Ця сторінка ще не перекладена на Українська. Показано англійську версію.
Version 1.4, last updated 2026-11-13. Effective date: 2026-11-13.
This policy explains how Sewa Rent (sewa.rent) handles personal data. It is written to meet Indonesian Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”). Many of our guests travel from the European Economic Area and the United Kingdom; for them, the GDPR and UK GDPR also apply, and section 13 gives the extra information those laws require.
In short: we collect what is needed to connect you with an owner (account, WhatsApp number, booking details), we share your contact with the owner only after the owner confirms, we never see payment card details (the only bank account we hold is the one a referral partner gives us to receive a payout), we do not store copies of passports or licences, and we delete booking details after 24 months.
1. Who is responsible (controller)
Sewa Rent, the online marketplace at sewa.rent (“Sewa Rent”, “we”, “us”) is the controller of personal data processed through the Platform. The operator’s full identity details are provided on request and to the authorities as the law requires (see “Company information”).
Contact for privacy questions and requests: support@sewa.rent, WhatsApp +62 822-4796-5465. Data protection contact point: support@sewa.rent (subject “Privacy”). We have not appointed a data protection officer, because our processing is not for a public service, does not involve large-scale regular and systematic monitoring and does not involve large-scale specific personal data (PDP Law, Article 53); we will appoint one if that changes.
Owners are separate controllers of the guest data they receive after a booking is confirmed (see section 5).
2. Data we collect
| Category | Examples | Source |
| Account | Name, email address, password (stored hashed), language, region, account type (guest or owner), email verification code if email verification is enabled | You |
| Contact | WhatsApp number (required for booking requests), phone number, optional profile photo | You |
| Booking request | Dates and times, pickup place or delivery address, number of units or passengers, message, confirmation that you hold the required licence or IDP category, booking status and history (requested, confirmed, picked up, returned, cancelled, expired, no-show) | You, owner |
| Request without an account | First name, email address and WhatsApp number when you send a booking request without signing up. We keep them in a guest profile under that email address, so the request appears in My trips once you set a password | You |
| Referral and advertising source | The partner code of the referral link or QR code you arrived through (cookie sewa_ref), stored with your booking request so that the partner who recommended us can be credited; advertising click identifiers and campaign tags (gclid, gbraid, wbraid, fbclid, utm) only if you accepted marketing cookies | Your device |
| Referral programme (partners) | Your personal partner code; the account of the person who invited you (fixed when your account is created); the people who signed up through your code (first name, sign-up date, number of completed rentals and the reward you earned from them); accrued and paid rewards; and, when a payout is due, the bank account you give us to receive it and the tax identification (NPWP or NIK) the law requires for withholding income tax | You, generated by the Platform |
| Messages | Messages sent through the Platform | You |
| Owner and listing data | Business or personal name, listing text, photos, prices, pickup points, response times; the fact and date that our operator saw identity and vehicle or vessel documents and confirmed the WhatsApp number (we do not store copies of the documents) | Owner, our team |
| Reviews and reports | Ratings, review text, reports you file | You |
| Reliability record | Counts of completed rentals, late cancellations and no-shows in the last 90 days, derived from booking events | Generated by the Platform |
| Consent record | Which document version you accepted, date and time, hashed IP address | Generated by the Platform |
| Technical | IP address (used for rate limits and anti-bot checks), browser and device data, security and error logs (stored outside the web root), cookies (see Cookie Policy) | Your device |
| Support | Messages and files you send to us by email, WhatsApp or the contact form | You |
What we do not collect: images of driving licences, passports or ID cards, payment card data, bank account numbers (other than the account a referral partner gives us to receive a payout), biometric data, or other “specific” personal data under the PDP Law. Please do not send such documents through the Platform. Owners may ask to see documents at pickup (see section 5 and the Damage and Security Deposit Policy).
