HotelierHub Privacy Notice (Pemberitahuan Pelindungan Data Pribadi)
Version 1.1.1. Effective on the Go-Live Date: 8 November 2026.
Language: This notice is published in Bahasa Indonesia and English. If they differ, the Indonesian text applies. The English text is a courtesy translation of `PRIVACY-POLICY-v1.1-ID.md`.
1. Who we are
HotelierHub is run by Suparyanto, an individual ("we"), domiciled in Jakarta, Indonesia. We are the data controller (Pengendali Data Pribadi). NIB: in process. Electronic system operator (PSE) registration: in process. Job portal permit (Sertifikat Standar): in process.
Person responsible for data protection: Suparyanto. Privacy contact: privacy@hotelierhub.id.
2. What we collect, and where it comes from
From you: name, email, password (stored as a one-way hash); profile: current or last position, skills, certifications, availability, city, work history, optional photo, chosen 3D character, optional reference contacts; applications and cover letters; messages; your consent choices.
From your use of the service: last active time, device and browser type, truncated or hashed IP address, security logs, reports you make or that are made about you.
Hotels: company details, logo, banner, address, staff accounts (name, work email, role).
From other sources:
- Featured jobs: we may write a short summary of a public job advertisement and hold the employer's contact email that was published with it. We use it only to invite the employer to claim the listing. It is never shown to users.
- Reference contacts: if you type another person's name and contact as a reference, you must have their permission. We tell that person within 30 days if we contact them.
We do not ask for KTP, religion, health or other sensitive data. Please do not put them in your profile or CV. We do not use your photo for face recognition.
3. Why we use it, and on what legal basis
| Purpose | Data | Basis |
|---|---|---|
| Create your account, let you apply, message, and run the hotel service | account, profile, applications, messages | Contract (UU 27/2022 Pasal 20(2)(b)) |
| Show you in the talent pool | profile snapshot | Your explicit consent (optional) |
| Job alerts by email | email, preferences | Your explicit consent (optional) |
| Keep the platform safe: stop fake accounts, scams and abuse; moderate reports | security logs, reports | Legitimate interest (Pasal 20(2)(f)); we keep a written balancing note, which you may ask us to explain |
| Tax, accounting and legal duties | hotel billing records | Legal obligation |
| Check that apply-limits and skills-match rules work | profile skills | Contract |
Automated decision. The Apply button is locked until your profile contains a skill that matches the job, and there is a daily apply limit. This is automatic. We show you which skill is missing and how to fix it. You may object and ask a person to review: privacy@hotelierhub.id.
4. Who sees your data
- The public and logged-out visitors: job listings only, never seeker profiles.
- Hotels without a pass (talent pool, only if you opted in): your 3D character, position (current or last), skills, availability and city (never your address or district).
- Hotels with a pass (talent pool, only if you opted in): also your name, photo and CV, and they can message you through HotelierHub.
- A hotel you apply to: your name, photo, profile, CV and cover letter. Never your email or phone. For a featured job whose hotel has not joined yet, your application is shown only after we verify and approve the hotel's claim.
- We never show your email or phone to hotels. We automatically block email and phone patterns in profile text, but cannot guarantee this for every free-text field; do not type contact details there.
- Hotels are separate controllers of what they receive and are bound by our employer terms (hiring use only, no sale, no copying, deletion when the hiring need ends).
- Service providers (processors) for hosting, storage and email process data only on our instructions under written agreements. Providers: hosting and storage: Hostinger; email: Brevo.
- Authorities when the law requires, and a buyer if the business is transferred (we will tell you first).
- We never sell personal data.
5. How long we keep it
| Data | How long |
|---|---|
| Talent pool membership and snapshot | Shown for 90 days (reminder on day 76, one-tap renew). Deleted at day 90. Deleted at once if you leave or withdraw consent |
| Account and profile | Until you delete your account, or after 24 months without login (we email you first and delete 30 days after the notice) |
| Applications and cover letters (your history) | Until your account is deleted |
| What a hotel saw when you applied | Hotel view ends 30 days after you apply; the frozen copy is deleted within 90 days after that. A hotel keeps only what it saved itself, as its own controller |
| Messages | Until 12 months after the last message, or until account deletion |
| "Deleted applicant" record | See section 6; deleted 12 months after the job closes |
| Featured-job employer email | Until the hotel claims, asks us to remove it, or 60 days |
| Security logs | 12 months (IP address truncated or hashed) |
| Proof of your consent and acceptance (hashed id, policy version, time, choices) | 24 months after you delete your account |
| Deletion record (hashed id) used to re-delete data after a backup restore | 35 days |
| Hotel invoices, contracts and customer records | 10 years (financial transaction data) and 5 years (other transaction data), as the law requires. These can't be erased on request while the law requires keeping them |
| Backups | Roll off within 30 days |
Deletion. When you delete your account, we erase your data from live systems within 7 days and from backups within 30 days, and send you a notice within 3x24 hours before or after the deletion. If a backup is restored, we delete your data again.
6. The "Deleted applicant" record
When you delete your account, a record stays in the hotel's own application history. It shows only the job, the month you applied and the last status. It has no name, photo, contact details, CV, cover letter or messages, and is not linked to your account. A very small hotel might still guess who it was; if a hotel has very few applications we show only a count instead.
7. Your rights
Under UU 27/2022 and PP 33/2026 you may: be informed; access and get a copy; correct or complete; withdraw consent; ask us to stop, restrict or delete; object to automated decisions; move your data; complain; and claim damages for a violation (Pasal 12).
Timing: we correct data, give access, stop processing after you withdraw consent, and restrict processing within 3x24 hours of a verified request. We may ask you to confirm who you are. Most rights are in Profile > Privacy (hotels: Account > Privacy); otherwise write to privacy@hotelierhub.id.
Complaints: write to us first. You may also complain to the Ministry of Communication and Digital (Komdigi) and, once it exists, the personal data protection agency (Lembaga PDP), and go to court.
8. Security
HTTPS, one-way password hashing, role-based access, private file storage, two-factor login for administrators, separate access for hotel-facing data. If a breach affects you, we notify you and the authority in writing within 3x24 hours, with what happened, what data, and what to do.
9. Cookies
Only necessary cookies for login and settings (for example dark mode). Analytics only if you agree; there is none at launch.
10. Children
18 and over only. If we learn that someone is under 18, we close the account and delete the data.
11. Where your data is stored
In Indonesia Hostinger, Indonesia. We do not routinely send personal data abroad. Email delivery uses Brevo, which receives your email address and a template identifier only, under a written agreement; Brevo may process that email address outside Indonesia (in the European Union). We will tell you before any change to this.
12. Changes
We publish a new version and date and tell you before a change takes effect (14 days for notice-only changes). For large changes we ask for your consent again at your next login.
Consent screen (checkboxes, all unticked)
- [required] I am 18 or older.
- [required] I agree to the Terms of Use, and I have read the Privacy Notice.
- [optional] Add me to the talent pool. Hotels without a pass see my 3D character, position, skills, availability and city. Hotels with a pass also see my name, photo and CV and can message me. Lasts 90 days; I can leave any time.
- [optional] Send me job alerts by email.
We store the version, time and your choices as proof.