliance with the General Data Protection Regulation (GDPR) of the European Union and the Indonesian Personal Data Protection Law UU PDP No. 27/2022.
By using VillaTax, you acknowledge that you have read, understood, and accepted the terms of this policy. If you do not agree with its provisions, we invite you not to use our service and to contact us with any questions.
1. Data controller
VillaTax is developed and operated by PT Asiah Legal Jaya, an Indonesian limited liability company duly registered under entity number 1446293. PT Asiah Legal Jaya is responsible for the full management of the VillaTax service, oversight of data infrastructure, and the contractual relationship with users.
| Detail | Information |
|---|---|
| Company name | PT Asiah Legal Jaya |
| Entity number | 1446293 |
| Registered office | Benoa Square lantai 3 suite 4.3, Jalan By Pass Ngurah Rai No 21 A, Badung, Bali, Indonesia |
| Contact email | commercial@operium.store |
| +6281387983316 |
2. Data collected
VillaTax collects only the data strictly necessary to provide its tax compliance services. No data is collected for advertising or resale purposes.
2.1 Account data
When you create your VillaTax account, we collect your email address, full name, the name of your company or legal entity (PT, CV, Perorangan, etc.), and your password, which is immediately hashed via the bcrypt algorithm (12 rounds) before storage. We never store your password in plain text. Additional information may be voluntarily provided in your Settings: NPWP number, Bali regency, tax status (resident / non-resident / DTA).
2.2 Booking and revenue data
To automatically calculate your tax obligations (PBJT, PPh, PPN), VillaTax imports and processes your villa booking data: guest names, check-in and check-out dates, gross revenues in Indonesian rupiah (IDR) or foreign currencies converted at the DJP Kurs Pajak, source platform (Airbnb, Booking.com, Traveloka, etc.), and computed tax breakdown. This data is imported via real-time webhook, iCal synchronisation, email parser, or REST API, depending on the method chosen.
2.3 Property data
Information relating to your villas is necessary in order to apply the tax rates specific to each Bali regency (local Perda): property name, full address, regency (Badung, Gianyar, Denpasar, Buleleng, etc.), operating legal entity, NPWPD number where applicable.
2.4 Personnel data
For users who have subscribed to the HR and Payroll modules, VillaTax processes your employees' data necessary for calculating BPJS Kesehatan, BPJS Ketenagakerjaan social contributions, and PPh 21 withholding: first and last name, gross monthly salary, job title, employer and employee BPJS contributions. This data is never shared with third parties outside your statutory reporting obligations.
2.5 Guest data (passport photographs)
In accordance with Indonesian regulations on foreign guests (Siskoharlat obligation), VillaTax may receive passport photographs when registering a guest. These images are classified as sensitive data and are subject to particularly rigorous processing. They are automatically and irreversibly deleted from our systems within 24 hours of the guest's checkout. No analysis, facial recognition, or analytical processing is performed on these images.
2.6 Payment data
All VillaTax subscription payments are processed exclusively by Xendit (PT Xendit Pembayaran Indonesia), a PCI DSS Level 1 certified provider. VillaTax does not store any bank card data, any permanent virtual account number, or any CVV key. We receive from Xendit only a transaction identifier and the payment status, necessary for activating your subscription.
3. Purpose of processing and legal basis
In accordance with Article 6 of the GDPR and Article 20 of UU PDP No. 27/2022, each processing activity rests on an identifiable legal basis.