3. Why we use it and on what legal basis
| Purpose | Legal basis (PDP Law / GDPR) |
| Create and run your account; process booking requests; show listings; send booking emails and reminders | Performance of a contract |
| Release WhatsApp contact details and the exact pickup point to the other party after confirmation, and for 30 days after the rental ends | Performance of a contract |
| Reliability record (late cancellations, no-shows) to protect owners and guests | Legitimate interest |
| Security: prevent spam, fraud and abuse; rate limits; Cloudflare Turnstile checks; logs | Legitimate interest |
| Reviews and moderation | Legitimate interest; contract |
| Record of accepted documents | Legal obligation / legitimate interest (evidence) |
| Accounting and tax records | Legal obligation |
| Non-essential cookies and analytics | Consent |
| Measuring our own advertising (Google Ads, Meta): conversion tags, pixel and server-side events, hashed contact details for matching | Consent (marketing cookies) |
| Referral programme: credit the partner who invited a user, calculate and pay rewards, withhold tax | Performance of a contract (the programme rules); legal obligation (tax) |
| Marketing emails or messages (only if we send them) | Consent |
| Responding to authorities | Legal obligation |
You may withdraw consent at any time (see section 8). Withdrawing consent does not affect processing that happened before.
4. How the booking request shares data, and the reliability record
- Before an owner confirms: the owner sees your first name, the requested dates, the item, your message, and your reliability indicator. The owner does not see your WhatsApp number or email.
- After the owner confirms: you and the owner can see each other’s WhatsApp number and the exact pickup point, until 30 days after the rental ends.
- The reliability record counts your completed rentals, late cancellations and no-shows over the last 90 days. Owners see it as an indicator. A guest with 2 or more no-shows in 90 days needs our team’s approval for new requests. A no-show can be disputed, and our team reviews every case before a restriction is applied. No decision with legal effect is taken automatically.
- If you signed up or sent a request through a partner’s referral link or code, that partner (and the partner who invited them) sees your first name, the date you signed up, how many of your rentals were completed and the reward earned from them. The partner never sees your contact details, your bookings, your listings or the prices you paid.
5. Who receives your data
- Owners, as described above. After confirmation the owner decides how to use the data for the rental. Owners must use it only for that rental and must protect it (Owner Partner Agreement, section 10).
- Service providers acting for us, each bound by a data processing agreement: Hostinger (web hosting, database, email mailbox and sending; its data centres may be outside Indonesia, see section 6); Cloudflare (DNS, firewall, Turnstile anti-bot checks, which process your IP address and browser data); Google (maps on listing pages; Google Analytics 4 usage statistics, only after you accept analytics cookies; Google Ads conversion measurement, only after you accept marketing cookies, including, when you are signed in, a SHA-256 hash of your e-mail address and phone number so that Google can match a conversion to an ad click (enhanced conversions); machine translation through the GTranslate widget for languages we do not host ourselves; encrypted off-site backups in Google Drive); Microsoft Clarity (session recordings and heatmaps, only after you accept analytics cookies; everything you type is masked, and recordings never run on account, booking or owner-cabinet pages); Meta Platforms (Facebook and Instagram ads: the Meta Pixel in your browser and the Meta Conversions API from our server, both only after you accept marketing cookies; they receive the pages you view, the fact that you sent a booking request or clicked WhatsApp, your IP address and browser data, the _fbp and _fbc identifiers and, when you send a request, a SHA-256 hash of your e-mail address, phone number and an internal user identifier, so that Meta can measure and attribute our ads; we never send plain contact details or booking content, and Meta also processes this data under its own terms); Anthropic (automatic translation of listing texts written by owners; no account or booking data is sent).
- Authorities, courts and professional advisers, where the law requires or to protect rights.
- A buyer or successor, if the business is transferred, under the same protections.
We do not sell personal data.
