Privacy Policy

FISTA MFA (Merchandise Force Automation)
Last updated: September 11, 2026

This Privacy Policy explains how PT Karya Solusi Pintar (“Company”, “We”, “Us”, or “Our”) collects, uses, stores, discloses, and protects Personal Data when an authorized user uses FISTA MFA (the “Application” or “Service”).

FISTA MFA is an enterprise merchandise force automation application used to support field operations, including customer check-in, customer-location verification, merchandise surveys, operational documentation, and activity updates.

We process Personal Data only as reasonably necessary for the purposes described in this Privacy Policy and in accordance with applicable privacy and data-protection laws. Where permission or consent is required, We request it before accessing the relevant device feature or information.

1. Interpretation and Definitions

Application

“Application” means FISTA MFA, the mobile application provided by PT Karya Solusi Pintar.

Company

“Company”, “We”, “Us”, or “Our” refers to PT Karya Solusi Pintar, 110A Jl. Raya Margorejo Indah, Kel. Margorejo, Kec. Wonocolo, Kota Surabaya, Jawa Timur 60238, Indonesia.

Customer Company

“Customer Company” means the company or organization that authorizes its personnel to use FISTA MFA for merchandise and field operations.

Personal Data

“Personal Data” means information relating to an identified or identifiable individual.

Service Provider

“Service Provider” means a third party that processes data on behalf of the Company to host, secure, support, communicate through, or otherwise operate the Service.

User

“User” or “You” means an individual authorized by a Customer Company to access and use FISTA MFA.

2. Information We Collect

2.1 Account and Employment-Related Information

Depending on the configuration of the Customer Company, We may process information required to identify and authorize a User, such as:

• Name, username, employee number, or other account identifier.
• Email address and/or phone number, where required.
• Customer Company, team, territory, role, and access rights.
• Authentication, session, and account-status information.

2.2 Customer Check-In and Merchandise Survey Information

To provide core field-operation functions, We may process:

• Assigned customer, store, outlet, or visit information.
• Customer check-in and check-out records and timestamps.
• Merchandise survey responses, notes, and completion status.
• Photos or documents submitted as customer check-in or merchandise survey documentation.
• Other operational records submitted through the Application.

2.3 Location Information

When You initiate a feature that needs location and grant permission, FISTA MFA may access precise location information, such as GPS coordinates, while the Application is in use. We use it to verify the customer location during customer check-in and merchandise surveys and to associate an operational activity with a location and timestamp.

The Application requests location access in the context of the relevant feature. You may deny or later disable location permission in iOS Settings. If permission is unavailable, the Application should remain usable, but check-in, survey, or verification features that require location may be limited or unavailable.

2.4 Camera

When You choose to capture documentation, FISTA MFA may request access to the camera to support customer check-in and capture photos for merchandise survey documentation.

Submitted images may be associated with the relevant User, Customer Company, customer or store, check-in or survey record, timestamp, and location where applicable. You can manage camera access in iOS Settings. Denying access prevents the relevant capture function but should not cause the Application to crash.

2.5 Notifications

With Your permission, FISTA MFA may send push notifications containing information and updates about operational activities. To provide this function, We and Our notification Service Providers may process a device or application-instance token, notification-delivery data, and related technical information.

You may deny or later disable notifications in iOS Settings. Denying notification permission does not prevent You from using the Application, but You may not receive timely activity information or updates.

2.6 Device, Technical, and Usage Information

We may process technical information needed to operate, secure, troubleshoot, and improve the Service, including device type, operating-system and Application version, device or installation identifiers where necessary, access timestamps, server logs, and crash or performance diagnostics where collected.

3. How We Use Personal Data

We may use Personal Data to:

• Authenticate Users and manage authorized access.
• Provide customer check-in and check-out functions.
• Verify customer locations during relevant field activities.
• Conduct and document merchandise surveys.
• Capture, upload, store, and associate photos with operational records.
• Provide operational information and updates by notification.
• Synchronize records with the Service and make them available to the Customer Company and its authorized personnel.
• Provide support and respond to requests.
• Protect the security, integrity, availability, and performance of the Service and troubleshoot technical problems.
• Comply with legal obligations and enforce applicable agreements.

