Privacy Policy

1. Who we are, and our role over your data

PT Javaman Digieco International builds and operates Alidaya, an HR system used by labour supply companies to manage their employees.

Our role over your data depends on who you are. The distinction matters because it decides where you send a request.

• If you are an employee whose data is in the system: the company you work for is the Data Controller. They decide what is collected and what for. PT Javaman Digieco International is the Data Processor — we store and process that data on their instructions, not on our own initiative. Requests about your data go to your company's HR first.
• If you are a job applicant who applied through the careers portal on this site: PT Javaman Digieco International is the Data Controller for your application, and passes it on to the company that posted the vacancy.

This policy is issued by PT Javaman Digieco International and follows Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP).

2. The personal data we collect

This list names what is actually stored in the system, not a generic catalogue.

The national ID number, family card number and biometric data are specific personal data under UU PDP and receive the stricter treatment described in sections 5 and 9.

3. What the data is used for

• Recording attendance, lateness, overtime and leave.
• Calculating salary, allowances, deductions, tax and BPJS contributions, and issuing payslips.
• Creating and renewing employment contracts.
• Invoicing service fees to the company using the workforce.
• Verifying that the person clocking in is who they say they are, and is at their assigned site.
• Running recruitment: receiving applications, scheduling interviews, communicating outcomes.
• Sending schedule notifications, announcements and task reminders.
• Handling incidents, disciplinary matters and employment legal cases.
• Meeting reporting obligations to government agencies and the social security administrator.
• Keeping the system secure and investigating misuse of access.

4. Legal basis for processing

• Performance of the employment agreement — most employee data processing rests on this: without it salary cannot be paid and the contract cannot be carried out.
• Legal obligation — tax, BPJS and labour reporting.
• Your consent — for face data, location, camera and microphone. Consent can be withdrawn at any time; see section 11.
• Legitimate interest — system security and preventing attendance fraud.

5. Face data (biometrics)

The system stores your face photo and a mathematical template derived from it. That template is used for one thing only: confirming that the person clocking in is you, and not someone else holding your device.

• Matching runs on the face recognition service we operate for this purpose. It is not sent to search engines, social networks or any advertiser.
• The face template is not used to identify you outside the app, is not matched against anyone else’s database, and is not used to judge emotion, age or character.
• You may refuse face enrolment. Your attendance is then verified another way provided by HR — refusing does not stop you working.
• Your face photo and template are deleted when you withdraw consent, or when your employment data is deleted under section 10.

6. Location, including background location

The app requests location permission, including background location. Here is the honest account of it.

• When location is taken: when you press clock-in, clock-out, or complete a patrol checkpoint. What is stored is the coordinate at that moment, not a trace of your movements through the day.
• Why background permission is needed: patrols and location-based reminders at an assigned site have to keep working when the screen is off or the app is not open. Without that permission, those features stop.
• Outside working hours: your location is not taken outside the hours and days recorded on your schedule.
• Refusing or withdrawing: you can revoke location permission at any time in your device settings. Location-based attendance then stops working and attendance has to be verified manually by HR.

7. Camera, gallery, microphone and meeting recordings

• The camera is used for attendance selfies, patrol photos and daily task evidence photos. It is only active while you have that screen open.
• The gallery can be chosen as the source for daily task report photos. The system records that such a photo came from the gallery rather than being shot live, so the verifying supervisor can tell the difference. We only read the image you pick, never the rest of your gallery.
• The microphone is used only in online meetings, and only while the meeting is running.
• Meeting recordings are kept when the meeting host turns recording on. Participants see an indicator that the meeting is being recorded before it starts.
• Photos and recordings are never captured silently. Nothing is recorded outside an action you start yourself, except the meeting recording flagged above.

8. Who we share data with

• Your employer and the company using the workforce — only as far as placement, attendance and invoicing require.
• Banks — name and account number, to pay salaries.
• Government agencies and BPJS — only as far as reporting obligations require.
• The technical service providers we use — the face recognition service, Google's Firebase Cloud Messaging for notifications, file storage, and our server provider. They are bound to use the data only on our instructions.
• Law enforcement — only on a request that is lawful.

Google's notification service may process device tokens outside Indonesia. Those tokens carry no personal data about you beyond a device identifier.

9. How we secure the data

• Encryption at rest for the most sensitive fields: national ID number, phone number, address, bank account number, tax number and BPJS numbers. These are stored encrypted, not as plain text.
• Encryption in transit (HTTPS) for all app and website traffic.
• Role-based access: HR, finance and supervisors see only what their job requires. Internal staff salary data is restricted separately.
• An audit trail over changes to important data, so any change can be traced to who made it and when.
• Passwords are stored hashed, never in their original form.

No system is completely secure. If a personal data breach occurs, we will notify you and the authorities within 3×24 hours of becoming aware of it, as UU PDP requires.

10. How long data is kept

• Employment data is kept while you work with us, plus the retention period after employment ends that labour and tax law require.
• Payroll data and tax documents follow the retention period required by tax regulation.
• Biometric data and attendance photos are deleted sooner: when consent is withdrawn, or when employment ends and they are no longer needed for an ongoing dispute.
• Unsuccessful applicants' data is kept for at most 12 months so we can offer other vacancies, unless you ask for deletion earlier.

11. Your rights over your personal data

Under UU PDP you have the right to:

• Know what data about you is processed, and what for.
• Obtain a copy of your data.
• Correct data that is wrong or incomplete.
• Request deletion, as far as it does not conflict with an obligation that still applies.
• Withdraw consent you have given — in particular for face data, location, camera and microphone.
• Object to a decision made entirely automatically that has a legal effect on you.
• Lodge an objection and claim compensation for a personal data protection breach.

12. Deleting your account and data

To request deletion of your Alidaya account and the data that goes with it, email managerit@javaman-digieco.id from your registered address, stating your full name and the company you work for.

• What is deleted: your account and credentials, face photo and template, attendance photos, location history, chat contents and device tokens.
• What is retained: payroll records, employment contracts and tax documents, for the retention period regulation requires. We cannot delete these earlier — that is a legal obligation of the company you work for, not a choice of ours.
• How long it takes: requests are processed within 30 calendar days.

13. Children

Alidaya is intended for workers and job applicants aged 18 and over. We do not knowingly collect data about children. If such data reaches the system without a lawful basis, tell us and we will delete it.

14. Changes to this policy

This policy may change as the system or the regulations change. The update date is always shown at the top of the page. For a change that materially affects you — a new kind of data or a new purpose, for instance — we will notify you in the app before it takes effect.

15. Contacting us

If our answer does not satisfy you, you have the right to complain to the authority responsible for personal data protection in Indonesia.