Data processing agreement

Last updated 27 October 2026 · version 2026-10-27

This agreement (“DPA”) is part of the WRSS terms of service between Wirasesa Digital (“WRSS”, “we”) and the business that uses WRSS (“you”). It applies when we process personal data on your behalf, mainly the data your website’s visitors send you. You accept it in your business’s Settings.

In GDPR terms you are the controller and we are the processor (Art. 28). Under Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”) you are the Pengendali Data Pribadi and we are the Prosesor Data Pribadi.

1. What we process

• Subject matter: hosting your website and the WRSS tools you use.
• Duration: as long as you use WRSS, plus the deletion periods in section 9.
• Nature and purpose: storing, displaying, sending by email, backing up and deleting data, only to provide WRSS to you.
• Types of data: names, email addresses, phone numbers, messages, job applications and CVs sent through your forms; IP addresses and browser details in security logs; anything else you choose to put on WRSS.
• Data subjects: your website visitors, customers, job applicants and team members.
• Special categories: not intended. Don’t ask visitors for health, religion or similar data through WRSS forms.

2. Your instructions

We process the data only on your documented instructions: these terms, this DPA, and the settings you choose in WRSS (for example where form messages are sent and how long enquiries are kept). If we must process it for another reason by law, we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you.

3. Confidentiality

Everyone at WRSS who can access your data is bound to keep it confidential and only accesses it when needed to run or support the service.

4. Security

We protect the data with appropriate technical and organisational measures (GDPR Art. 32, UU PDP Art. 35–39), including:

• encryption in transit (HTTPS/TLS) everywhere, and hashed passwords;
• access limited to the people who run WRSS, with two-step verification;
• separation between businesses: each business can only see its own data;
• regular backups and the ability to restore them;
• security logging, bot protection and rate limits on public forms;
• keeping software up to date and reviewing these measures as WRSS grows.

5. Sub-processors

You give us general permission to use the sub-processors on our sub-processor list. We tell you by email at least 30 days before adding or replacing one. If you object on reasonable data protection grounds, we’ll try to find a solution; if we can’t, you may end the affected service and we refund any prepaid fees for it. Each sub-processor is bound by data protection terms at least as protective as this DPA, and we remain responsible for them.

6. Helping you

• People’s rights. WRSS lets you view, export and delete enquiries yourself. If someone contacts us directly about your data, we pass the request to you and help you answer it.
• Your obligations. We give you reasonable help with security, breach notifications, data protection impact assessments and consultations with regulators, taking into account the information we have.

7. Personal data breaches

If we become aware of a breach affecting your data, we tell you without undue delay and aim to do so within 48 hours, with what we know: what happened, the data and people affected, likely consequences and what we’re doing about it. This lets you meet your own deadlines (72 hours under GDPR Art. 33 and UU PDP Art. 46).

8. International transfers

WRSS is run from Indonesia and our sub-processors operate in several countries. Where personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, the European Commission’s Standard Contractual Clauses (Module 2 controller-to-processor, or Module 3 processor-to-processor with our sub-processors) and the UK Addendum apply and are incorporated into this DPA by reference. Transfers out of Indonesia follow UU PDP Art. 56.

9. When you stop using WRSS

You can export your data at any time. When you delete a business or your account, we delete its data from the live system (after the grace period you’re shown) and from backups within 30 days, unless the law requires us to keep it. Website enquiries are deleted automatically after the retention period you choose.

10. Audits and information

We make available the information you reasonably need to show compliance with GDPR Art. 28 and UU PDP, and answer your written questions about our security. If that isn’t enough, you may audit us (or have an independent auditor do so) once a year with 30 days’ notice, at your cost, during business hours and under confidentiality.

11. Liability and order of precedence

Each party’s liability under this DPA is subject to the limits in the terms of service, except where the law doesn’t allow it to be limited. If this DPA conflicts with the terms, this DPA wins for data protection matters; the Standard Contractual Clauses win over both.

12. Contact

Questions about this agreement or our security: [email protected].