Data Processing Agreement (UU PDP)
A summary of the Data Processing Agreement that is attached to every SekolahOS subscription contract, per Law No. 27 of 2022 on Personal Data Protection.
The parties
This agreement is between the customer foundation/school (Data Controller) and Elsia, SekolahOS's provider (Data Processor). A signed copy is attached to each foundation's subscription contract and is legally binding from the account activation date.
Scope of processing
| Aspect | Terms |
|---|---|
| Data subjects | Students, parents/guardians, and foundation staff |
| Data category | Identity, attendance, academic, financial, employment, and (optional) biometric/health data |
| Purpose | Solely to operate the SekolahOS service per the foundation's written instructions |
| Duration | For the duration of the subscription, plus the applicable statutory retention period |
SekolahOS's obligations as processor
SekolahOS processes personal data only on the foundation's documented instructions, keeps data confidential, applies TLS 1.3 encryption in transit and application-level encryption of sensitive personal data at rest (Fernet: AES-128-CBC with HMAC-SHA256 authentication), restricts internal staff access to time-boxed and audited sessions, and helps the foundation fulfil data subject requests and the 3×24-hour incident notification obligation from the moment an incident is detected.
Third-party subprocessors
SekolahOS uses the following sub-processors to run the service. Adding a new sub-processor requires a documented Data Protection Impact Assessment (DPIA) before it goes live.
| Sub-processor | Purpose | Processing location |
|---|---|---|
| DigitalOcean | Application servers and managed database (production data) | Singapore |
| Google Cloud Storage | Uploaded files and encrypted copies of the database backup | United States (Oregon, us-west1) |
| Google Firebase Cloud Messaging | Delivery of push notifications to the app | Google's global network |
| Cloudflare | Proxy and protection of web traffic; forwards encrypted traffic to the servers | Cloudflare's global network |
The following sub-processors are used only when the foundation turns the feature on:
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Payment gateway chosen by the school (e.g. Xendit, Midtrans) | Processes parents' payments when the school turns it on | As the provider operates; announced before it is turned on |
| WhatsApp Business Cloud API (Meta) | Delivery of WhatsApp notifications when the school turns it on | As the provider operates; announced before it is turned on |
| LINE Messaging API (LY Corporation) | Delivery of LINE notifications for schools in Thailand when turned on | As the provider operates; announced before it is turned on |
| Application error monitoring (Sentry) | Receives application error reports when turned on; personal data is scrubbed before sending | As the provider operates; announced before it is turned on |
Cross-border data transfers
Personal data is processed in Singapore and partly stored in the United States. For foundations in Indonesia, this transfer follows Article 56 of the Personal Data Protection Law (UU PDP); for foundations in Thailand, it follows Sections 28 and 29 of the Personal Data Protection Act (PDPA B.E. 2562). SekolahOS transfers only the data needed to run the service.
The basis for the transfer is not merely the foundation's agreement by signing this agreement. Each transfer to a sub-processor outside the foundation's country rests on an appropriate safeguard in the form of standard contractual clauses: SekolahOS uses only sub-processors whose data processing terms contain the ASEAN Model Contractual Clauses (ASEAN MCC) or the EU Standard Contractual Clauses (EU SCC), plus confidentiality and security obligations equivalent to this agreement, a ban on using the data for other purposes, and a duty to notify of an incident. On request, SekolahOS gives the foundation a copy of each sub-processor's safeguard instrument; a foundation that objects can contact us before signing.
The foundation's rights as controller
The foundation has the right to request a compliance audit, a copy of access logs to its personal data, and evidence of security obligations being met. The foundation remains the only party authorized to instruct changes to the purpose of processing.
Termination & data return
When the contract ends, the foundation can request a full export of its data. Data is deleted from production systems once the statutory retention period has been met, as described on the data retention page.
Contact
To receive a full, signable copy of the Data Processing Agreement, contact [email protected].