Privacy policy

Pasaran Marketplace is the controller of the personal data described here. This policy covers everyone who uses pasaran.id — buyers, sellers, business members and visitors who never create an account.

It sits alongside the cookie policy, which explains the small files set in your browser, and the terms of service, which explains the agreement itself. Where a feature handles data differently, that difference is described in the section covering the feature.

We collect only what a marketplace needs to work. Most of it comes directly from you; some is generated as you use the site.

• Account data — name, email address, mobile number, password hash, chosen language and currency, and your profile photo and introduction if you add them.
• Verification data — the identity document you upload, the selfie used to compare with it, and for business accounts the registration, deed and tax documents.
• Listing and transaction data — the listings you publish, offers made and received, appointments, orders, invoices and dispute records.
• Communications — messages between members, support tickets, reports you file about a listing or a person, and reviews you write.
• Technical data — IP address, device and browser type, approximate location derived from the IP address, and the pages and searches within a session.
• Payment data — the last four digits, card type and expiry of a saved method. Full card numbers are handled by our payment partner and never reach our servers.

Every use below is tied to a purpose. We do not sell personal data, and we do not share it with advertisers to build profiles of you across other websites.

• To run the service — showing listings, delivering messages, processing orders and issuing invoices.
• To keep the marketplace safe — verifying identity, detecting fraudulent listings and duplicate accounts, and investigating reports.
• To improve what we build — aggregated analysis of which searches fail, which filters go unused, and where people abandon a flow.
• To communicate with you — transactional email and SMS about your account, and marketing messages only where you have opted in.
• To meet legal obligations — tax records, responses to lawful requests, and retention of transaction records.

Identity documents are used only to confirm that the person behind an account is who they say they are, and to screen for fraud. They are never shown on your public profile, never shared with another member, and never used for advertising.

Under Indonesian personal data protection law we rely on one of four bases. Performance of a contract covers everything needed to give you the service you asked for. Legal obligation covers tax, accounting and lawful requests.

Legitimate interest covers fraud prevention, service security and product analytics, balanced each time against your interests. Consent covers optional things — marketing email, non-essential cookies and precise location — and you can withdraw it at any time without affecting the rest of the service.

Your public profile shows your display name, photo, area, languages, the year you joined, your active listings, your response rate and typical reply time, and any verification badges you have earned. Reviews you leave appear under that name.

Your email address, phone number and identity documents are never published. A buyer only sees your phone number if you enable phone or WhatsApp contact on a listing, and even then it is shown on request rather than crawled into search results.

We share personal data with service providers who process it on our instructions, under written contracts that forbid using it for anything else.

• Payment processing and escrow — to take payment, hold funds and issue refunds.
• Identity and business verification providers — to check documents and screen against sanctions and fraud databases.
• Cloud hosting, email and SMS delivery — infrastructure needed to run and to reach you.
• Professional advisers, auditors and, where legally required, law enforcement and regulators.

If Pasaran is ever sold or merged, personal data may transfer with the business. You would be told before that happened and this policy would continue to apply until a replacement was published.

Our primary systems are hosted in Indonesia and Singapore. Some providers process data in other jurisdictions; where they do, the transfer is covered by contractual protections that require an equivalent standard of protection to the one applied here.

We keep data only while there is a reason to. When the reason ends, the record is deleted or irreversibly anonymised.

• Account records — while the account is open, then 90 days after closure to allow recovery and to settle disputes.
• Identity document images — deleted once the verification decision is made. We keep the outcome, the document type and the date, not the file.
• Listings — 12 months after removal, so that a dispute about a past sale can still be investigated.
• Message threads — 24 months after the last message, or longer where a dispute or a report is open.
• Transaction and invoice records — 10 years, as required by Indonesian tax and accounting rules.
• Technical logs — 12 months, after which they are aggregated into counts that identify nobody.

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing we base on legitimate interest. You can also withdraw consent for marketing or optional cookies at any time.

Most of these are self-service: profile data is editable in account settings, marketing preferences are in notification settings, and a full export can be requested from privacy controls. For anything else, write to us and we will answer within 30 days. If you are not satisfied with our answer, you may complain to the Indonesian data protection authority.

Data is encrypted in transit and at rest. Access to production systems is restricted to the small number of staff who need it, protected by two-step verification, and logged. Verification documents sit in separate storage with a shorter retention clock and their own access controls.

No system is perfect. If a breach occurs that is likely to create a real risk to you, we will tell you and the regulator without undue delay, describing what happened, what data was involved and what we are doing about it.

Pasaran is not for people under 18. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will close it and delete the data.

We update this document when what we do changes. The date at the top always reflects the current version, and material changes are announced by email and on-site at least fourteen days before they take effect.

Questions, requests and complaints about privacy can be sent to our privacy team using the contact details at the end of this page. Please tell us the account email address so we can find your records.