| Processing purpose | GDPR legal basis | UU PDP legal basis |
|---|---|---|
| Account creation and management | Art. 6.1.b, Contract performance | Art. 20.1.b |
| Automated tax calculation (PBJT, PPh, PPN) | Art. 6.1.b, Contract performance | Art. 20.1.b |
| DJP / Coretax compliance report generation | Art. 6.1.b + 6.1.c, Legal obligation | Art. 20.1.c |
| Social contribution and BPJS payroll calculation | Art. 6.1.c, Legal obligation | Art. 20.1.c |
| OTA booking import and processing | Art. 6.1.b, Contract performance | Art. 20.1.b |
| Security and fraud detection | Art. 6.1.f, Legitimate interest | Art. 20.1.f |
| Sending transactional emails | Art. 6.1.b, Contract performance | Art. 20.1.b |
| Service improvement and technical analysis | Art. 6.1.f, Legitimate interest | Art. 20.1.f |
| Accounting records retention | Art. 6.1.c, Legal obligation | Art. 20.1.c |
None of your personal data is sold, rented, or transferred to third parties for commercial, advertising, or prospecting purposes. The only disclosures of data to third parties are those strictly necessary to provide the service (sub-processors listed in section 8) or required by a legal obligation.
4. Data storage and security
4.1 Data location
All VillaTax data is hosted on servers located in Indonesia. For EU/EEA residents, this involves a transfer of personal data outside the European Economic Area; see the "International data transfers" section of our GDPR & UU PDP Compliance page for the applicable safeguards.
4.2 Technical security measures
VillaTax implements a set of technical and organisational measures to protect your data against any unauthorised access, disclosure, alteration, or destruction:
- TLS 1.3 encryption on all communications between your browser and our servers
- Production server access strictly limited via SSH key (certificate-based authentication, password authentication disabled)
- User passwords hashed via bcrypt with a cost factor of 12 rounds
- JWT tokens signed via jose (HMAC-SHA256) with strict expiry
- Automatic daily backups at 03:00 UTC, retained 14 days with encryption at rest
- PostgreSQL database access exclusively from authenticated local connections (127.0.0.1)
- Error and performance monitoring via Sentry with PII scrubbing enabled, no sensitive data in logs
- No secret keys or API secrets transmitted as URL parameters
4.3 Security incident management
In the event of a data breach likely to give rise to a risk to your rights and freedoms, PT Asiah Legal Jaya undertakes to notify the competent supervisory authority within 72 hours of becoming aware of the incident, in accordance with Article 33 of the GDPR. Affected users will be informed without undue delay of the nature of the breach, the data affected, and the corrective measures taken.
5. Retention periods
We retain your data only for as long as strictly necessary for the purposes for which it was collected, in compliance with applicable legal obligations.
| Data category | Retention period |
|---|---|
| Account data (email, name, company) | Duration of subscription + 90 days |
| Booking and tax revenue data | 5 years (Indonesian tax obligation) |
| Exported tax declarations (DJP, SPT) | 5 years from the declaration date |
| Guest passport photographs | Automatic deletion 24h post-checkout |
| Personnel data (BPJS, PPh 21) | 5 years (statutory obligation) |
| Xendit transaction logs (ID only) | 3 years (accounting) |
| Technical logs and Sentry errors | 90 rolling days |
| Database backups | 14 days (daily rotation) |
| JWT session tokens | Max 30 days (automatic expiry) |
| Email magic links | 7 days (automatic expiry) |
| Marketing attribution data (pseudonymous identifier, linked events) | 24 months, deletable on request |
After retention periods expire, data is irreversibly deleted or anonymised. Upon an account deletion request, all your personal data is erased within 30 calendar days, except data whose retention is required by a legal obligation (tax data for 5 years, anonymised).
6. Cookies and tracking technologies
6.1 No advertising or tracking policy
VillaTax adopts a radically minimalist approach to cookies and tracking. We use no tracking cookies, third-party analytics cookies, advertising pixels, remarketing scripts, conversion tags, or any other mechanism for collecting behavioural data. No data is transmitted to Google Analytics, Facebook Pixel, LinkedIn Insight Tag, or any third-party advertising system. The only exception, described in Section 6.3, is a limited first-party mechanism used solely to measure which of our own pages and campaigns lead to a signup — it is not third-party advertising tracking and it only operates with your consent.
