Last updated September 14, 2026
What we collect, on what basis, how long we keep it, and what rights you have over it. This policy forms part of the Terms & Conditions. This English text is a translation; the Indonesian version is the operative one.
Gearkeun is the data controller for personal data processed through the Platform, within the meaning of Indonesian personal data protection law.
Our identity and full address are on the Contact page, and requests about personal data are made there.
Only what running a transaction needs:
We process personal data on these bases:
A seller page shows only name, city and buyer rating. Email, phone, WhatsApp and account numbers are never shown to other Users. That restriction is enforced at the database level, not just in the interface.
A delivery address is shown to the Seller on that order, because the Seller ships. They cannot see your other addresses.
On a return it runs the other way: the Seller's origin address is shown to the Buyer on that order, because the Buyer calls the courier and sticks on the return label.
Communication between Buyer and Seller runs through Gearkeun. We do not share direct contact details.
Account numbers are shown as the last four digits only, including to their owner.
We share data only as far as these require:
Data is stored with a cloud provider whose data centre is in Singapore.
Indonesian personal data protection law permits transfer abroad where the destination has an equivalent level of protection or adequate contractual safeguards exist. We rely on a data processing agreement with that provider as the safeguard.
Retention follows need and legal obligation:
Under Indonesian personal data protection law you may:
Some data cannot be deleted on request: transaction records that electronic commerce and tax regulation require us to keep.
So an account that has held listings or orders cannot be deleted in full. What we do is deactivate it and delete what we are not required to keep, while the transaction records remain until their period ends.
Order threads cannot be deleted by anyone, including us, because they are the evidence if a dispute arises. The photographs in them are removed on the schedule in section 7.
Make the request through the Contact page. We may ask for enough proof of identity to be sure the request comes from the right person.
We respond within 14 days of receiving it. If we refuse, we say why.
Access is restricted at the database level through row-level security, not only in the interface. Data other users must not see is not in a table they can read.
Uploaded photographs are re-encoded on the server to strip metadata, including the location coordinates phone cameras usually embed.
Videos and files attached in a thread or a complaint are stored as they are, so any metadata in them, including where they were recorded, is not removed. Strip it before uploading if you do not want to share it.
Account numbers are shown as the last four digits only. The full value is used only at disbursement.
No system is completely secure. We do not promise absolute security; we set out what we do so you can judge it.
If personal data protection fails, we notify you and the supervisory authority within 3 times 24 hours of becoming aware, as Indonesian personal data protection law requires.
The notice covers what data was affected, when and how it happened, and what we are doing about it.
We use the cookies the Platform needs to work: keeping you signed in and remembering your language and theme.
We use no advertising cookies and do not track you across other sites.
The Platform is not for minors and we do not knowingly collect their data.
If we learn we hold a child's data without parental consent, we delete it.
Material changes are announced on the Platform at least 7 days before they take effect.
The last update date is at the top of this page.