Privacy Policy

PT Catalyst Digital Nusantara (hereinafter referred to as "the Company," "we," "us," or "our") operates Scholedu, an integrated school management platform. We are committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, disclose, and protect information you provide when using Scholedu's services, in full compliance with Law No. 27 of 2022 on Personal Data Protection (UU PDP) and all other applicable regulations of the Republic of Indonesia. By accessing or using Scholedu, you acknowledge that you have read, understood, and agreed to this Privacy Policy. If you disagree with any part herein, please cease using our services immediately.

The operator of the Scholedu platform is: PT Catalyst Digital Nusantara Domiciled in Pringsewu, Lampung, Republic of Indonesia Email: [email protected] We operate the Scholedu platform, which provides school digitalization services including academic management, attendance, digital report cards (e-Rapor), online new-student admissions under the SPMB system (Sistem Penerimaan Murid Baru, formerly known as PPDB), and e-learning for educational institutions across Indonesia. Our role in processing personal data depends on the category of data concerned: (a) Institutional Data: In respect of the personal data of students, parents or guardians, teachers, and education personnel entered into the platform by an educational institution, that institution acts as the Data Controller and determines the purposes and scope of processing. The Company acts as the Data Processor and processes such data solely on the instructions of the institution, in accordance with the Subscription Agreement and this Policy. (b) Account and Website Data: In respect of administrator account data, billing data, support correspondence, and data of visitors to our website, the Company acts as the Data Controller. This allocation of roles determines which party is responsible for responding to data subject requests. If you are a student, parent or guardian, teacher, or member of education personnel, requests to exercise the rights set out in Section 12 should in principle be directed to your educational institution as Controller in the first instance. We will support that institution in responding to your request.

We collect personal data that is necessary to provide, maintain, and improve our services. The categories of data we collect include: (a) Identity Data: Full name, National Identity Number (NIK), Student Registration Number (NISN/NIS), date of birth, gender, and photograph. (b) Contact Data: Email address, WhatsApp/phone number, and residential address. (c) Academic Data: Class level, academic year, grades, attendance records, report card data, and extracurricular participation. (d) Institutional Data: School name, NPSN (National School Principal Number), principal's information, and staff data. (e) Financial Data: Payment history, tuition billing records, and transaction identifiers (no full payment card data is stored by us). (f) Usage Data: IP address, browser type, operating system, pages visited, time spent on platform, and device identifiers. (g) Technical Data: Log files, error reports, and platform interaction data collected automatically.

We process your personal data on one or more of the following lawful bases as defined under UU PDP Article 20: (a) Contractual Necessity: Processing is necessary for the performance of a subscription agreement or service contract between your institution and the Company. (b) Legal Obligation: Processing is required to comply with applicable Indonesian law and regulations, including tax, education, and data protection obligations. (c) Legitimate Interests: Processing is necessary for the Company's legitimate business interests, including platform security, fraud prevention, and service improvement, provided these interests do not override your fundamental rights. (d) Explicit Consent: Where required by law (e.g., processing sensitive data or data of minors), we will obtain your explicit, informed, and freely given consent prior to processing.

We use cookies and similar tracking technologies to enhance your experience on Scholedu. The types of cookies we use are: (a) Strictly Necessary Cookies: Essential for the platform to function, including session authentication tokens. These cannot be disabled. (b) Performance Cookies: Anonymous analytics data collected via Google Analytics to understand how users interact with the platform and to improve its functionality. (c) Functional Cookies: Remembering your language preferences, display settings, and login state. You may control non-essential cookies through your browser settings at any time. Disabling performance cookies will not affect the core functionality of Scholedu. By continuing to use our platform, you consent to our use of cookies as described herein.

We use your personal data for the following purposes: (a) To provide, operate, and maintain Scholedu's services as agreed in your institution's subscription plan. (b) To process and record academic, attendance, and financial transactions. (c) To communicate important service updates, security notices, and system announcements. (d) To respond to support requests, complaints, and inquiries. (e) To conduct internal analytics and research to improve platform features and user experience. (f) To comply with applicable legal obligations, regulatory requirements, and court orders. (g) To detect, prevent, and address fraudulent activity, unauthorized access, and technical security issues. (h) To generate anonymized, aggregated statistical reports on educational trends (no personally identifiable information is shared in such reports).