6.2 Storage technologies used
We use only two types of storage technology, strictly limited to the operation of the service:
| Technology | Purpose |
|---|---|
Session cookie (httpOnly, secure, sameSite: lax) |
Maintaining the authenticated session, strictly necessary for the service |
localStorage, lang key |
Remembering the chosen language (fr/en/de/es/id) |
localStorage, theme key |
Remembering the light / dark theme preference |
These preferences are stored locally in your browser and are never transmitted to our servers. You can clear them at any time via your browser settings. No personal identifying data is contained in these localStorage entries.
6.3 First-party marketing attribution
To measure which of our own content pages and campaigns lead to a signup, VillaTax uses a first-party, pseudonymous technical identifier (villatax-aid), generated in your browser and stored in a first-party cookie for up to 400 days. This identifier is created and used only if you have accepted cookies in our consent banner; if you refuse or have not yet decided, no identifier is created and no attribution event is recorded.
This mechanism:
- serves solely to measure marketing attribution (which page or source led to a visit, a diagnostic, or a subscription) — never to build an advertising profile, nor to sell or share data with third parties;
- never includes any fiscal content, diagnostic answers, NPWP numbers, passport data, banking details, or passwords — only aggregated indicators (e.g. risk band, page category) ever leave your browser;
- does not use device fingerprinting, canvas fingerprinting, or any other technique aimed at re-identifying you after cookies are cleared — the identifier is a single random value tied to a first-party cookie, nothing more;
- is retained for a maximum of 24 months, after which the underlying records are deleted or anonymised;
- may be linked, once you create an account, to your user profile in order to attribute your subscription to its original marketing source — this link never overwrites or replaces the account data described in Sections 2 and 5;
- billing and payment-confirmation events (e.g. subscription activation) are always recorded through your authenticated user account, never through this anonymous identifier.
You may delete this cookie at any time via your browser settings, or withdraw your cookie consent, which clears the identifier immediately.
7. Your rights over your personal data
In accordance with the GDPR (Articles 15 to 22) and Indonesian law UU PDP No. 27/2022 (Articles 5 to 17), you have the following rights over your personal data processed by VillaTax.
7.1 Right of access (Art. 15 GDPR)
You may at any time request a complete copy of all personal data we hold about you. This request may be sent by email to commercial@operium.store. We will respond within 72 hours and provide the data within 30 days.
7.2 Right to rectification (Art. 16 GDPR)
If data about you is inaccurate or incomplete, you may correct it directly from your Settings page in the VillaTax dashboard. For data not listed in Settings, contact us at commercial@operium.store.
7.3 Right to data portability (Art. 20 GDPR)
You may export all your data at any time directly from your VillaTax dashboard in structured, machine-readable formats: CSV for bookings and tax data, ZIP for all your files. No prior request is necessary, the export is available as a self-service feature from your dashboard.
7.4 Right to erasure, "right to be forgotten" (Art. 17 GDPR)
You may request complete deletion of your account and all associated data. Deletion will be carried out within 30 calendar days of receiving your request. Exception: tax data subject to a statutory retention obligation (5 years) will be anonymised and not deleted.
7.5 Right to object and to restriction (Art. 18–21 GDPR)
You may object to any processing based on our legitimate interest. You may also request restriction of processing in the cases provided for in Article 18 GDPR. These requests are handled within 30 days.
7.6 Right to lodge a complaint
If you consider that the processing of your personal data by VillaTax constitutes a breach of the applicable regulations, you have the right to lodge a complaint with the competent supervisory authority:
- EU residents: the authority in your Member State (CNIL in France, BfDI in Germany, AEPD in Spain, etc.)
- Indonesian residents: Kementerian Komunikasi dan Digital (Komdigi)
To exercise any of these rights: email commercial@operium.store or WhatsApp +6281387983316. Acknowledgement within 72 hours, full processing within 30 days. No fees are charged for exercising these rights.
