Privacy Policy of Wafa Khidmah

Posted on | by Wafa Indonesia

Effective date: 5 October 2026  ·  Last updated: 5 October 2026  ·  Applies to: khidmah.wafaindonesia.or.id

Khidmah Wafa is the work app for Wafa Indonesia’s professional staff (SDM Profesional): munaqosyah examiners (munaqisy), trainers, academy teachers and others assigned to Wafa activities. It brings your profile, your schedule and your munaqosyah grading together in one app that works on your phone, tablet or computer.

Khidmah does not keep its own database. It shows and updates data held in three other Wafa systems: Wafa SSO (your account), SIFA (your professional profile and assignments) and SiMumtaz (munaqosyah participants and scores). This Privacy Policy explains how Khidmah handles personal data, in line with Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (the “PDP Law”).

At a glance

  • You sign in with your Wafa Account, and Khidmah reads your name, contact details and Wafa ID from Wafa SSO.
  • Your biodata, fields of expertise and competency levels come from SIFA. You can update some of them in the app.
  • When you grade a munaqosyah, you see the participants assigned to you, who are often children. The scores you enter are saved in SiMumtaz.
  • If your connection drops while grading, scores wait on your device and are sent automatically when you are back online.
  • Khidmah keeps only your sign-in session and a short-lived cache on our servers. We never sell your data.
  • Our servers are located in Singapore.
  • To exercise your rights, contact [email protected].

1. Who we are

Khidmah is operated by Yayasan Syafa’atul Qur’an Indonesia (YAQIN), known as Wafa Indonesia (“Wafa”, “we”, “us” or “our”), a foundation established under the laws of the Republic of Indonesia. Wafa Indonesia is the personal data controller for the processing described in this policy. The Wafa SSO Portal, SIFA and SiMumtaz each have their own privacy policy describing how they store your data.

2. Personal data we process

Category What it includes Where it comes from
Your account Name, email address, WhatsApp number, Wafa ID, roles, and whether you have set a password or still have a temporary email address. Wafa SSO.
Your professional profile Full name, gender, place and date of birth, address, province and city, fields of expertise, competency levels, qualifications and education history. SIFA; you, when you edit your biodata.
Assignments and schedule Activities you are assigned to, your role, dates, places and institutions. SIFA; SiMumtaz.
Munaqosyah grading Participants assigned to you (name, institution, category, test type and target material), attendance, the scores you enter per aspect and juz, participants you add at the last minute (name, gender, category, test type and target), and your grading history and statistics. SiMumtaz; you.
Contact details you add A new email address or WhatsApp number and the one-time code that confirms it (handled by Wafa SSO). You.
Session and technical data Session identifier, IP address (passed on to SIFA and SiMumtaz for their security logs), request identifiers and technical logs. Generated automatically.

Your email address and WhatsApp number belong to your Wafa Account, so Khidmah shows them but does not change them. You can add a missing email address or number in the app. To change an existing one, use the Wafa SSO Portal or contact us.

3. How we use your data and our legal bases

Purpose Legal basis (PDP Law, Art. 20)
Sign you in and show your profile, schedule, competency levels and tasks. Fulfilment of an agreement (your engagement with Wafa); legitimate interests.
Let you keep your biodata in SIFA accurate. Fulfilment of an agreement; legitimate interests (accurate records).
Let you grade munaqosyah participants, including without an internet connection. Fulfilment of an agreement; legitimate interests.
Let you add an email address or WhatsApp number to your Wafa Account. Fulfilment of an agreement; legitimate interests (account security).
Keep the app secure and fix problems. Legal obligations as an electronic system operator; legitimate interests.

Your competency levels and incentive rates are calculated in SIFA, as explained in the SIFA privacy policy. Khidmah only displays them. We do not use your data for advertising.

4. Who we share your data with

4.1 Within Wafa

Khidmah exchanges data only with Wafa SSO, SIFA and SiMumtaz, and only through a fixed list of permitted functions. It sends your sign-in token, IP address and a request identifier with each request. It does not pass on cookies.

4.2 Service providers

Provider What they do Data involved Location
Contabo Cloud servers that host Khidmah. Sessions, short-lived cache and the data passing through the app. Singapore
Google (Google Fonts) Provides the fonts used in the app. IP address and browser information. Global

One-time codes for adding an email address or WhatsApp number are sent by Wafa SSO through its email and WhatsApp providers, as described in the Wafa SSO Portal privacy policy.

