Acceptable Use and Prohibited Business Policy

1. Scope

This Policy applies to anyone who uses Baiyar's Service for business purposes, including to:

• create and manage a business account or profile;
• create and use a Payment Link or Checkout;
• use Baiyar's API or integration services;
• receive payments from a Customer;
• offer or sell products or services;
• manage Transactions through the Baiyar dashboard; or
• use the Service on behalf of another party.

2. Definitions

In this Policy:

• Baiyar means the payment technology service operated by PT Digital Platform Nusantara, including the dashboard, Payment Link, Checkout, API, and other related services and features.
• Business Partner means an individual or business entity that uses or has access to Baiyar's Service for business purposes.
• Customer means a party that makes a purchase or payment through Baiyar's Service.
• Service means the products, features, systems, and services Baiyar provides from time to time.
• Payment Provider means a bank, payment service provider, payment network, or other payment service used to process Transactions through Baiyar.
• Transaction means a payment or commercial transaction processed using the Service.
• Prohibited Business means a business activity or use of the Service that is prohibited under this Policy, applicable law, or the requirements of a party involved in providing the Service.
• Restricted Business means a business activity or use of the Service that may require additional review, documentation, approval, or requirements before it can be processed through Baiyar.

3. Acceptable Use Principles

A Business Partner must use the Service in a manner that is:

• Legal — in accordance with applicable laws and regulations;
• Transparent — providing accurate information about its identity, business activities, products, services, and Transactions;
• Not misleading — not using the Service to provide false or misleading information to a Customer;
• Consistent with its registered business activity — use of the Service must be consistent with the information provided to Baiyar; and
• Responsible — not using the Service in a manner that could cause loss, abuse, fraud, or undue risk to a Customer, Baiyar, a Payment Provider, or any other party.

Baiyar's approval of an account, Business Partner, product, Payment Link, project, Transaction, or use of a particular feature does not constitute a representation that the activity in question has been determined to be legal by Baiyar or that it meets every license or permit required by law.

A Business Partner remains responsible for obtaining and maintaining all licenses, permits, registrations, and approvals required for its business activities.

4. Compliance with Applicable Law

Use of Baiyar's Service must comply with the laws and regulations of the Republic of Indonesia applicable to the relevant activity, product, service, Transaction, and party.

A Business Partner may not use the Service to carry out, facilitate, or receive payment connected with activity that violates the law, including but not limited to:

• gambling or prohibited gambling activity;
• money laundering or disguising the origin of proceeds of crime;
• using proceeds of crime or funds derived from illegal activity;
• fraud, fictitious transactions, or activity intended to obtain an unlawful advantage;
• trading in goods or services prohibited by law;
• unlawfully misusing or collecting Personal Data;
• sexual exploitation or illegal content;
• unauthorized access to or use of computer systems;
• malware, cyberattacks, or other unlawful activity;
• infringement of intellectual property rights;
• activity that requires a government license, permit, or approval where that license is not held or is no longer valid; or
• any other activity prohibited under the laws and regulations of the Republic of Indonesia.

Listing an activity in this Policy does not limit a Business Partner's obligation to comply with any other regulation applicable to its business.

5. Prohibited Business

In addition to activity directly prohibited by law, Baiyar does not permit the Service to be used for the following.

5.1 Gambling and Similar Activity

• online gambling;
• wagering or betting;
• online casinos;
• games involving wagering money or assets through a gambling mechanism;
• services that facilitate illegal gambling or betting; and
• other activity with similar characteristics.

5.2 Fraud and Fictitious Transactions

• transactions with no underlying goods or services;
• transactions created to withdraw or move funds unlawfully;
• use of false identity or business information;
• transaction manipulation;
• use of a payment method without authorization;
• transactions deliberately structured to evade risk-detection systems; and
• other activity intended to obtain an advantage through fraud or abuse of the payment system.

5.3 Money Laundering and Criminal Activity

Including using the Service to:

• disguise the origin of funds;
• move proceeds of crime;
• use an account for the benefit of an undisclosed party;
• conceal the party that actually receives the economic benefit;
• carry out transactions connected with criminal activity; or
• facilitate activity connected with money laundering or the financing of illegal activity.

5.4 Illegal Goods and Services

Including the sale or distribution of goods and services prohibited by law, including proceeds of crime, counterfeit goods, or products whose ownership or circulation is prohibited.

