Privacy Policy of Wafa SiMumtaz

Effective date: 5 October 2026  ·  Last updated: 5 October 2026  ·  Applies to: simumtaz.wafaindonesia.or.id, including certificate request forms and certificate (syahadah) links

SiMumtaz is Wafa Indonesia’s munaqosyah management system. Munaqosyah is the Quran proficiency examination that concludes learning with the Wafa method. Partner institutions use SiMumtaz to apply for munaqosyah and register their students and teachers as participants. Wafa staff and examiners (munaqisy) use it to schedule examinations, record and validate scores, and issue certificates (sertifikat, syahadah and piagam).

This Privacy Policy explains what personal data SiMumtaz processes, why, who we share it with, how long we keep it and what rights you have. It is written in line with Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (the “PDP Law”).

1. Who we are

SiMumtaz is operated by Yayasan Syafa’atul Qur’an Indonesia (YAQIN), known as Wafa Indonesia (“Wafa”, “we”, “us” or “our”), a foundation established under the laws of the Republic of Indonesia. Wafa Indonesia is the personal data controller for the processing described in this policy. Sign-in to SiMumtaz is provided by the Wafa SSO Portal, which has its own privacy policy.

2. Whose data we process

• Users: Wafa staff (administrators, quality managers and score validators), administrators and Quran coordinators of partner institutions, and examiners;
• participants: students and teachers who take a munaqosyah examination;
• parents or guardians of student participants, whose phone number is recorded;
• contacts of external parties: organisations or individuals outside our partner network that apply for munaqosyah; and
• people who fill in a certificate request form or a certificate link.

3. Personal data we process

Students’ data is children’s data, which is specific personal data under Article 4 of the PDP Law. See section 11.

4. How we use your data and our legal bases

For children, we also rely on the consent of a parent or guardian, obtained by the institution (see section 11).

How results are determined: scores are entered by examiners and checked by Wafa validators. SiMumtaz then calculates the final score, predicate and pass/fail result automatically using predefined assessment criteria. If you believe a result is wrong, you or your institution can ask us to review it.

5. Certificates and their delivery

• Printed details. A certificate shows the participant’s name, place and date of birth, institution, test type, predicate and scores, plus a Wafa ID, a certificate number and a QR code.
• Public verification. Each certificate is registered with Wafa Certificate Verification (sertifikat.wafaindonesia.or.id). Anyone who scans the QR code or enters the code sees the certificate number, name, institution, test type, material covered, predicate and dates. Date of birth and detailed scores are not shown. Please share your certificate or QR code only with people who need to verify it.
• Delivery by email. Participants can request their certificate through a Google Form, entering their NIPS, name, institution, place and date of birth, phone number and email address. SiMumtaz updates the certificate with the confirmed details, creates a PDF and emails it through Brevo.
• Delivery by WhatsApp. Teachers receive a personal link by WhatsApp. After they confirm their name, place and date of birth and WhatsApp number, the certificate PDF is sent to that number through Fonnte. The confirmed details also update the teacher’s participant record.
• Institutions can download their participants’ certificates in SiMumtaz.

6. Who we share your data with

6.1 Within Wafa

• Partner institution administrators see only their own institution’s applications, participants, results and certificates.
• Examiners see only the participants assigned to them, usually through the Khidmah app.
• Wafa staff have access according to their role.
• SIFA receives participants, results and certificate details to keep partnership records.
• Wafa SSO receives participants’ names, and teachers’ own phone number and email address, to assign a Wafa ID.
• Wafa Certificate Verification receives the details shown on the public verification page, only when a code is checked.

6.2 Service providers

SiMumtaz also sends our munaqosyah product and price list to Odoo, our accounting system. This does not include any participant data.

6.3 Other disclosures

We may disclose personal data where required by law, a court order or a lawful request from a competent authority, or to protect the rights and safety of Wafa, participants or the public. We do not sell, rent or trade personal data.

7. International data transfers

Our servers are located in Singapore, so SiMumtaz data is stored outside Indonesia. Google and Brevo may also process data in other countries. Singapore (Personal Data Protection Act 2012) and the European Union (General Data Protection Regulation) have comprehensive data protection laws. We transfer personal data outside Indonesia only in accordance with Article 56 of the PDP Law: the destination country provides a level of protection equal to or higher than the PDP Law, or adequate and binding safeguards are in place, or, where neither applies, with your consent.

8. How long we keep your data

When the period ends, we delete the data or anonymise it so it can no longer identify anyone.

9. How we protect your data

• All connections are encrypted with HTTPS. Sign-in uses the Wafa SSO, and sessions are held in an HttpOnly, Secure cookie.
• Access is role-based: institutions see only their own data and examiners see only the participants assigned to them.
• Public forms and certificate links use long, random codes and are rate-limited to prevent guessing and abuse.
• Communication between Wafa systems is authenticated, digitally signed and runs over internal networks.
• The public verification page deliberately leaves out dates of birth and detailed scores.

If a personal data breach occurs, we will notify the affected people and the relevant authority in writing no later than 3 × 24 hours, as required by Article 46 of the PDP Law.

10. Cookies and similar technologies

We do not use advertising, analytics or tracking cookies in SiMumtaz. On a shared computer, always sign out when you finish.

11. Children’s data

We protect children’s data by:

• collecting only what the examination and certificate need;
• not recording a child’s own phone number or email address: we use the parent’s or guardian’s phone number instead;
• limiting access to the child’s institution, the assigned examiner and authorised Wafa staff; and
• never showing a child’s date of birth or detailed scores on the public verification page.

Parents or guardians can exercise their child’s rights by contacting us directly or through the institution.

12. Your rights

Under the PDP Law (Articles 5–13) you have the right to:

• be informed about who processes your data, why and on what basis;
• access your personal data and obtain a copy;
• correct or update data that is inaccurate or incomplete, for example a misspelled name on a certificate;
• end processing, delete or destroy your data, subject to legal exceptions (for example, the record of an issued certificate, which we must keep so it can be verified);
• withdraw consent where processing is based on consent;
• object to decisions based solely on automated processing;
• delay or restrict processing in proportion to its purpose;
• data portability: receive your data in a commonly used, machine-readable format and have it sent to another controller where technically feasible; and
• claim compensation for violations in the processing of your personal data, in accordance with the law.

To make a request, email [email protected] with the subject “Privacy Request – SiMumtaz”, stating the participant’s name, institution, NIPS or certificate number if known, your relationship to the participant, and what you would like us to do. Institutions may also forward requests on behalf of their students and teachers. We may need to verify your identity first. We will respond within the time limits set by the PDP Law (for many requests, no later than 3 × 24 hours after we receive a complete and verified request). If we cannot fulfil a request, we will explain why. You may also lodge a complaint with the personal data protection authority in Indonesia.

13. Changes to this policy

We may update this policy when our services or the law change. We will publish the updated version on this page and change the “Last updated” date. For significant changes, we will also inform partner institutions before the changes take effect.

14. Contact us