Your data, and what we do with it
A plain account of what this website collects, why, how long we keep it, and what you can ask us to do about it. Written to meet Law 27 of 2022 on Personal Data Protection.
Last updated:
The short version
- What we collect
- Only what you type into a form: a tour request, or an email address.
- Why
- To arrange the visit you asked for and to answer you. Nothing is sold.
- How long
- Tour requests for 24 months after our last contact. Newsletter until you leave.
- Your rights
- See it, correct it, delete it, or take your consent back. Email us and we act.
The policy in full
Who we are
KYZN Preschool is run by Yayasan Bintang Muda Indonesia, a foundation registered in Indonesia. Under Law 27 of 2022, the foundation is the controller of the personal data described on this page.
Our office address, our email and our WhatsApp number are at the foot of this page. Every request about your data goes to one of those three.
What this policy covers
This website, kyzn.sch.id, and the two forms on it: the tour request and the newsletter sign-up.
It does not cover the records the school keeps once a child is enrolled. Those are governed by the enrolment agreement you sign, which sets its own terms for school records, photographs, medical notes and the parent app.
What we collect
Only what a form asks for. Nothing on this site gathers anything in the background.
When you request a tour
- Your child's name and date of birth
- The campus you want to visit
- Your own name
- Your phone number and email address
- The morning and time you chose
When you sign up to the newsletter
- Your email address, and nothing else
Article 4 of the law treats a child's data as specific personal data, which carries a higher duty of care. A date of birth is on that form because it decides which room a child would visit, and for no other reason.
Why we collect it, and on what basis
A tour request is processed to arrange the visit and to reply to you afterwards. The basis is your consent under Article 20(2)(a), given when you send the form, together with the steps taken at your request before any agreement, under Article 20(2)(b).
A newsletter address rests on consent alone, and withdrawing it takes one click in any email we send.
We do not sell personal data, we do not build profiles from it, and no decision about your child is made by a machine.
Your child's data
Article 25 requires that consent for a child's personal data comes from a parent or guardian. Completing a tour form is you giving that consent for your own child, which is why the form asks for your name beside theirs.
We ask for as little as we can. A name and a date of birth is enough to place a child in the right room for one morning, and a tour form is not the place to ask about health, allergies or anything else.
If somebody has sent us a form about your child and it was not you, tell us and we will delete it.
How long we keep it
- Tour requests: 24 months after our last contact with you, then deleted
- Newsletter addresses: until you unsubscribe, then removed from the list
- Anything we no longer have a reason to hold: deleted, whether or not you ask
If your child enrols, what you put on the tour form becomes part of the school record and is kept on the terms of the enrolment agreement instead of these.
Who else sees it
Inside the school: the admissions team, and the teachers at the campus you asked to visit.
Outside the school: nobody, apart from the providers who run our email and host this website. They act on our instructions, may not use your data for their own purposes, and are held to that in writing, as Article 51 requires.
We hand personal data to an authority only where a law or a valid court order requires it.
Data outside Indonesia
Our email and hosting providers may hold data on servers outside Indonesia. Article 56 permits that only where the destination protects personal data at least as well as Indonesian law does, or where adequate safeguards are in place. We hold our providers to it.
Ask us and we will tell you which providers we use and where your data sits.
How we protect it, and what happens if that fails
The site is served over HTTPS. Access to what a form sends is limited to the staff who need it, and taken away when they no longer do.
No system is beyond failure. If personal data is exposed, Article 46 gives us 3x24 hours to notify you and the supervisory authority in writing. You would be told what was exposed, what it means for you, and what we are doing about it.
Changes, and how to complain
When this policy changes, the date at the top of the page changes with it. A change that affects data we already hold will be told to you directly rather than left here to be found.
If our answer does not satisfy you, Law 27 of 2022 gives you the right to complain to the supervisory authority it establishes, and to take the matter to court.
Your eight rights under the law
Send any of these to the email or WhatsApp number below. The law sets a deadline of 3x24 hours for most requests about personal data, and that is the clock we work to.
Know what we hold
Ask what personal data we hold about you or your child, where it came from, and what we are doing with it.
See it, and get a copy
Ask for the data itself, in a form you can read, rather than a description of it.
Correct it
A misspelled name, the wrong birth date. Tell us and we will fix it, and tell anyone we passed it to.
Have it deleted
Ask us to delete or destroy what we hold, unless a law requires us to keep it for longer.
Withdraw your consent
Take back a consent you gave. What we did before you withdrew stays lawful, and everything after it stops.
Object to automated decisions
Object to any decision made about you by a machine alone, and ask a person to make it instead. Nothing here works that way today.
Delay or limit what we do
Ask us to pause while a correction or an objection is still being sorted out.
Take it with you
Receive your data in a common, machine-readable format, and ask us to send it on where that is technically possible.
Ask us anything about this
Write in Indonesian or in English. Tell us what you want and which child or which address it concerns, and we will do the rest.
Data controller
Yayasan Bintang Muda Indonesia
- Address
- 2nd Floor, Building A, KYZN Building, Jl. Karet Sawah II No. 216, Setiabudi, South Jakarta 12930
- +62 811-8601-000
We answer requests about personal data within 3x24 hours, which is the deadline the law sets.
This policy is published in English, Bahasa Indonesia and Simplified Chinese. Where the three differ, the Indonesian text governs.