5.5 Exploitation and Illegal Content

• sexual exploitation;
• child exploitation;
• human trafficking;
• sexual content that violates the law;
• content connected with sexual exploitation or abuse; and
• other activity prohibited under applicable law.

5.6 Misuse of Data and Unauthorized Access

• obtaining Personal Data without a lawful basis;
• selling or disclosing Personal Data unlawfully;
• phishing;
• credential theft;
• credential stuffing;
• unauthorized access to an account or system;
• spyware or malware; and
• services specifically designed to facilitate misuse of a system or data.

5.7 Intellectual Property Infringement

Including using the Service to sell or distribute products known to infringe another party's copyright, trademark, patent, or other intellectual property rights.

6. Restricted Business

Some business activities are not always prohibited, but may carry a higher legal, operational, fraud, chargeback, or other risk.

Baiyar may request additional review, documentation, licenses, or written approval before such activity can use the Service. Examples include:

• financial services or activity requiring a special license;
• crypto assets or digital-asset-related services;
• donations, crowdfunding, or fundraising;
• marketplaces or platforms that accept payment on behalf of multiple parties;
• ticketing or events;
• travel and reservations;
• pre-orders with a long fulfillment period;
• certain subscriptions or recurring billing;
• health products, medicine, cosmetics, or supplements;
• cigarettes, vapes, alcohol, or other age-restricted products;
• vouchers, gift cards, mobile credit, stored value, or similar products;
• digital products or services with a high risk of fraud or chargebacks;
• political or campaign fundraising;
• services using a new business model that does not yet have a clear risk classification; or
• any other category that, in Baiyar's assessment, requires additional review.

Approval of a Restricted Business may be given subject to specific conditions and may be reviewed again if there is a change to the business activity, risk profile, Payment Provider requirements, or applicable law.

7. Use on Behalf of Other Parties

A Business Partner may not use the Service on behalf of another party without Baiyar's approval where doing so would prevent Baiyar from knowing the party actually operating the business or receiving the economic benefit of a Transaction.

A Business Partner may not:

• rent or lend its Baiyar account;
• resell access to Baiyar's payment services without approval;
• share API keys or credentials with an unauthorized party;
• operate a business not disclosed to Baiyar;
• use a single account to disguise several different businesses or entities;
• act as a payment intermediary, aggregator, or marketplace without the required approval; or
• direct payments or a Payout to a third party without a lawful basis and authority.

Baiyar may request information about the party actually operating the business, its beneficial owners, commercial relationships, and the purpose of its use of the Service.

8. Prohibited Transaction Practices

A Business Partner may not use the Service to:

• carry out Transactions unrelated to its actual business activity;
• split Transactions to avoid review or limits;
• transact with itself without a legitimate transactional basis;
• create fake Transactions to inflate transaction volume or history;
• misrepresent a product or Transaction description;
• use a payment method for a purpose other than its genuine payment purpose;
• engage in activity that deliberately increases fraud or chargeback risk;
• process refunds or cancel Transactions in a manipulative manner;
• use another party's identity or account without authorization; or
• engage in any other activity that could disrupt the security, integrity, or operation of the Service.

9. Obligations to the Customer

A Business Partner must provide accurate and non-misleading information to a Customer regarding:

• its products or services;
• pricing;
• additional fees;
• purchase terms;
• the fulfillment process;
• its cancellation and refund policy;
• contact details for customer support; and
• any other information required under applicable law or terms.

A Business Partner is responsible for fulfilling its commercial obligations to a Customer to the extent that responsibility rests with the Business Partner under the applicable contractual relationship and law.

The allocation of responsibility between Baiyar, a Business Partner, a Payment Provider, and other parties may be further set out in applicable terms or agreements.

10. System and API Security

A Business Partner must safeguard the security of its:

• account;
• password;
• API keys;
• access tokens;
• webhook secrets;
• integration credentials; and
• other security information.

A Business Partner may not:

• conduct penetration testing of Baiyar's systems without approval;
• carry out scraping or automated access that disrupts the Service;
• attempt to gain unauthorized access to a system or data;
• exploit a vulnerability;
• distribute malware; or
• engage in any activity that could disrupt the availability or security of the Service.

If a Business Partner becomes aware of a credential compromise, suspicious transaction, or security incident relating to the Service, it must promptly take mitigating steps and notify Baiyar where necessary.

