Privacy Policy

1. About this policy

This Privacy Policy explains how CV Bulung Gadung (“we”) processes personal data through Arkantara, a web-based school management platform. It applies to the platform site, each school's site, and schools' custom domains that use Arkantara.

This policy was prepared with reference to Law Number 27 of 2022 on Personal Data Protection (UU PDP). The terms personal data controller, personal data processor, and personal data subject follow the definitions in that law.

2. The school's role and ours

Each subscribing school is the personal data controller for the data it manages in Arkantara, such as student, guardian, employee, grade, attendance, finance, and document data. The school decides what data is recorded, who may access it, and how long it is kept. For that data we act as a personal data processor: we process it only to run the service under our agreement with the school and the school's instructions.

We are the personal data controller for the data we collect to run the platform itself: contact and billing data of subscribing schools, platform administrator accounts, demo requests, support records, and platform security logs.

If you are a student, guardian, employee, or applicant, please direct questions about your data to the school concerned first.

3. Data we process

The types of data processed depend on the modules the school uses and the data entered by the school or users:

• User accounts: email address, password stored as a hash (not the original text), language and theme preferences, two-step verification devices and passkeys, and your Google account ID if you link it.
• Identity data recorded by the school: name, gender, place and date of birth, NIK, NIS and NISN, address, phone number, email, photo, guardian–student relationships, and employment data.
• School activities: attendance including leave and sickness notes with their attachments, schedules, grades and report cards, assignments, exam answers, counseling notes, violations and achievements, extracurricular activities, library, transport, and canteen.
• Finance: school invoices and payments, scholarships, student savings, canteen balances, and employee payroll including bank account numbers.
• Communication and documents: chat messages, announcements, notifications, letters, and uploaded files.
• Public forms: applicant and guardian data with documents in PPDB admissions, data of alumni who register with their consent, and contact data in demo requests (school name, name and role, email, phone, city, student count, and message).
• Technical and security data: IP address and user agent in sign-in sessions and audit logs, and records of computer-based exam activity (such as switching tabs or leaving full screen) to protect exam integrity.

We do not collect GPS location. QR code attendance does not use location data.

4. Children's data

Most students are children. The UU PDP requires children's data to be processed with special care and with the consent of a parent or guardian. The school, as the data controller, is responsible for ensuring a lawful basis for processing, including parent or guardian consent where required, before recording children's data in Arkantara.

PPDB forms are completed by applicants together with their parents or guardians. We do not use children's data for advertising, marketing, or profiling beyond the school's purposes.

5. Purposes of processing

• Providing and running the service under our agreement with the school, including the modules the school chooses.
• Securing the service: authenticating users, preventing abuse and repeated sign-in attempts, and keeping audit logs.
• Sending service-related emails and notifications, such as account confirmation, invitations, password resets, reminders, and announcements from the school.
• Managing subscriptions, invoices, and payments.
• Responding to demo and support requests.
• Meeting legal obligations and lawful requests from competent authorities.

We do not sell personal data, show advertising, or use third-party analytics trackers.

6. Third-party service providers

We use the following providers to run the service. Each provider receives only the data needed for its function:

• Cloudflare: the delivery and protection network that all site traffic passes through, private file storage and database backups (R2), Turnstile bot verification on sign-in and public forms (receives a verification token and IP address), and management of schools' custom domains.
• Resend: email delivery (recipient address, subject, and email content).
• DOKU: online payments when enabled by the school, and payment of subscription invoices. DOKU receives the invoice amount and number, the student or school name and ID, and the payer's email. Your card and payment account details are entered directly on DOKU's page and never pass through our system.
• Google: sign-in with a Google account, if you choose it. We receive only your email address and Google account ID.
• Browser notification services (Google, Mozilla, Apple, or Microsoft, depending on your browser): delivery of device notifications, only if you enable them. Notification content is encrypted.
• Sentry: application error reporting, when enabled. Reports are configured to drop email, IP address, cookies, and request content, but may contain technical context from the part of the code that failed.
• Data center provider where our application servers and database run.

Some of these providers may process data outside Indonesia. We use providers that apply adequate data protection, and only for the purposes above.

7. Cookies and browser storage

We use only the cookies and browser storage needed for the service to work:

• Session cookie: keeps you signed in, for up to two weeks. Accounts with sensitive access are signed out automatically after a period of inactivity.
• CSRF cookie: protects forms from forged requests.
• Language cookie: remembers your chosen language until the browser is closed.
• Message cookie: shows a short message after you save or submit something.
• Local storage theme: remembers your choice of light, dark, or system theme.
• Service worker: stores only the offline page; your pages and data are not stored on the device.

We do not use advertising or analytics cookies. Cloudflare may set its own technical cookies for network security. When you sign out, we ask the browser to clear this site's cache and storage.

8. Retention and deletion

School data is kept for as long as the school uses Arkantara. The school decides when its operational data is archived or deleted using the available features. Some data is deleted automatically:

• Audit log: 730 days.
• Read notifications: 180 days.
• Chat messages deleted by their sender: permanently deleted after 365 days.
• Archived documents and their files: 1825 days after archiving.
• School data export files: 7 days after creation.
• Expired sign-in sessions: cleaned up daily.
• Self-registered accounts not confirmed within 24 hours: deactivated and their email address released.

After a school stops subscribing, its data remains stored and can be exported as long as the school has not been archived or suspended. At the school's request, school data can be permanently purged no earlier than 30 days after the school is archived: accounts are anonymized, the school database is emptied, and its files are deleted. We keep subscription, invoice, audit log, and support history records for legal and accounting purposes.

Demo requests are kept for as long as needed to follow them up, and you may request their deletion at any time. Database backups are rotated regularly, so deleted data also disappears from backups once the rotation period ends.

9. Security

• All connections use HTTPS with HSTS.
• Each school's data is separated in its own database schema, and its files are stored in a separate space per school.
• Passwords are stored as hashes. Two-step verification is required for platform administrators and available to all users, as are passkeys.
• Two-step verification keys and schools' payment credentials are stored encrypted.
• Private files can be downloaded only after permissions are checked, through temporary links that expire very quickly.
• Sign-in attempts are rate limited, and public forms are protected by bot verification.
• Audit logs cannot be changed or deleted, except by the retention process.
• Database backups are made daily and copied to private storage outside the application server, using dedicated credentials separate from the application's credentials.
• Photo metadata, including the location where a photo was taken, is removed on upload.

For support purposes, platform administrators can sign in as a school user. This access requires password confirmation and a reason, is time-limited, and is recorded in the audit log.

If a personal data protection failure occurs, we notify affected schools without delay. For data we control, we notify data subjects and the competent authority in accordance with the UU PDP.

10. Your rights

Under the UU PDP, your rights include the right to:

• obtain information about the processing of your personal data;
• access and obtain a copy of your personal data;
• correct inaccurate or incomplete data;
• request deletion or destruction of your personal data;
• withdraw consent you have given;
• object to or request restriction of processing.

For data managed by the school, submit your request to your school; we help the school fulfil it. School administrators can update or deactivate accounts and export all school data. For data we control, send your request through the operator contact at the end of this page. We verify your identity first and respond within the time limits set by the UU PDP.

11. Changes to this policy

We may update this policy following changes to the service or regulations. The effective date at the top of this page shows the latest version. We notify schools of significant changes by email or in-app notice before they take effect.

12. Contact us

Questions or requests about this policy can be sent to CV Bulung Gadung through the contact details below. If you are not satisfied with our response, you may complain to the personal data protection authority in accordance with the UU PDP.