Skip to content

Privacy Policy

Last updated: 9 October 2026

Selsol Indonesia ("we") respects your privacy and is committed to protecting your personal data in accordance with Law No. 27 of 2022 on Personal Data Protection (UU PDP).

1. Data We Collect

  • Identity data: name, email address, phone/WhatsApp number.
  • Date of birth (only to check the minimum age of 18).
  • Sign-up reference code (for example a code from a flyer or link, to know how you found Pasarol).
  • Account data: username, password (encrypted), role (buyer/seller).
  • Listing data: title, description, price, photos, and location you upload.
  • Verification data (optional): KTP/business documents - encrypted and deleted after verification.
  • Business data (Business-type sellers only): Business Registration Number (NIB) - encrypted (AES-256); business address (province, city, sub-district, street address) - used as the default location for your new listings, changeable per listing at any time.
  • Technical data: IP address (hashed for view logs), device, and on-site activity.
  • Complaint data: if you submit the Consumer Complaint form, we store your name, email address and the text of your complaint (and a link to your account if you are signed in), together with our replies. We give you a reference number and send a short confirmation email that contains only that reference number.

We process data based on your consent and to deliver our services: creating an account, publishing listings, facilitating buyer-seller communication, processing payments for paid features, preventing fraud, and complying with legal obligations. NIB and business address are processed specifically to fulfill business-operator verification obligations under Minister of Trade Regulation No. 19 of 2026.

Consent is given explicitly at registration (the checkbox is not pre-ticked). The time of consent is recorded. You may withdraw consent at any time by contacting us (see Section 6).

4. Data Sharing

We do not sell your personal data. Data is shared with the following third parties, as needed to provide our service:

  • Midtrans & Xendit (payment providers) - transaction data to process payments for paid features.
  • Google (Sign in with Google, optional) - if you choose "Sign in with Google", your Google name, email, and profile photo are shared with Pasarol to create/link your account. Processed on Google's servers (abroad).
  • Fonnte (WhatsApp verification & notifications) - your WhatsApp number is sent to Fonnte to deliver OTP verification codes and account/listing-related notifications.
  • hCaptcha (anti-bot protection) - browser interaction signals (not personal content) are sent to hCaptcha when registering/logging in to prevent automated/fake sign-ups. Servers located abroad.
  • Gravatar (profile photos) - your email address is hashed and sent to Gravatar (Automattic) to display a profile photo, if you have one registered there.
  • Microsoft Clarity (behavioral analytics, optional) - only if you consent via the cookie banner ("Accept All"). Behavioral data is pseudonymized, not fully anonymous - see Section 7.
  • Matomo (analytics, self-hosted) - runs on our own servers; data is NOT sent to any third party for this analytics.
  • OpenStreetMap / Nominatim (maps & location search) - when you search for an address on the listing form or view a listing's location map, the request is sent to the OpenStreetMap mapping service (third party, no API key/account required).
  • Authorities, where legally required.

Contacting a seller via the "Chat WhatsApp" button opens your own WhatsApp app - Pasarol does not send your data to WhatsApp; the message is sent directly from your device once you press send.

A seller's WhatsApp number is only shown according to the visibility preference they set.

5. Storage & Security

Verification documents and NIB are encrypted (AES-256) - verification documents are deleted after the verification decision. Security logs are kept for at most 1 year, other logs for 90 days, then archived with IP anonymised. Passwords are never stored in plain text. Your complaint is received by the Pasarol support team by email and can be read by authorised Pasarol administrators. Complaints are kept for up to 24 months after the complaint is closed and are then deleted automatically. If you delete your account, the name and email on your complaints are cleared and the link to your account is removed, but the complaint itself is kept until the retention period ends; the text you wrote may still contain information about you.

6. Your Rights as a Data Subject

Under UU PDP, you have the right to: access, correct, update, and erase your data, withdraw consent, and request a copy of your data (portability). You can download your data yourself through the "Download my data" feature in your profile. To request correction or deletion of your account and data, contact us at the address in Section 8; we will verify your identity first and reply as soon as possible. Some records may have to be kept (for example order and complaint records); when we reply, we explain what we keep and why. Complaints you submitted while signed in are included in "Download my data". For complaints submitted without an account, contact us quoting your reference number; we will verify the request through the email address recorded on that complaint.

7. Cookies

We use cookies for the login session and the language preference (pasarol_lang). We do not use IP geolocation to determine language. If you consent via the cookie banner, we also use cookies from Microsoft Clarity and Matomo for analytics - see Section 4 for the third parties involved and your choices (Essential Only / Reject All / Accept All, changeable any time via the "Cookie preferences" link in the footer).

8. Contact

For privacy questions or data-rights requests, contact: [email protected].

Children and date of birth

Pasarol is intended for users aged 18 and over and does not knowingly collect personal data of children (anyone under 18). At sign-up we ask for your date of birth to check the minimum age. The date of birth is used only for the age check, can be seen only by you and Pasarol administrators, and is deleted with your account. If a sign-up is refused because of age, we do not keep your email or date of birth; we only record the number of refusals anonymously. If you entered your date of birth wrongly, contact [email protected] from your account's email address.

A child's personal data is specific personal data under Law No. 27 of 2022. If we learn that we have processed a child's personal data, we will deactivate the account and delete the related personal data, except data we are required to keep under law.

A parent or guardian who believes their child has created a Pasarol account can contact [email protected]; we will verify the request and follow up.

Use of Content for Promotion

Pasarol may use your listing content (photos, title, price, and location) to promote the marketplace on its official social media channels. This use, your consent, and how to withdraw it are described in full in section 7.5 of our Terms & Conditions. You can withdraw consent at any time in Profile > Promotion Preferences.

Data Controller

The data controller is Selsol Indonesia. For privacy questions or data-subject requests (access, correction, erasure, portability), contact [email protected]. Website: www.pasarol.com.