Privacy Policy

1 Scope & Parties Covered

This policy applies to all individuals and entities who interact with the Jembatan Bahasa Portal:

• Students & Prospective Students: Individuals enrolled in or inquiring about private, semi-private, group, corporate, or online language learning programs.
• Tutors & Teaching Staff: Instructors, academic coordinators, and evaluators engaged in curriculum delivery, grading, and attendance management.
• Affiliates & Marketing Partners: Participants in the Jembatan Bahasa affiliate program generating referrals and receiving commission payouts.
• Corporate & B2B Partners: Company representatives, HR managers, and corporate liaisons managing group training contracts and quotations.
• Website & Portal Visitors: Any person accessing public pages, knowledge bases, dictionaries, or open learning resources.

2 Legal Basis for Data Processing

Under Article 20 of Law No. 27 of 2022 (UU PDP), we process your personal data based on one or more of the following lawful bases:

• Explicit Consent: You have explicitly provided consent during account registration, onboarding forms, document uploads, or newsletter subscriptions.
• Contractual Obligation: Processing is strictly necessary to execute our learning agreement, schedule classes, issue certificates, process tutor honorariums, or disburse affiliate payouts.
• Legal & Statutory Compliance: Processing is required to satisfy Indonesian tax documentation (NPWP/PPh), financial auditing standards, and immigration verification where applicable.
• Legitimate Business Interests: Maintaining portal security, preventing fraudulent account creation, enforcing academic integrity, and optimizing educational quality.

3 Information We Collect

Depending on your role and usage of the portal, we collect the following categories of data:

4 Purposes of Processing

We process your personal information strictly for the following legitimate purposes:

• Curriculum Customization & Matching: Crafting tailored lesson plans, matching students with the most qualified tutors based on learning goals, and adjusting pace based on rubric evaluations.
• Academic Administration: Tracking student attendance, logging lesson summaries, coordinating classroom room bookings, and issuing verifiable completion certificates.
• Financial Operations: Generating corporate proposals, issuing invoices, verifying payment settlements, maintaining digital student wallets, calculating teacher payroll (including bonuses and THR), and processing affiliate commissions.
• Platform Security & Integrity: Authenticating account logins, enforcing role-based permissions (RBAC), verifying 2FA recovery codes, and filtering spam/bot attacks via Google reCAPTCHA.
• Operational Communications: Sending automated reminders regarding upcoming classes, schedule adjustments, homework notifications, and administrative announcements via portal notifications or verified messaging channels.
• Quality Assurance & Dispute Resolution: Reviewing lesson delivery logs, evaluating student feedback ratings, and resolving academic or scheduling disputes.

5 Third-Party Sub-processors & Integrations

We do not sell, rent, or trade your personal data. We only share personal data with trusted third-party service providers who operate under strict confidentiality and security agreements:

• Payment Gateways (e.g., Midtrans / Bank Virtual Accounts): Regulated payment institutions operating under Bank Indonesia supervision and PCI-DSS Level 1 certification to process secure transactions.
• Virtual Classroom Providers (e.g., Zoom Video Communications, Google Meet): Facilitating interactive online video and audio language sessions. Users are advised to review the respective privacy terms of these conferencing platforms.
• Cloud Infrastructure & Database Hosting: Tier-3/Tier-4 cloud service providers providing encrypted data storage, backup redundancy, and high-availability server clusters.
• Security & Anti-Abuse (Google reCAPTCHA): Protecting public forms (registration, login, contact) against automated credential stuffing and malicious bot traffic.
• Push Notifications & Relays: Encrypted web push services delivering real-time alerts regarding class schedules and incoming chat messages.
• AI Educational Tools: Where artificial intelligence features are utilized (e.g., automated flashcard generation, vocabulary examples, or knowledge base lookups), prompts are scrubbed of direct student personal identifiers and are never utilized to train public foundation models without explicit consent.

