Privacy Policy

1. Who we are

Pathvance is a multi-institution career development and examination management platform operated by PT Pathvance, headquartered in Jakarta, Indonesia. Each partner school is provisioned as a separate institution with isolated data. The school is the data controller for its students' records; Pathvance acts as the data processor on the school's instructions, except where we determine processing purposes ourselves (for example, security and platform integrity), in which case we act as a joint controller.

2. Personal data we process

We process the following categories of personal data, depending on the user's role:

• Identity data: full name, date and place of birth, gender, religion, nationality, photo.
• National identifiers (optional): NISN (10 digits), NIK (16 digits, encrypted at rest), NPSN for schools, NUPTK for teachers.
• Contact data: address, phone number, email address.
• Academic and assessment data: grade level, assessment responses, raw and normalized scores, cumulative scores, generated PDF reports.
• Account data: hashed passwords, login activity, audit logs of critical actions.
• Technical data: IP address, browser and device information, session cookies for authentication.

3. Legal basis for processing

We rely on the following lawful bases under UU PDP Article 20:

• Consent — obtained from the school during onboarding, and from parents or guardians for students under the age of majority.
• Performance of a contract — to deliver the Service to the school under our subscription agreement.
• Legitimate interest — to operate, secure, and improve the platform, including aggregated analytics that do not identify individuals.
• Legal obligation — to retain educational records as required by Indonesian education regulations.

4. How we use personal data

Personal data is used to: provision and authenticate accounts; deliver and score the six career assessments (MBTI, RIASEC, DISC, Multiple Intelligence, Learning Style, School Adaptation); generate PDF reports; provide longitudinal career recommendations; allow schools and counselors to support student development; and comply with legal and regulatory obligations. We do not sell personal data, and we do not use student responses for advertising.

5. Children's data

The Service is used by students who may be minors under Indonesian law. Student accounts are not self-registered — they are provisioned by the partner school, which obtains the necessary consent from parents or legal guardians prior to onboarding. Parents and guardians may access, correct, or request deletion of their child's data at any time by contacting the school or Pathvance directly.

6. Data subject rights

Under UU PDP Articles 5–14 you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of personal data, subject to retention obligations described below.
• Restrict or object to certain processing activities.
• Receive a portable copy of your data in a structured, machine-readable format.
• Withdraw consent at any time (this does not affect the lawfulness of processing carried out before withdrawal).
• Lodge a complaint with the Indonesian personal data protection authority.

To exercise these rights, contact your school administrator (for student and parent data) or email privacy@pathvance.com.

7. Security

We apply organizational and technical safeguards proportionate to the sensitivity of the data:

• NIK and other sensitive identifiers are encrypted at rest using AES-256-GCM.
• All transport is protected by TLS 1.2 or higher.
• Access tokens live in browser memory; refresh tokens are issued as httpOnly, secure cookies.
• Database access uses parameterized queries and role-scoped credentials following the principle of least privilege.
• multi-institution queries are scoped by institution_id at the middleware layer; cross-institution access is restricted to a dedicated super-admin role.
• Critical actions are written to an immutable audit log.

8. Retention

Student academic records, assessment responses, scores, and generated reports are retained for at least 20 years from the date of creation, in line with the expectation that career and education data should remain accessible to the student throughout their working life. Account credentials and authentication metadata are retained for as long as the account is active. When personal data is no longer needed, it is soft-deleted and then irreversibly removed during scheduled purges. We do not perform hard deletes of academic data.

9. Third-party processors

We use a small number of trusted sub-processors to operate the Service:

• Cloud hosting and container orchestration (Coolify infrastructure).
• Managed PostgreSQL provider (e.g. Supabase, Neon, or Railway).
• Object storage for PDF reports and uploaded photos.

Each sub-processor is bound by a data processing agreement and is selected for its compliance posture. A current list is available on request.

10. International transfers

Where personal data is transferred outside the Republic of Indonesia (for example, because a cloud region sits abroad), we ensure the destination country provides an equivalent level of protection or rely on contractual safeguards permitted under UU PDP Article 56.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to partner schools and, where appropriate, to end users at sign-in. The "last updated" date above always reflects the current version.

12. Contact

For questions about this policy or to exercise your rights, contact us at privacy@pathvance.com. For general inquiries, hello@pathvance.id. Mailing address: PT Pathvance, Jakarta, Indonesia. TODO: replace with the registered office address before launch.