Mahaja Group · PT Duta Selera Pertiwi

Privacy Policy

Last updated: 6 October 2026

This policy explains what data is collected, why, and how we protect it, on this website, in the Mahaja POS, Mahaja Office and Mahaja TEAM apps and in Mahaja Group’s internal services. We comply with Indonesia’s Personal Data Protection Law (Law No. 27 of 2022).

1. This website

mahajagroup.com uses no accounts, forms, cookies, advertising or analytics trackers, and our servers keep no visit logs. The site is delivered through the Cloudflare network, which may process technical data (such as IP addresses) for security. Website fonts are loaded from Google Fonts.

2. The Mahaja POS app

Mahaja POS is published by PT Karsa Indriya Paramita for use by staff in Mahaja Group restaurants (waiters and cashiers). It is not intended for the public and only works after a device has been paired by a restaurant cashier. Data processed by the app is stored on Mahaja Group servers.

• Accounts: accounts are created by the company for staff (user ID and PIN). The app does not offer sign-up.
• Order data: table, items, quantities, notes, times and the waiter’s name, to process restaurant orders and payments.
• Guest data (optional): a guest’s name and phone number if the guest provides them, for orders and reservations.
• Camera: used only to scan a QR code when pairing the device. Images are not stored or sent.
• Device token: a random code that identifies a paired device, stored on the device and on our servers, revocable at any time by the cashier.

The app does not collect location, contacts or advertising data, or anything beyond restaurant work, and contains no third-party trackers.

3. The Mahaja Office app

Mahaja Office is published by PT Karsa Indriya Paramita for Mahaja Group management (owners, directors, finance, restaurant managers, cost control). It opens the company back office and can only be used by accounts invited by an administrator. There is no self sign-up.

• Accounts: name, email or user ID, role and permitted outlets, created by a company administrator.
• Registered devices: a random device token, device name/type, IP address and last-used time, for password-free sign-in and so an administrator can revoke a lost device.
• Sign-in and change logs: time, IP address and browser of each sign-in attempt, plus records of data changes, for security and audit.
• Fingerprint / PIN lock: uses the phone’s own screen lock. Fingerprint or face data is never received by the app or our servers.
• Supervisor Code: for assigned supervisors, the secret that generates 6-digit codes is stored encrypted on the phone (Android Keystore) and removed when the device is revoked.
• Camera: only to scan an invitation QR code through the Google Play services scanner. Images are not stored or sent.

Business data shown (sales, closings, purchases, reports) belongs to the company. All connections use HTTPS. The app does not collect location, contacts or advertising data and contains no third-party trackers.

4. The Mahaja TEAM app

Mahaja TEAM is published by PT Karsa Indriya Paramita for Mahaja Group employees. It is separate from Mahaja Office: it runs on its own server and cannot open company business data. It only shows the employee’s own data.

• Sign-up: employee number and date of birth are matched against company HR records and approved by HR. The date of birth is used only for matching and is not stored again.
• Registered devices: a random device token, device type, IP address and last-used time, for password-free sign-in and so HR can revoke a lost device.
• Attendance: clock-in, break and clock-out times from the outlet attendance machine, only the employee’s own.
• Requests: leave, permission, sick leave and days off with their reasons, read by the restaurant manager and HR to decide.
• Notifications: a device notification token to deliver announcements and request decisions.

The app does not collect location, contacts, photos or advertising data and contains no third-party trackers.

5. Staff attendance

For attendance we may use face recognition on official restaurant tablets. Facial (biometric) data is processed only with the employee’s written consent, used solely to record attendance, stored on company servers, and deleted at the employee’s request or when consent is withdrawn.

6. Reservations and events

For reservations we record name, phone number, organisation, party size, menu and proof of deposit payment, to prepare the event and issue invoices.

7. Storage, security and sharing

• Data is stored on company-owned servers with restricted access and daily backups. Access from outside the restaurant network always uses encrypted connections (HTTPS).
• We never sell personal data. Data is shared only where required by law (for example tax) or with service providers bound by confidentiality.
• Transaction records are kept for as long as tax and accounting regulations require.

8. Your rights

You may request access to, correction of, or deletion of your personal data, and withdraw consent. Staff may request deletion of their app account and data through HR or the email below. We respond within 3 working days.

9. Children

Our services are not directed to children under 18 and we do not knowingly collect their data.

10. Contact

PT Karsa Indriya Paramita, Jl. Budisari Raya No. 6, Bandung 40141 · publisher of the Mahaja POS, Mahaja Office & Mahaja TEAM apps

PT Duta Selera Pertiwi (Mahaja Group) · restaurant operator

Email: [email protected]

Any change to this policy will be published on this page with its update date.