Privacy Policy

Controller: Universitas Islam Sultan Agung (UNISSULA), Jl. Raya Kaligawe Km. 4, Terboyo Kulon, Genuk, Semarang, Central Java 50112, Indonesia.

Operational unit: Biro Sistem Informasi (BSI), UKM Building, UNISSULA campus. Service desk: bsi@unissula.ac.id · +62 857-0047-3695 · https://si.unissula.ac.id

Privacy, access, correction, incident, and data-request matters should be submitted through the official BSI service desk so they can be logged, verified, and answered.

This notice covers personal data processed in SIM and in systems that authenticate or exchange data with SIM (for example academic, finance, human resources, library, repository, and quality modules), when you use an UNISSULA account (NIK/NIM) or an authorised institutional role.

We process only data that is relevant and limited to the service you use. Depending on your role, this may include:

• Identity and account data: name, NIK/NIM, user ID, date of birth, gender, photograph, nationality, and authentication credentials.
• Contact data: campus or registered address, email, and telephone number.
• Academic data: study programme, enrolment status, courses, grades, thesis, graduation, scholarships, and student-evaluation (EDOM) records.
• Employment data (staff): unit, position, workload, and related personnel records needed for campus services.
• Financial and administrative data related to tuition, billing, disbursement, or official letters, limited to authorised finance modules.
• Technical and security data: login time, IP address, device/browser metadata, session cookies, and audit logs.
• Quality and accreditation evidence: learning outcomes, assessment artefacts, and aggregated indicators used for internal quality assurance and external review.

As an Islamic university, SIM may process limited data that Indonesian law treats as specific personal data (for example religion, where required for institutional services). Health-related or other sensitive fields are processed only when necessary for a defined academic or administrative purpose, with stricter access control.

We do not use sensitive data for marketing or for automated profiling that produces legal or similarly significant effects without human review.

Processing is based on one or more of the following, as applicable under UU PDP and higher-education regulations:

• Performance of education and employment contracts and related academic administration.
• Compliance with legal obligations (among others reporting to the Ministry of Higher Education / PDDIKTI, taxation, and archival rules).
• Public-interest and university tasks in teaching, research, student services, and quality assurance.
• Vital interests or security of the campus information environment (fraud prevention, incident response).
• Consent, only where a purpose is optional and not required by law or the core academic contract. Consent can be withdrawn without affecting the lawfulness of prior processing.

• Identity management, authentication, authorisation, and single sign-on to authorised campus services.
• Delivery of academic, financial, library, research, and administrative services.
• Official communication about studies, employment, billing, and service status.
• Information security, audit, business continuity, and incident handling.
• Internal quality assurance, outcome-based education (OBE), student feedback, and continuous improvement.
• Evidence for national and international accreditation and certification, preferably in aggregated, anonymised, or pseudonymised form whenever individual identification is not required.
• Fulfilment of statutory reporting and lawful requests from competent authorities.

We do not sell personal data. Disclosure is limited to:

• Authorised UNISSULA units and staff on a need-to-know, least-privilege basis.
• Integrated campus systems (for example library and repository) that receive only the attributes required for login and the service.
• Government systems required by law (for example PDDIKTI) and banks or payment partners strictly for tuition or disbursement processing.
• Accreditation and quality-review bodies when evidence of programme quality is required; student-level files are shared only if necessary and under confidentiality.
• IT service providers acting as processors under confidentiality and instruction of the University.
• Parties to whom disclosure is required by a valid legal obligation or court order.

SIM is operated for UNISSULA in Indonesia. If a transfer outside Indonesia is necessary (for example a cloud component, an accreditation review, or an international mobility process), we apply contractual and technical safeguards and transfer only the data that is needed.

Where an accreditation agency is established in the European Economic Area, data are provided for quality-review purposes under confidentiality, with preference for aggregated statistics.