We may disclose personal data where required by law, a court order or a lawful request from a competent authority. We do not sell, rent or trade personal data.

5. International data transfers

Our servers are located in Singapore, which has a comprehensive data protection law (the Personal Data Protection Act 2012). We transfer personal data outside Indonesia only in accordance with Article 56 of the PDP Law: the destination country provides a level of protection equal to or higher than the PDP Law, or adequate and binding safeguards are in place, or, where neither applies, with your consent.

6. How long we keep your data

Data How long
Sign-in session Up to 30 days, or until you sign out or your Wafa Account session is ended.
Profile cache on our server 5 minutes.
Scores waiting on your device Until they are sent successfully, then removed automatically.
Technical logs 30 days (performance traces: 7 days).
Your profile, assignments and scores Kept in SIFA, SiMumtaz and Wafa SSO for the periods set out in their privacy policies.

7. How we protect your data

  • All connections are encrypted with HTTPS, and sign-in uses your Wafa Account.
  • Your session is held in an HttpOnly, Secure cookie. When your Wafa Account is signed out elsewhere or deactivated, your Khidmah session ends too.
  • Khidmah can only reach a fixed list of functions in SIFA and SiMumtaz, so it cannot be used to read other data held there.
  • You see only your own profile and the participants of activities assigned to you.
  • Scores are never stored in the app’s offline cache. Only unsent scores wait in a dedicated queue on your device.

Please help us: use a screen lock on your device, do not share your account, sign out on shared devices, and do not copy, photograph or share participants’ data outside the app. If a personal data breach occurs, we will notify the affected people and the relevant authority in writing no later than 3 × 24 hours, as required by Article 46 of the PDP Law.

8. Cookies and data stored on your device

Name Type Purpose Duration
khidmah_session Strictly necessary cookie Keeps you signed in. Up to 30 days, or until sign-out.
Unsent score queue IndexedDB on your device Holds scores entered while offline until they can be sent. Until sent successfully.
App cache Service worker Stores application files, images, fonts and reference lists so the app loads quickly and can be installed. It does not store scores. Until updated or removed.
Preferences Local and session storage Remembers light/dark mode, and briefly notes your last sign-in attempt to avoid repeated redirects. Until you clear browser data (session storage: until you close the tab).

We do not use advertising, analytics or tracking cookies in Khidmah.

9. Participants’ data and children

Many munaqosyah participants you grade are children. Their data comes from their institutions through SiMumtaz and is handled as described in the SiMumtaz privacy policy, in line with Article 25 of the PDP Law. In Khidmah you see only the participants of activities assigned to you, and only the data needed to grade them. As an examiner, you must use this data only for your assignment and keep it confidential.

10. Your rights

Under the PDP Law (Articles 5–13) you have the right to:

  • be informed about who processes your data, why and on what basis;
  • access your personal data and obtain a copy;
  • correct or update data that is inaccurate or incomplete;
  • end processing, delete or destroy your data, subject to legal exceptions;
  • withdraw consent where processing is based on consent;
  • object to decisions based solely on automated processing;
  • delay or restrict processing in proportion to its purpose;
  • data portability: receive your data in a commonly used, machine-readable format and have it sent to another controller where technically feasible; and
  • claim compensation for violations in the processing of your personal data, in accordance with the law.

You can view your data and update parts of your biodata directly in the app. For anything else, email [email protected] with the subject “Privacy Request – Khidmah”, stating your name, your Wafa ID if you know it, and what you would like us to do. We may need to verify your identity first. We will respond within the time limits set by the PDP Law (for many requests, no later than 3 × 24 hours after we receive a complete and verified request). You may also lodge a complaint with the personal data protection authority in Indonesia.

11. Changes to this policy

We may update this policy when the app or the law changes. We will publish the updated version on this page and change the “Last updated” date. For significant changes, we will also notify you in the app or by WhatsApp or email.

12. Contact us

Wafa Indonesia – Yayasan Syafa’atul Qur’an Indonesia
Jl. Raya Wisma Pagesangan No. 9, Menanggal, Gayungan, Surabaya, East Java 60234, Indonesia
Email: [email protected]
WhatsApp Helpdesk: +62 811-3058-9310
Phone: +62 31 9904 3404
Office hours: Monday–Friday 08.00–16.00 WIB, Saturday 08.00–12.00 WIB

Post Views: 1

Leave a Reply