We do not sell, rent, or trade your personal data to third parties. We may share your data with trusted sub-processors who assist in delivering our services, bound by data processing agreements that impose obligations no less protective than this Policy. Our current sub-processors include:

We may also disclose your data to government or regulatory authorities if required by law, court order, or to protect the rights and safety of users and third parties.

Some of our sub-processors are located or operate servers outside the Republic of Indonesia. When we transfer personal data internationally, we ensure that: (a) The receiving country provides an adequate level of data protection as assessed by the competent Indonesian authority; or (b) We have implemented appropriate safeguards, including contractual clauses binding the recipient to standards equivalent to UU PDP; or (c) The transfer is necessary for the performance of a contract to which you are a party. Primary data processing and storage for Indonesian institutional clients occurs within cloud infrastructure in the Singapore region (AWS ap-southeast-1), which provides regulatory proximity and low latency.

Scholedu is an institutional platform used by educational entities and their authorized personnel. Access for students under the age of 13 (thirteen) is subject to the following conditions: (a) Parental or guardian consent is required before a student's personal data is collected and processed by the platform. (b) Schools, as institutions, are responsible for obtaining and documenting such consents from parents or guardians prior to onboarding student data. (c) We do not knowingly collect personal data from children under 13 without verified parental or institutional consent. (d) Data collected from minors is used solely for educational purposes, is never used for advertising, and is protected with heightened access controls. If you believe we have inadvertently collected data from a child without proper consent, please contact us immediately at [email protected] so that we may take prompt corrective action.

We retain your personal data only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. (a) Active Account Data: Retained for the duration of your institution's active subscription agreement. (b) Post-Termination: Following termination or expiry of a subscription, personal data is retained for a maximum of ninety (90) days before being securely deleted or anonymized, except where longer retention is mandated by Indonesian tax or education regulations. (c) Backup Data: Encrypted backup data may be retained for up to thirty (30) additional days in disaster recovery storage before permanent deletion. (d) Legal Hold: Where data is subject to legal proceedings, regulatory investigation, or dispute resolution, retention will be extended accordingly until the matter is resolved. You may request earlier deletion of your personal data by submitting a written request to [email protected], subject to our legal obligations.

We implement technical and organizational security measures appropriate to the risk of processing, including: (a) Encryption of data in transit using TLS 1.2 or higher. (b) Encryption of data at rest using AES-256 or equivalent standards. (c) Role-Based Access Control (RBAC) to restrict data access to authorized personnel only. (d) Regular security audits and penetration testing. (e) Multi-factor authentication (MFA) availability for administrative accounts. (f) Isolated database architecture: each institutional client's data is logically separated. In the event of a personal data breach that poses a significant risk to your rights and freedoms, we will notify the relevant Indonesian regulatory authority within 72 (seventy-two) hours of becoming aware of the breach. Affected data subjects will be notified without undue delay in accordance with UU PDP.

Under UU PDP, you have the following rights regarding your personal data: (a) Right of Access: To obtain confirmation of whether we process your data and to receive a copy thereof. (b) Right to Rectification: To request correction of inaccurate or incomplete personal data. (c) Right to Erasure: To request deletion of your personal data, subject to legal retention obligations. (d) Right to Restriction: To request that we limit processing of your data in certain circumstances. (e) Right to Data Portability: To receive your personal data in a structured, machine-readable format. (f) Right to Object: To object to processing based on legitimate interests or for direct marketing purposes. (g) Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. To exercise any of these rights, please submit a written request to [email protected]. We will respond within 30 (thirty) days. Identity verification may be required before fulfilling your request.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. When we make material changes, we will: (a) Publish the revised Policy on this page with an updated "Last Updated" date; (b) Notify institutional administrators via email at least 14 (fourteen) days prior to the effective date of material changes. Your continued use of Scholedu after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree, you must cease using the services and may request data deletion as described above.

For privacy-related inquiries, data subject rights requests, or to report a concern, please contact our Data Protection Officer (DPO): PT Catalyst Digital Nusantara Pringsewu, Lampung, Indonesia Email: [email protected] We are committed to working with you to resolve any privacy concern fairly and promptly.