Data are kept only as long as needed for the purpose or as required by law and university archives:

• Academic records of lasting evidential value (for example diplomas, transcripts) are retained in accordance with higher-education and archival rules.
• Financial documents follow applicable accounting retention periods.
• Authentication and security logs are retained for a limited operational and audit period, then deleted or anonymised.
• Session cookies last only for the login session or a defined “remember me” period.

BSI applies organisational and technical controls proportionate to the risk, including:

• Role-based access control and least privilege.
• Encrypted transport (HTTPS) for SIM in production.
• Audit logging of privileged and security-relevant activity.
• Documented incident-response and continuity procedures.
• Identity verification before honouring access, correction, or deletion requests.

No method of transmission or storage is perfectly secure. Users must keep credentials confidential and report suspected incidents immediately to BSI.

SIM uses strictly necessary cookies and session identifiers for login, security (including captcha/challenge), language preference on this page, and optional “remember me”. We do not use advertising cookies. You can block cookies in your browser; essential login functions may then be unavailable.

Access rights in SIM are assigned by role and organisational rules. SIM does not make solely automated decisions that produce legal or similarly significant effects (for example admission, grading, or dismissal) without human involvement in the responsible academic or administrative unit.

Some students may be under 18. Accounts and academic records are processed as part of the education service. Requests on behalf of a minor should be made by a parent or legal guardian through official channels, with identity and authority verified.

Subject to UU PDP and archival/legal exceptions, you may request:

• Access to personal data we hold about you in SIM.
• Rectification of inaccurate or incomplete data.
• Erasure or restriction, where the data are no longer needed and no legal retention duty applies.
• Objection to processing that is based on public-interest or legitimate-interest grounds, stating your reasons.
• Withdrawal of consent for optional processing.
• Information about the logic of role-based access that affects you.
• A complaint to the Indonesian personal-data protection supervisory authority under Law 27/2022, without prejudice to other legal remedies.

Academic records required by law cannot always be erased. We will explain any refusal and the remaining options.

Submit requests to bsi@unissula.ac.id. We verify identity (and authority, if you act for someone else) before processing. We aim to respond within a reasonable time consistent with UU PDP.

UNISSULA uses SIM data to monitor teaching, learning outcomes, student workload, and service quality, and to provide evidence for internal reviews and external accreditation.

For accreditation and similar quality-review agencies, published or submitted evidence is prepared so that individual students are not identifiable unless a review genuinely requires sample files. Reviewers are bound by confidentiality. Participation in teaching evaluation is used to improve programmes, not to market products.

We may update this notice when services, law, or accreditation requirements change. The current version is always published at this URL, with the “last updated” date above. Material changes that affect your rights will be highlighted on this page or announced through official campus channels.

My UNISSULA uses device location, including precise location when you allow it, to support attendance features for UNISSULA employees and lecturers. Location is used to display your position on a map and to check whether you are within the attendance area assigned to your account before daily or event attendance is recorded.

If you enable area-based attendance alarms and grant the required consent and permissions, My UNISSULA may access location in the background at scheduled check-in or check-out alarm times, including when the application is not in use or has been normally closed. The application first checks your attendance status with UNISSULA. If you have not attended, it obtains your location and verifies whether you are inside the assigned area. The alarm sounds only after both conditions are verified. This feature does not continuously track your location.

The comparison between your coordinates and the attendance area is performed on the device. Coordinates obtained for the alarm check are not sent to the attendance-status endpoint and are not stored as a travel history by this feature. Attendance requests may send your account number, device identity, operating-system information, and event identity when needed to UNISSULA servers. Maps use Google Maps and are also subject to Google’s Privacy Policy: https://policies.google.com/privacy.

Before requesting background location for an area-based alarm, the application explains the purpose and asks for your consent. You may deny background location and continue using attendance while the application is open, provided the required in-use location permission and other attendance requirements are met. You may disable the alarm in the Account notification/alarm settings or revoke location permission in your device settings. Revoking permission may limit maps, area verification, and alarms; it does not by itself delete attendance data already stored on UNISSULA servers.