4. Legal Basis and Device Permissions

Depending on the processing activity and applicable law, Personal Data may be processed to provide the requested Service, perform a contract, pursue legitimate operational or security interests, comply with a legal obligation, or on the basis of consent where required.

iOS permission prompts control access to sensitive device features but do not by themselves describe every legal basis for processing. Where We rely on consent, You may withdraw it through iOS Settings or by contacting Us. Withdrawal does not affect processing already performed lawfully and may limit functions that need the relevant permission.

Permission summary

• Camera: customer check-in and merchandise survey photo documentation.
• Location while using the Application: customer location verification during check-in and merchandise surveys.
• Notifications: operational information and activity updates.

5. How We Disclose Personal Data

We do not sell Personal Data. We may disclose Personal Data only as reasonably necessary for the following purposes.

5.1 Customer Companies and Authorized Personnel

Because FISTA MFA is an enterprise application, operational records may be available to the Customer Company that authorized the User and to its authorized supervisors, administrators, or other personnel, according to their roles and access rights.

5.2 Service Providers

We may use Service Providers for hosting, infrastructure, storage, security, push notifications, technical support, and diagnostics. They may process Personal Data only to perform services for Us and must protect it as required by contract and applicable law.

5.3 Legal Requirements and Business Transfers

We may disclose Personal Data where required by applicable law, a valid court or government request, or where reasonably necessary to protect Users, the Company, property, legal rights, or the security of the Service. Personal Data may also be transferred as part of a merger, acquisition, restructuring, financing, or sale of assets, subject to applicable law and appropriate safeguards.

6. Tracking, Advertising, and Sale of Data

FISTA MFA is an enterprise operational application. We do not sell Personal Data and do not use Personal Data for third-party advertising or cross-app advertising tracking as part of the Service. If these practices materially change, We will update this Privacy Policy and the applicable App Store privacy disclosures before the change takes effect where required.

7. Data Retention

We retain Personal Data only for as long as reasonably necessary to provide the Service, meet Customer Company and contractual requirements, maintain security and operational records, comply with legal obligations, and establish, exercise, or defend legal claims.

Retention periods may differ by category and deployment. Account, check-in, location, merchandise survey, photo, notification, and technical records may be retained in accordance with the Customer Company’s instructions, applicable agreements, applicable law, and the Company’s documented retention schedule. Data in backups may remain until the relevant backup is overwritten or securely deleted. When Personal Data is no longer required, We delete or anonymize it in accordance with applicable requirements.

8. Your Privacy Rights and Choices

Subject to applicable law, You may have rights to request access to, correction of, deletion of, restriction of, or information about the processing of Your Personal Data, and to withdraw consent or object to certain processing.

You may manage camera, location, and notification permissions through iOS Settings. If a required permission is denied, FISTA MFA may explain which feature is affected and direct You to Settings to enable it. Features unrelated to that permission should remain available.

To exercise a privacy right, contact Us at support@sentia.id. Because the Customer Company may administer Your enterprise account and determine how operational data is used, We may need to verify Your identity and coordinate the request with the Customer Company. A request may be limited where retention is required by law or necessary for security, legal claims, or another lawful purpose

9. Data Security

We use reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, loss, or destruction. Measures may include encrypted communications, authentication, role-based access controls, secure credential handling, and other safeguards appropriate to the Service. No transmission or storage method is completely secure, so We cannot guarantee absolute security.

10. International Data Transfers

Personal Data may be processed in Indonesia or another jurisdiction where the Company, Customer Company, or authorized Service Providers operate. Where applicable law requires safeguards for an international transfer, We will implement appropriate safeguards and supplementary measures as required.

11. Children’s Privacy

FISTA MFA is an enterprise workforce application and is not directed to children. We do not knowingly collect Personal Data from children through the Service. If You believe a child has provided Personal Data through FISTA MFA, please contact Us so We can take appropriate action.

12. Links to Other Services

The Service may contain links to services not operated by Us. Their privacy practices are governed by their own policies. We encourage You to review the privacy policy of any third-party service You access.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, Our data practices, or applicable requirements. We will update the “Last updated” date and provide additional notice of material changes where required by law.

14. Contact Us

If You have questions, concerns, or requests concerning this Privacy Policy or Your Personal Data, contact Us: