1. Overview & Scope

This Privacy Policy governs the data collection, processing, and protection practices of SMES Mobile (Solo Murni Enterprise System) and MGT Mobile (Solo Murni Management), collectively referred to as the "Applications". The Applications are developed, maintained, and operated by PT Solo Murni (makers of KIKY stationery products, hereby referred to as "Company", "we", "us", or "our").

The Applications are dedicated enterprise solutions designed exclusively for internal employees, field technicians, sales representatives, supervisors, branch directors, and authorized commercial partners. They are distributed via Google Play (Enterprise/Managed) and the Apple App Store (Unlisted App Distribution).

2. Regulatory & Store Compliance

This policy complies with:

• Google Play Developer Distribution Agreement and Google Play Data Safety guidelines.
• Apple App Store Review Guidelines (specifically Guidelines 5.1.1 Data Collection & Storage, 5.1.2 Data Use & Sharing, 2.1 Information Needed, and Guideline 3.2 Business).
• Applicable Indonesian Personal Data Protection laws (Undang-Undang Perlindungan Data Pribadi No. 27 Tahun 2022).

3. Information We Collect and Purpose of Use

We strictly limit data collection to what is necessary to fulfill authorized corporate workflows, track field operations, and secure enterprise communications:

Data Category	Data Elements	Operational Purpose
Account & Identity	Employee ID (NIK), Full Name, Work Email, Phone Number, Company Code, Department, Job Title	User authentication, role-based access control, company assignment, and official corporate communications.
Location Data	Precise GPS Coordinates, Coarse Location (latitude, longitude, horizontal accuracy)	Attendance geofence verification (check-in/check-out at authorized factory or office sites), and GPS tagging for retail store customer visits (NOO / CRM).
Camera & Photos	2D RGB Photographs taken within the application	Visual attendance verification selfie photos, document scans (e.g. sick leave certificates, work permits), and proof of visit merchandise display photos.
Device & Telemetry	Device Model, OS Version, App Build Version, IP Address, Session Token, Unique Device Identifier (UUID)	Preventing unauthorized device-sharing, detecting rooted/jailbroken devices, fraud prevention, and session integrity.

4. Biometric Authentication (Face ID & Touch ID / Biometrics)

For user convenience and enhanced security, the Applications offer optional biometric authentication:

• Apple iOS (Face ID / Touch ID): Implemented exclusively via Apple's official LocalAuthentication framework (LAContext.evaluatePolicy). Biometric verification is evaluated entirely by hardware inside the Apple Secure Enclave. The operating system returns only an isolated boolean confirmation (success or failure) to the application.
• Android (BiometricPrompt): Implemented via AndroidX Biometric APIs using hardware-backed KeyStore and Trusted Execution Environment (TEE).
• User Control: Biometric login is completely optional. It can be enabled or disabled at any time in the Pengaturan (Settings) screen. On the login screen, biometric authentication is triggered strictly upon manual user tap of the Face ID / Biometric button and does not auto-prompt.

5. Camera Usage & Photos Disclosure

When you grant the Applications permission to access your device camera:

• The camera is used solely to capture standard 2D photographs for operational records (attendance selfies, physical store visit evidence, and document attachments).
• The camera never uses TrueDepth APIs, facial recognition mapping, ARKit, or biometric scanning algorithms. Captured images are treated as standard static image files (JPEG/PNG).
• Photos are transmitted securely over TLS 1.3 encryption directly to PT Solo Murni's private enterprise servers and are never shared with advertising networks or social media platforms.

6. Location Data Disclosure

Location information is accessed only while using the application (foreground) when explicitly triggered by a workflow action:

• Attendance Validation: When an employee taps Check-In or Check-Out, the device's location is queried to verify proximity to the designated company facility radius.
• Store Visit Validation: When a sales representative checks in at a retail partner or customer location, GPS coordinates are recorded to document the visit.
• No Continuous Background Tracking: The Applications do not track your location continuously in the background when the app is closed. Location data is never sold, shared with advertising brokers, or used for third-party analytics.

7. Data Retention and Account / Data Deletion Rights

In compliance with Google Play Data Safety policies and Apple App Store Guideline 5.1.1(v), users have full control over their personal data:

How to Request Data Deletion:

1. Send an email from your registered corporate or personal email address to: itsm@kiky.co.id
2. Specify the Subject Line: [Data Deletion Request] - Employee NIK / Username
3. Include your Full Name, Employee NIK, and Company Code in the body of the message.

Processing Timeline: Our IT team will verify and process your deletion request within 14 business days. All personal data, session tokens, and uploaded profile photos will be permanently expunged from active operational databases, except for statutory accounting and employment records required by Indonesian labor and tax regulations.

8. Third-Party Services & Data Sharing

We do not sell, rent, or trade your personal data. Data is shared only with trusted operational providers necessary for infrastructure and mobile runtime:

• Google Play Services: Used on Android for core platform APIs and map rendering (Google Privacy Policy).
• Apple Core Location & LocalAuthentication: Native on-device operating system services (Apple Privacy Policy).

No third-party advertising SDKs, tracking pixels, or cross-app data brokers are embedded in the Applications. The Applications do not request permission to track across third-party apps and websites.

9. Security Safeguards

We implement robust technical and organizational security measures to protect corporate data:

• End-to-end transport layer encryption (TLS 1.3) with TLS certificate pinning for all API endpoints.
• AES-256 cryptographic encryption for sensitive local credentials stored in device keychains.
• Role-based access controls and least-privilege administrative access policies.
• Routine vulnerability scanning and OWASP MASVS compliance verification.

10. Children's Privacy

The Applications are designed strictly for enterprise workplace administration and are intended exclusively for individuals of legal working age. We do not knowingly collect or solicit personal information from children under the age of 13. In the event that we learn that an account has been created by a minor, we will immediately purge such data from our systems.

11. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect enhancements in application functionality or regulatory requirements. Any modifications will become effective immediately upon posting to this URL. Users will be alerted to material updates via internal enterprise notification channels.

12. Contact Information

For questions, inquiries, or data access/deletion requests regarding this Privacy Policy, please contact:

• Organization: PT Solo Murni (IT Department)
• Email: itsm@kiky.co.id
• Brand: KIKY Stationery
• Headquarters: Surakarta, Central Java, Indonesia
• Website: https://kiky.co.id