6. Transfers outside Indonesia
Some providers store or process data outside Indonesia (hosting, email, Cloudflare, Google, Microsoft, Meta, Anthropic). Under Article 56 of the PDP Law we transfer data abroad only where the destination country offers a level of protection at least equal to the PDP Law, or where the provider is bound by binding and enforceable data protection commitments (a data processing agreement with contractual clauses, including the EU Standard Contractual Clauses where the GDPR applies), or, failing both, with your consent. Data sent to Google Ads and Meta for advertising measurement is transferred only on the basis of your consent, which you give by accepting marketing cookies and can withdraw at any time in Cookie settings.
7. How long we keep data
| Data | Retention |
| Account and profile | While the account is active; inactive accounts: we notify you, then delete after 24 months |
| Booking requests (personal details such as name, WhatsApp number, message) | 24 months after the booking ends, then personal details are removed |
| Anonymised booking records (dates, price, region) | 10 years, as accounting and tax records (Law No. 28 of 2007 on General Tax Provisions, Article 28(11)) |
| Messages | With the related booking: 24 months |
| Consent record | For the life of the account plus 5 years, as a record of the electronic transaction (Government Regulation No. 80 of 2019, Article 25) |
| Reliability record | While the account is active, recalculated from booking events of the last 90 days |
| Referral programme: attribution and reward lines | While the partner account exists and during the earning window of each referred person (12 months from sign-up), then 5 years as a record of the electronic transaction |
| Referral payouts (amount, tax withheld, bank reference, bank account) | 10 years, as accounting and tax records |
| Activity, access and security logs | 30 to 90 days |
| Email sending logs | 30 days |
| Support messages (email, WhatsApp, contact form) | 24 months after the conversation ends |
| Backups | Daily and weekly copies are overwritten within about 8 weeks; deleted data may remain in backups until then |
We review these periods at least once a year.
8. Your rights
Under the PDP Law you can: ask what data we hold about you and get a copy; correct or complete it; ask us to delete it or stop processing it; withdraw consent; object to a decision based only on automated processing; ask us to limit processing; and receive your data in a portable format. If the GDPR applies to you, you have the equivalent rights and the right to complain to your supervisory authority.
To exercise a right, write to support@sewa.rent from the email address on your account. We respond without undue delay. For access, correction and deletion requests the PDP Law requires us to act within 3×24 hours of receiving a complete request (Articles 30 to 33); where the GDPR applies we answer within one month, extendable by two months for complex requests.
You withdraw consent to analytics and marketing cookies, and to the Google Ads and Meta events that depend on them, through Cookie settings in the footer; it takes effect from that moment.
On a deletion request we delete or anonymise your profile, booking details and messages. We keep anonymised booking records (dates, price, region) where we must keep accounting or dispute records, as stated in section 7.
9. Data breaches
If a personal data breach is likely to harm you, we will notify you and the competent authority within 72 hours (3×24 hours) of becoming aware, as required by the PDP Law and, where it applies, GDPR Article 33.
10. Security
We use access controls, two-factor authentication for administrators and operators, login and request rate limits, Cloudflare Turnstile anti-bot checks, security headers, encrypted connections, upload checks, logs stored outside the web root, and activity logs. No system is perfectly secure.
11. Cookies
See the Cookie Policy.
12. Children
The Platform is not for people under 18. We do not knowingly create accounts for them.
13. Additional information for users in the EEA and the United Kingdom
If you are in the EEA or the UK, the GDPR or UK GDPR applies to our processing of your data when you use the Platform. The legal bases in section 3 are those of GDPR Article 6. You may complain to the supervisory authority of your country. We have not appointed a representative in the EU or the UK under GDPR Article 27, because our processing of EEA and UK users’ data is occasional, does not include special categories of data on a large scale and is unlikely to result in a risk to your rights (Article 27(2)(a)); write to support@sewa.rent. Hong Kong: when we launch there, a notice under the PDPO will be added.
14. Changes
We will publish the new version with its date and notify registered users of material changes at least 30 days before they take effect.
15. Contact
support@sewa.rent, WhatsApp +62 822-4796-5465.
