Personal Data Processing and Privacy Policy of the BMMPAY service

1. Terms and definitions
1.1. Service – the "BMMPAY" service available when using the site at: https://bmmpay.id, the main function of which is to provide the technical possibility of dividing the bill in a public catering establishment between several visitors, transferring funds, both tips for waiters, and the amount of the main invoice in non-cash form from the Payer to the Recipient.
1.2. User – any visitor to a public catering establishment, or a waiter in it, using the Service. 
Payer – A User of the Service who has the right to make money transfers using the Service's functionality.
Recipient – a registered User of the Service who can receive money transfers from Payers.
Operator - an organization that provides the Service.
1.3. Personal Data – any information about the User obtained during the use of the Service.
1.4. The online payment system is a partner of the Service that provides the possibility of making a non-cash transfer of funds from the Payer to the Recipient.

2. General provisions
2.1. This Policy applies to all information that can be obtained about the User during the use of the Service.
2.2. The User must read this Policy before using the Service and accept this Policy in accordance with the procedure specified in clause 3.4 of this Policy. By accepting the Policy, the User expresses unconditional consent to the provision of Personal Data and their subsequent processing by the Operator. Failure to comply with the terms of this Policy means that you will not be able to use the Service.
2.3. The Service may contain links to third-party sites and automatically navigate to third-party sites. The operator is not responsible for the confidentiality of Personal Data when accessing such sites or interacting with third-party services. The user must familiarize himself with the Personal data processing policy of such sites and services.
2.4. Personal data is processed in accordance with the laws of Indonesia.

3. Processing of personal data
3.1. In order to provide the User with access to the use of the Service, the Operator processes Personal Data, including through their collection, recording, systematization, accumulation, storage, clarification, extraction, use, transfer, depersonalization, blocking, deletion and destruction of the User's Personal Data.
3.2. The User agrees that the Operator has the right to transfer (provide)information to the User.  Personal data of the User to third parties – Service partners. 
3.3. Any user of the Service is aware (giving his / her unconditional approval) that by not disabling the marks in the corresponding columns of the Service about the use and processing of personal data, the User agrees to the Policy.

3.4.1. To the processed Personal Data The payer includes:
•	information about the Payer's payment system (MasterCard, Visa, any other), payment type (contactless/entering card details), card mask (PAN), device type (Android/Apple), information about the institution where the transaction was made, time and amount of the transaction for the purpose of collecting analytical data for improvement and refinement The service.
•	depersonalized data (data about the user session - a sequence of requests made by the Payer during the use of the Service) obtained when accessing the Service using Internet statistics services for the purpose of collecting analytical data to improve and refine the Service
•	last name, first name
•	email addresses of mail services
•	phone numbers

3.4.2. To the processed Personal Data These include:
•	Last name, first name, of the Recipient.
•	Contact mobile phone number of the Recipient.
•	image for the Recipient's profile.
•	information about the type of device (Android/Apple), information about the institution where the Recipient receives transactions, the time and amount of transactions, information about the Recipient's card mask for the purpose of collecting analytical data to improve and refine the Service.
•	depersonalized data (data about the user session - a sequence of requests made by the Recipient during the use of the Service) obtained during access for the purpose of collecting analytical data to improve and refine the Service.

3.5. Purposes of Personal Data processing

3.5.1. Payers:
•	providing access to the Service and functioning of the Service.
•	providing customer and technical support in case of problems related to the use of the Service;
•	Service management, administration, improvement, refinement, and technical support;
•	other goals that do not contradict the current legislation of the Russian Federation.

3.5.2. Tip recipients:
•	providing access to the Service and functioning of the Service.
•	Create an account to use the Service.
•	verification of the User's account ownership to limit abuse and violations of the User's or other persons ' rights;
•	identification of the Recipient.
•	establishing feedback for the purpose of using the Service, processing requests and requests from the User.
•	sending notifications and requests regarding the use of the Service and its functioning.
•	providing customer and technical support in case of problems related to the use of the Service;
•	other goals that do not contradict the current legislation of the Russian Federation.

3.6. The Operator takes technical, organizational and legal measures to ensure the protection of the User's Personal Data from unauthorized or accidental access, deletion, modification, blocking, copying and distribution of Personal Data. 
3.7. The term of Personal Data processing is unlimited. The User can withdraw their consent to the processing of Personal Data at any time by sending a notification to the Operator at the email address indicated on the site.
3.8. If the User withdraws consent to the processing of Personal Data, the Operator has the right to continue processing Personal Data without the User's consent, if there are grounds provided for by the legislation of the Russian Federation.
3.9. The Operator has the right to delete the User's account or information posted by the User, thereby stopping the processing and storage of the User's Personal Data. The Operator is not obliged to disclose to the User the reasons for such deletion of the User's Personal Data.

4. Final provisions
4.1. The law of the Russian Federation applies to this Policy and relations with the User in the field of Personal Data.
4.2. The Policy may be changed by the Operator by posting a new version of the Policy on the website. Changes to the Policy made by the Operator will take effect on the day when the new version of the Policy is published.