Privacy Policy

Controller & processor roles

The foundation/school is the data controller for student, parent, and staff data entered into SekolahOS. SekolahOS acts as the data processor, processing that data only per the foundation's written instructions, as set out in the Data Processing Agreement (DPA).

Data collected

Depending on the modules a foundation enables, SekolahOS may process: student and parent/guardian identity (name, NISN, NIK, date of birth, address), attendance data and gate photos, biometric templates (optional, with separate consent), academic and report card data, financial and billing data, staff employment and role data, and logs of communication to parents.

Legal basis & purpose of processing

The legal basis for processing is recorded per purpose (delivering the education service, government reporting obligations, or explicit consent for biometrics, gate photos, and giving medicine to a student). Consent is requested per purpose, separately — never bundled into one general consent — and recorded with a version and timestamp. Student and staff profile photos uploaded by the school are used to recognise the person and are processed on the basis of delivering the education service; parents/guardians and staff can ask for them to be removed at any time. SekolahOS does not send marketing communication to parents/guardians or staff; if that is ever added, it will only follow a separate consent.

Security & data location

SekolahOS runs on enterprise-grade cloud infrastructure from independently audited providers (including ISO/IEC 27001 and SOC 2), with physical data-centre security, network segmentation, continuous monitoring and encrypted backups. The processing location of each sub-processor and the basis for cross-border data transfers are set out in the Data Processing Agreement.

Data is encrypted with TLS 1.3 in transit. Sensitive personal data (e.g. national ID number, student ID number, date of birth, address, health and counselling data, bank account numbers, and biometric templates) is encrypted at the application level at rest with Fernet (AES-128-CBC with HMAC-SHA256 authentication), using separate encryption keys per type of data, including general PII, biometric templates, and clinic and counselling notes. Database backups are encrypted with AES-256-GCM. SekolahOS staff access to production is time-boxed, approved, and logged — no standing production credentials exist.

Data subject rights

Parents/guardians and staff can submit requests for access, correction, deletion, restriction of processing, or data portability through the school admin. Valid requests are served within 30 days, except for data that must be retained under a statutory retention obligation (see the data retention page).

You also have the right to complain to the personal data protection authority of your country: the Personal Data Protection Agency in Indonesia, or the Personal Data Protection Committee (PDPC) in Thailand.

Children's data

Student data sharing settings default to the most restrictive option. Widening access (for example, sharing data with a new third party) can only be done through an explicit action by the school admin, and is always recorded in the audit trail.

Data breach incidents

Suspected personal data breaches are handled through an internal incident procedure with a 3×24-hour notification clock to the affected foundation, including evidence of the incident and a list of affected data subjects.

Contact

Questions about this policy or requests related to personal data can be sent to [email protected].