Privacy Policy

1. Legal Basis and Data Processing Principles

All processing of Personal Data is conducted fairly, transparently, and lawfully based on at least one of the following legal bases (lawful basis):

• Consent: Explicit consent provided by the Data Subject or the parent/legal guardian of a minor.
• Contractual Obligation: To fulfill obligations and rights under service agreements for the provision of the digital educational ecosystem platform.
• Legal Obligation: Compliance with statutory and regulatory obligations under Indonesian law.
• Vital Interest: Protection of essential and vital interests of the Data Subject.
• Public Interest & Statutory Mandate: Performing tasks in the public interest within the education sector.
• Legitimate Interest: Fulfilling legitimate interests while balancing the fundamental rights and freedoms of Data Subjects.

2. Relevance and Purpose Limitation

• Specific and Limited Collection (Data Minimization): We collect and process Personal Data strictly to the extent necessary, adequate, and relevant to fulfill defined and specified purposes.
• Specified Purposes of Processing:
  • Authentication & Account Access: Verifying user identities and managing Role-Based Access Control (RBAC).
  • Academic Operations: Processing daily attendance, digital gradebook entries (e-Gradebook), class schedules, and homework distribution.
  • Parental Reporting: Delivering real-time notifications regarding attendance recaps, academic evaluation (digital report cards), and school announcements to parents/guardians.
  • Security & Compliance: Ensuring platform reliability, technical helpdesk support, preventing unauthorized access/cyber threats, and complying with national statutory obligations.

3. Rights of Data Subjects

We guarantee and facilitate the full exercise of Data Subject rights under the UU PDP:

• Right to Confidentiality: We guarantee the strict confidentiality of your Personal Data and maintain privacy protection procedures.
• Access & Rectification: Data Subjects have the right to access, update, or correct inaccurate Personal Data via their profile settings or written requests.
• Data Portability & Copy Retrieval: Data Subjects have the right to obtain a copy of their Personal Data provided to Us in a structured, commonly used, and machine-readable format through secure verification protocols.
• Restriction on Automated Decision-Making (Profiling): We DO NOT engage in decision-making based solely on automated processing or profiling that produces legal or significant effects on Data Subjects.
• Right to Object: Should any automated processing be introduced in the future, Data Subjects maintain the right to object and request non-automated review mechanisms.

4. Data Accuracy and Quality

We take all reasonable and measured steps to ensure that Personal Data is processed accurately, completely, non-misleadingly, and kept up-to-date. Inaccurate or incomplete data will be corrected or updated promptly upon notification or validation by the Data Subject or School Administrator.

5. Security Measures and Internal Governance

• Technical & Physical Safeguards: Data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. We conduct periodic security assessments and penetration tests to evaluate technical effectiveness.
• Third-Party & Subprocessor Governance: Where third parties assist in data processing, We enforce binding written Data Processing Agreements (DPA) that bind third parties to data protection and security standards equivalent to the UU PDP.
• Internal Rules & Awareness: We maintain documented internal governance policies (SOP Governance) that are periodically reviewed, communicated to all employees, and supported by mandatory internal Data Privacy Training and Awareness workshops.
• Data Protection Officer (DPO): We have designated an official Data Protection Officer (DPO) responsible for monitoring internal compliance, advising on Data Protection Impact Assessments (DPIA), and acting as the primary contact for Data Subjects and regulatory authorities.

6. Transparency, Documentation, and Data Breach Notification

• Documentation of Processing Activities: All processing activities, retention schedules, and operational technical measures are documented in immutable audit logs.
• Transparent Information: Information regarding controller identity, lawful basis, and processing purposes is communicated clearly using plain and accessible language.
• Data Breach Notification Protocol: In the event of a Personal Data breach, We maintain a written protocol to notify Data Subjects and the relevant Authority in writing within 24 hours of discovery. The notification will include breach details, potential impacts, mitigation actions taken, and dedicated reporting channels.
• Grievance Channels & Risk Mitigation: We provide dedicated grievance channels and Incident Response Plans to mitigate risks and assist Data Subjects in protecting themselves against further adverse impacts.

7. Termination, Erasure, and Retention of Data

• Termination of Processing: Data Subjects may request the termination of Personal Data processing based on consent withdrawal, data inaccuracies, or absence of lawful basis.
• Deletion and Destruction: We provide mechanisms for the permanent deletion and/or destruction of Personal Data from our electronic systems upon expiration of retention periods, achievement of purpose, or valid requests, unless retention is mandated by law.
• Retention Policy: Personal Data is retained strictly in accordance with defined retention schedules based on statutory requirements and processing purposes. Data is securely destroyed once the retention period expires.

8. Data Transfers, Disclosure, and Law Enforcement Access

• Data Residency: All primary production databases, backups, and system logs reside exclusively within the territory of the Republic of Indonesia (AWS / GCP Jakarta Region). We DO NOT transfer Personal Data outside the territory of Indonesia.
• Law Enforcement Requests: We maintain strict internal policies and procedures regarding requests for Personal Data from law enforcement agencies. Disclosure is restricted strictly to valid legal process, necessity, proportionality, and the absolute minimum data required.

9. Contact the Data Protection Officer (DPO) & Complaints

For inquiries, feedback, data updates, exercising Data Subject rights, or reporting security incidents, please contact Our designated Data Protection Officer (DPO):

• DPO / Privacy Email: support@agendabygen.co.id
• Telephone / Helpdesk: +62 21 5291 7409
• Office Address: PT Generasi Ekselensia Nusantara, BEI Tower 2, Jakarta, Indonesia