8. Sub-processors and data transfers
VillaTax engages a limited number of sub-processors, carefully selected for their level of compliance and security. Each sub-processor is bound to PT Asiah Legal Jaya by a data processing agreement (DPA) or standard contractual clauses (SCC) compliant with GDPR requirements.
| Sub-processor | Role | Guarantees |
|---|---|---|
| PT Xendit Pembayaran Indonesia | Payment processing (IDR subscriptions) | PCI DSS Level 1, ISO 27001 |
| Resend Inc. (USA) | Transactional email delivery | Standard Contractual Clauses (SCC) |
| Hosting provider (Indonesia) | Server hosting and database | Data Processing Agreement |
| Sentry (USA) | Error and performance monitoring | SCC + PII scrubbing configured |
Data transfers to countries outside the European Union (hosting in Indonesia, Resend Inc., Sentry) are governed, for the US-based sub-processors, by the Standard Contractual Clauses (SCC) approved by the European Commission, pursuant to Article 46 of the GDPR. For hosting in Indonesia, see the "International data transfers" section of our GDPR & UU PDP Compliance page.
No VillaTax data is transmitted to advertising platforms, data brokers, social networks, or any entity not listed above.
9. Public API and access keys
VillaTax offers a public REST API allowing developers to integrate the Indonesian tax engine into their own applications. Use of the API is subject to the same privacy rules as the dashboard.
- API keys are randomly generated and hashed before storage, PT Asiah Legal Jaya cannot retrieve your key in plain text
- API keys must be transmitted exclusively via the
Authorization: Bearer {api_key}HTTP header, never as a URL parameter - Each API call is logged (endpoint, timestamp, HTTP code) for abnormal usage detection, without logging the request body
- In the event of suspected compromise of a key, you may revoke it instantly from your dashboard
10. Changes to this policy
PT Asiah Legal Jaya reserves the right to amend this Privacy Policy to reflect changes in its practices, applicable legal requirements, or VillaTax service features.
In the event of a material change affecting your rights or the processing of your personal data, we undertake to:
- Notify you by email to the address associated with your account, at least 14 calendar days before the changes take effect
- Display an information banner on villa-tax.operium.store during the notice period
- Update the "last updated" date visible at the top of this document
The current version of the Privacy Policy is always accessible at villa-tax.operium.store. By continuing to use VillaTax after a change takes effect, you accept the updated policy. If you do not accept the changes, you may close your account and stop using the service before the effective date.
For minor changes (typographical corrections, editorial clarifications with no impact on your rights), no prior notification is required.
11. Contact
For any questions regarding this Privacy Policy, to exercise your rights, or to raise a concern about the processing of your personal data, you may contact us at any time:
| Channel | Contact details |
|---|---|
| commercial@operium.store | |
| +6281387983316 | |
| Postal address | PT Asiah Legal Jaya, Benoa Square lantai 3 suite 4.3, Jalan By Pass Ngurah Rai No 21 A, Badung, Bali, Indonesia |
| Hours | Monday (Friday, 09:00) 18:00 WITA (UTC+8) |
We undertake to acknowledge receipt of any request within 72 hours and to provide a complete response within a maximum of 30 calendar days. This deadline may be extended by two additional months in the case of complex or numerous requests, in which case we will inform you within the initial 30-day period.
12. Governing law and jurisdiction
This Privacy Policy is governed jointly by:
- The General Data Protection Regulation (GDPR): Regulation (EU) 2016/679 of 27 April 2016, applicable where VillaTax offers services to or monitors persons in the European Union within the scope of Article 3
- The Indonesian Personal Data Protection Law: Undang-Undang Perlindungan Data Pribadi (UU PDP) No. 27/2022, applicable by virtue of PT Asiah Legal Jaya's activity in Indonesia
- The relevant provisions of the Indonesian Civil Code (KUHPer) governing contractual obligations
In the event of a dispute relating to the interpretation or application of this policy, the parties will endeavour to find an amicable solution within 30 days. Failing amicable agreement, the dispute will be submitted to the exclusive jurisdiction of the Commercial Court of Denpasar, Bali, Indonesia, unless mandatory legal provisions to the contrary apply in your country of residence.
VillaTax (PT Asiah Legal Jaya) villa-tax.operium.store, May 2026