Privacy Policy

1. Introduction

This Privacy Policy explains how PT. Kaldu Sari Nabati ("Company", "we", "us", or "our") collects, uses, stores, discloses, and protects information when you ("User", "Employee") use the HC Portal mobile and web application (the "App"). HC Portal is an internal employee attendance and human capital management application provided for employees of PT. Kaldu Sari Nabati and affiliated entities under the Nabati Group (permanent, contract, and internship staff).

By installing, accessing, or using the App, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Account & Identity Information

Employee ID (NIK), full name, email address, phone number.
Position, department, branch/outlet assignment, supervisor relationship.
Authentication credentials (password is stored in hashed form).

2.2 Location Information (Precise & Approximate Location)

The App collects precise location data (GPS coordinates: latitude and longitude) and approximate (network-based) location from your device. This data is essential for the core attendance functionality of the App.

Aspect	Details
Type of location data	Precise location (GPS) and approximate location (network / Wi-Fi based).
When it is collected	Only when you actively perform the following actions inside the App (foreground only): Check-in (clock-in) at the start of your working shift. Check-out (clock-out) at the end of your working shift. Recording outlet visits or field activities (for sales/field staff). The App does not collect location in the background and does not track your location outside of these actions.
Why it is collected (purpose)	To verify that the employee is physically present at a valid designated work location (office, factory, outlet, or assigned area) when recording attendance. To prevent attendance fraud (e.g. remote clock-in by unauthorized parties). To validate field/outlet visits for sales and operational roles.
How it is used	Location coordinates are attached to the attendance record and compared against approved company work locations. The result is used solely for HR attendance validation, payroll computation, and operational audit.
Sharing of location data	Location data is not sold and is not shared with any third party for advertising, analytics, or marketing purposes. It is accessible only to authorized HR personnel and your direct supervisor within PT. Kaldu Sari Nabati / Nabati Group for the purposes stated above.
Retention	Location records attached to attendance data are retained for the duration of your employment and for up to 5 (five) years after the end of employment, in accordance with Indonesian labor and tax record-keeping regulations, after which they are deleted or anonymized.
User control	You may revoke location permission at any time via your device settings (Settings → Apps → HC Portal → Permissions → Location). Please note that disabling location permission will prevent you from performing check-in and check-out through the App.

2.3 Camera & Photo

The App may access the camera to capture a selfie photo during check-in/check-out for face verification and to capture supporting documents (e.g. medical certificates for sick leave, document photos for leave requests).
Photos are stored together with the related attendance or leave record and are used only for verification and HR documentation.

2.4 Device & Technical Information

Device model, operating system version, unique device identifier, and App version — used to detect device changes (for fraud prevention) and for technical support.
Log data such as access timestamps and error logs — used for security monitoring and troubleshooting.

2.5 Attendance & HR Data

Check-in / check-out timestamps and status (on time, late, AWOL, etc.).
Leave requests, shift changes, overtime submissions, approvals, and related supporting documents.

3. How We Use Your Information

The information collected is used solely for legitimate internal human capital purposes, including:

Recording and validating employee attendance (check-in & check-out).
Processing leave, overtime, shift change, and related HR submissions.
Calculating payroll, allowances, and disciplinary actions related to attendance.
Ensuring the security of the App and preventing misuse or fraudulent attendance.
Providing technical support to employees.
Complying with applicable Indonesian labor, tax, and data protection regulations.

4. Legal Basis

We process your data based on the following legal grounds under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP):

Performance of an employment contract — attendance and location recording is necessary to fulfill the employment relationship.
Legal obligation — record-keeping for labor, tax, and social security purposes.
Legitimate interest — preventing attendance fraud and ensuring operational integrity.
Consent — where required by applicable law, obtained at the time of first use of the App.

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. Your personal data will not be shared with any third party, except in the following limited cases:

Within the Nabati Group — authorized HR, payroll, and supervisory personnel of PT. Kaldu Sari Nabati and affiliated entities that employ you.
Service providers — trusted infrastructure providers (cloud hosting, database) that process data strictly on our instructions and under confidentiality obligations. These providers cannot use your data for their own purposes.
Legal obligations — when required by law, court order, or a valid request from Indonesian government authorities.

6. Data Retention

Attendance and location data: retained during employment and up to 5 years after termination, in line with labor and tax regulations.
Leave documents and supporting files: retained up to 5 years after the end of the related fiscal year.
Account data: deleted or anonymized within a reasonable period after employment ends, unless retention is required by law.

7. Data Security

All data transmissions between the App and our servers use HTTPS (TLS) encryption.
Passwords are stored using one-way hashing; we never store plain-text passwords.
Access to HR data is restricted to authorized personnel through role-based access control.
Servers are hosted on secured infrastructure operated by PT. Kaldu Sari Nabati or trusted providers within Indonesia.
We maintain audit logs and monitor for unauthorized access.

8. Your Rights

As a data subject, you have the following rights under UU PDP No. 27/2022:

Right to access and obtain a copy of your personal data held by us.
Right to rectify inaccurate or incomplete data.
Right to request deletion of your data (subject to legal retention obligations).
Right to withdraw consent, where processing is based on consent.
Right to restrict or object to processing.
Right to lodge a complaint with the competent data protection authority.

To exercise any of these rights, please contact us using the contact details in Section 12.

9. Permissions Requested by the App

Permission	Purpose	Required?
Location (ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION)	To record precise GPS location at the moment of check-in and check-out to verify presence at the designated work site.	Required for attendance
Camera	To capture selfie for face verification during attendance, and to photograph supporting documents for leave/overtime requests.	Required for attendance & leave
Storage / Photos & Media	To attach supporting documents (e.g. medical certificates) to leave requests.	Optional
Internet / Network state	To communicate securely with our servers.	Required
Notifications	To deliver approval statuses, schedule reminders, and HR announcements.	Optional

10. Children's Privacy

The App is intended strictly for employees of PT. Kaldu Sari Nabati and affiliated Nabati Group entities, who are of legal working age. The App is not directed to, and we do not knowingly collect personal data from, children under the age of 18.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the App and/or through official internal channels. The "Last Updated" date at the top of this page indicates when the policy was last revised. Continued use of the App after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us at:

Data Controller: PT. Kaldu Sari Nabati
Address: Jl. Soekarno-Hatta No. 410, Bandung, West Java, Indonesia
Email (HR / Data Privacy): hrd@nabatisnack.co.id
Website: https://hcportal.nabatisnack.co.id

HC Portal — Employee Attendance Application