11. Reviews and Requests for Information

Baiyar may review an account, business activity, product, Transaction, and use of the Service for purposes including:

• identity and business-activity verification;
• security and fraud prevention;
• meeting legal obligations;
• meeting Payment Provider requirements;
• risk assessment;
• investigating a suspicious Transaction; or
• ensuring compliance with this Policy and Baiyar's other terms.

Baiyar may request additional documents or information, including information about:

• the Business Partner's identity;
• ownership or control of the business;
• its business activity;
• its products or services;
• the source or purpose of a Transaction;
• licenses or permits;
• relationships with other parties; and
• other information reasonably required for the review.

A Business Partner must provide information that is accurate, complete, and not misleading.

12. Transaction and Payout Restrictions

To protect Customers, Business Partners, Baiyar, Payment Providers, and other relevant parties, Baiyar may restrict a Transaction or Payout where it has reasonable grounds to believe that:

• a Transaction is potentially fraudulent;
• there has been a violation of this Policy or Baiyar's other terms;
• a Business Partner's information needs to be verified;
• its business activity does not match the information it provided;
• there is a request or obligation from a competent authority;
• a Payment Provider has requested the restriction;
• there is a security risk or risk of misuse;
• there is a dispute, refund, chargeback, or other obligation that needs to be resolved; or
• the restriction is necessary to meet applicable law or requirements.

A restriction may take the form of delaying or declining a Transaction, restricting a payment method, delaying or restricting a Payout, requesting additional information, or any other action that is reasonable in the circumstances.

Baiyar will seek to apply any restriction in a manner proportionate to the relevant risk and circumstances.

13. Action Taken for a Violation

If Baiyar discovers, or has reasonable grounds to believe, that there has been a violation of this Policy, Baiyar may take one or more of the following actions:

• issue a warning;
• require the Business Partner to take corrective action;
• request additional documents or information;
• restrict or disable a Payment Link, Checkout, API, project, or particular feature;
• restrict a payment method;
• decline or delay a Transaction;
• delay or restrict a Payout;
• conduct a further review or re-verification;
• suspend the account;
• terminate access to the Service;
• take any other action necessary to meet a legal obligation or Payment Provider requirement; or
• report the activity to a competent authority where required or permitted by law.

Action may be taken without prior notice where necessary to prevent loss, fraud, abuse, a security risk, or a violation of law.

14. Review and Objection

A Business Partner may contact Baiyar if it believes a restriction or action taken against its account was based on inaccurate information, or if the relevant circumstances have since changed.

Baiyar may request additional documents or information before conducting a review.

A review does not guarantee that a restriction will be lifted.

15. Changes to Business Activity

A Business Partner must notify Baiyar of any material change to its business activity, including:

• a change in its main products or services;
• a change in its business model;
• a change in the owner or party controlling the business;
• a change in how it uses the Service;
• a change in its Payout account;
• a change in its licenses or permits; or
• any other change that could affect the Business Partner's risk profile or compliance.

Baiyar may conduct a further review where such a change occurs.

16. Reporting Abuse and Contact

If you become aware of suspected abuse of Baiyar's Service, fraud, illegal gambling, money laundering, scams, or other illegal activity connected with Baiyar, you may contact Baiyar Abuse & Compliance at abuse@baiyar.com.

For general questions about Baiyar's Service, you may contact Baiyar Support at support@baiyar.com.

A report should include enough information to help Baiyar conduct a review, including relevant Transaction, account, or activity details where available.

17. Governing Law

This Policy is governed by the laws of the Republic of Indonesia.

Use of the Service also remains subject to the laws and regulations applicable to the relevant business activity, product, service, Transaction, and party.

If a change in law, regulation, Payment Provider requirements, or Baiyar's Service requires an adjustment to this Policy, Baiyar may update the Policy as needed.

This Policy forms part of the terms governing use of Baiyar's Service and should be read together with the Terms of Service, the Business Partner Terms, the Buyer Terms, the Privacy Policy, the Cookie Policy, and any other applicable terms.

18. Changes to This Policy

Baiyar may update this Policy from time to time to reflect changes to the Service, risk, Payment Provider requirements, or applicable law and regulation.

The latest version will be published on Baiyar's site or Service and takes effect from the date shown under “Last updated,” unless stated otherwise.