6 Data Retention Periods

We retain personal data only for as long as necessary to fulfill the operational, educational, and legal obligations described in this policy:

• Active Account Data: Retained for the duration of your active enrollment or contract with Jembatan Bahasa.
• Academic & Certification Records: Retained indefinitely (or up to 10 years after class conclusion) to enable students to request certificate re-issuance, transcript verification, or academic references.
• Financial & Invoice Records: Retained for a mandatory period of 5 to 10 years pursuant to Indonesian taxation and corporate record-keeping statutes, regardless of whether an account is closed.
• In-Portal Chat & File Uploads: Stored for the duration of the associated course plus 12 months for quality evaluation and dispute audit purposes.
• Ephemeral Security Logs: IP and server access logs are cycled and purged within 90 days, unless flagged for active security investigation.

7 Protection of Minors (Students Under 18)

In compliance with Article 25 of Law No. 27 of 2022 (UU PDP):

• Processing of personal data belonging to children (individuals under the age of 18) requires verifiable consent from a parent or legal guardian.
• When registering a student under 18 years of age, the parent or guardian must provide their identifying details and assume legal responsibility for the account.
• If we discover that personal data of a minor was submitted without verifiable parental consent, we will promptly suspend the account and delete the associated data.

8 Cross-Border Data Transfers

As Jembatan Bahasa serves international expatriates, overseas students, and global partners, your information may be accessed or transferred across international borders through encrypted cloud networks. In accordance with Article 56 of the UU PDP, we ensure that any cross-border data recipient maintains personal data protection standards that are equal to or higher than the requirements of Indonesian law, or that the transfer is conducted with your explicit contractual consent.

9 Security Measures & Breach Notification Commitment

We implement comprehensive technical and organizational safeguards to protect your personal data against unauthorized access, loss, alteration, or disclosure:

• Cryptographic Standards: Modern TLS 1.3 encryption in transit for all web sessions; robust password hashing (bcrypt / Argon2); encrypted storage for sensitive identity documents.
• Access Governance: Role-Based Access Control (RBAC) ensuring employees and tutors can only access student data strictly necessary for their assigned teaching and administrative duties.
• Two-Factor Authentication (2FA): Optional multi-factor authentication and backup recovery codes to protect administrative and user accounts.
• Mandatory Breach Notification: In the unlikely event of a verified personal data breach, Jembatan Bahasa commits to notifying affected data subjects and relevant Indonesian regulatory authorities within 3 × 24 hours (72 hours), including details of the breach, affected data categories, and remediation actions taken.

10 Your Rights as a Data Subject

Under Indonesian and international data protection laws, you possess the following rights regarding your personal data:

• Right to Access & Information: You have the right to obtain confirmation of data processing and request a copy of your personal data held in our systems.
• Right to Rectification: You may update or correct inaccurate or incomplete profile data directly via your profile settings or by contacting administration.
• Right to Erasure ("Right to be Forgotten"): You may request permanent deletion of your account and personal data from our active databases, subject to legal obligations requiring retention of financial and tax records.
• Right to Withdraw Consent: You may withdraw previously granted processing consent at any time without retroactive penalty, noting that withdrawal may prevent further access to active course services.
• Right to Restrict or Object to Processing: You may request the suspension of certain processing activities (such as marketing communications) at any time.
• Right to Data Portability: You may request an export of your primary profile and learning history in a structured, commonly used machine-readable format.

11 Cookies & Local Storage

We use essential session cookies and browser LocalStorage solely to maintain your authenticated login session, preserve your UI theme preference (dark/light mode), and ensure CSRF security protection. When clicking affiliate links, temporary attribution cookies or URL parameters are stored to credit referring partners accurately. We do not engage in third-party behavioral ad tracking across third-party websites.

12 Governing Law

This Privacy Policy and all matters related to the handling of personal data through this portal shall be governed by and construed in accordance with the laws of the Republic of Indonesia. Any disputes arising from or in connection with this policy shall be resolved through good-faith deliberation, or failing which, submitted to the exclusive jurisdiction of the competent courts in the domicile of Jembatan Bahasa (Bali, Indonesia).

13 Contact Us & Data Protection Inquiries

To exercise any of your data rights, submit questions regarding this policy, or report a suspected data security concern, please contact our designated privacy administration team: