Privacy Policy of Wafa SSO Portal

Effective date: 5 October 2026  ·  Last updated: 5 October 2026  ·  Applies to: sso.wafaindonesia.or.id and auth.wafaindonesia.or.id

The Wafa SSO Portal is the single sign-on service of Wafa Indonesia. With one Wafa Account you sign in once and open the Wafa applications you have access to, such as SIFA, SiMumtaz and Khidmah, without signing in again for each of them.

This Privacy Policy explains what personal data the Wafa SSO Portal processes, why we process it, who we share it with, how long we keep it and what rights you have. It is written in line with Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (the “PDP Law”) and its implementing regulations.

1. Who we are

The Wafa SSO Portal is operated by Yayasan Syafa’atul Qur’an Indonesia (YAQIN), known as Wafa Indonesia (“Wafa”, “we”, “us” or “our”), a foundation established under the laws of the Republic of Indonesia. For the purposes of the PDP Law, Wafa Indonesia is the personal data controller for the processing described in this policy. Our contact details are in section 14.

2. Scope of this policy

This policy covers personal data processed when you:

• create or use a Wafa Account, or an account is created for you by a Wafa administrator;
• sign in to the portal, or to a Wafa application through the portal;
• recover your password, set or change your password, add an email address or WhatsApp number, or manage your signed-in devices; and
• are registered in our Wafa ID registry by another Wafa application (this can happen even if you never sign in yourself).

Each Wafa application has its own privacy policy explaining how it uses your data after you sign in (SIFA, SiMumtaz, Khidmah, HRIS and Sertifikat). Some applications, such as HRIS, currently use their own sign-in and are only linked from the portal for convenience.

3. Personal data we process

The SSO Portal does not ask for specific (sensitive) personal data such as health, biometric or financial data.

4. How we use your data and our legal bases

Under Article 20 of the PDP Law we may only process personal data on a lawful basis. The table below shows each purpose and the basis we rely on.

Where we rely on legitimate interests, we have weighed them against your interests and rights. We do not use your data for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. How sign-in and verification work

• Password sign-in. You enter your email address or WhatsApp number and your password. The password is checked by our identity service, which we host ourselves using the open-source Zitadel software.
• WhatsApp one-time code. We send a 6-digit code to the WhatsApp number registered to your account. The code is valid for 5 minutes and can be tried at most 5 times. Requests are limited per number/email and per IP address.
• Protection against account discovery. The portal answers in the same way whether or not an email address or number is registered, so others cannot use it to find out who has an account.
• Forgotten password. For accounts with an email address, we email a reset link that is valid for 15 minutes. After a reset, your other portal sessions are signed out.
• Adding an email address. We email a verification code (valid for 10 minutes) to the new address, and send a WhatsApp notification to your registered number, with the email address partly hidden, so you will know if someone else did it.
• Adding a WhatsApp number. We send a verification code (valid for 5 minutes) to the new number by WhatsApp.
• My Devices. You can see where your account is signed in (browser and device, IP address, last activity) and sign out any session. Changing your password signs out your other sessions.
• Single sign-out. When you sign out of one Wafa application, we end your portal session and notify the other Wafa applications so they end your sessions as well. When an administrator deactivates your account or changes your roles, your sessions are ended or refreshed so the change takes effect quickly.
• Administrator access for support. In exceptional cases, such as technical support or investigating a problem, a small number of authorised administrators can open a session for an account through a tightly restricted mechanism. Every such access is recorded in the audit log.

6. Who we share your data with

6.1 Wafa applications

When you sign in, or when an application needs to refresh your access rights, we share your name, email address, WhatsApp number, Wafa ID, roles, job title and department (for staff) and links to your profiles with the Wafa application concerned (SIFA, SiMumtaz or Khidmah). HRIS, SIFA and SiMumtaz also use the Wafa ID registry to look up or create Wafa IDs. Each application uses this data as described in its own privacy policy.

6.2 Service providers

We use the following providers to run the service. They process data on our behalf and only for the purposes below.

6.3 Legal requirements

We may disclose personal data where required by law, a court order or a lawful request from a competent authority, or where necessary to protect the rights, property or safety of Wafa, our users or the public.

We do not sell, rent or trade personal data.

7. International data transfers

Our servers are located in Singapore, so data processed by the SSO Portal is stored outside Indonesia. Some service providers, such as Brevo (European Union) and Cloudinary (global network), may also process data in other countries. Singapore (Personal Data Protection Act 2012) and the European Union (General Data Protection Regulation) have comprehensive data protection laws. We transfer personal data outside Indonesia only in accordance with Article 56 of the PDP Law: the destination country provides a level of protection equal to or higher than the PDP Law, or adequate and binding safeguards are in place, or, where neither applies, with your consent.

8. How long we keep your data

9. How we protect your data

• All connections to the portal and identity service are encrypted with HTTPS.
• Passwords are never stored in plain text; they are protected with strong cryptography. Secrets used between Wafa systems are stored encrypted.
• Sign-in is protected by attempt limits, cooldown periods, rate limiting by number/email and IP address, and uniform responses that prevent account discovery.
• The session cookie is HttpOnly and Secure, so it cannot be read by scripts on the page. Sessions can be listed and ended at any time.
• Communication between Wafa systems is authenticated, digitally signed and runs over internal networks.
• Only authorised central staff can manage accounts and roles, and their actions are recorded in the audit log.
• Our logs are kept to the minimum needed to run and secure the service.

If a personal data breach occurs, we will notify you and the relevant authority in writing no later than 3 × 24 hours, as required by Article 46 of the PDP Law. No system is completely secure, so please keep your password and one-time codes to yourself. Wafa staff will never ask you for them.

10. Cookies and similar technologies

Our identity service at auth.wafaindonesia.or.id may also use strictly necessary cookies during sign-in. We do not use advertising, analytics or tracking cookies, and the portal’s fonts are served from our own servers. You can block or delete cookies in your browser, but without the session cookie the portal cannot keep you signed in.

11. Children

Wafa Accounts are intended for adults: Wafa staff, trainers, representatives of partner institutions and other adult participants. We do not knowingly create sign-in accounts for children without the involvement of a parent or guardian. The Wafa ID registry may contain records of children, for example students who take a munaqosyah examination, created by SiMumtaz or SIFA so that a Wafa ID can be printed on their certificates. These records cannot be used to sign in and are handled as described in the SiMumtaz and SIFA privacy policies, in line with Article 25 of the PDP Law.

12. Your rights

Under the PDP Law (Articles 5–13) you have the right to:

• be informed about who processes your data, why and on what basis;
• access your personal data and obtain a copy;
• correct or update data that is inaccurate or incomplete;
• end processing, delete or destroy your data, subject to legal exceptions (for example, records we must keep by law, or the minimum record needed to keep certificates verifiable);
• withdraw consent where processing is based on consent;
• object to decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you;
• delay or restrict processing in proportion to its purpose;
• data portability: receive your data in a commonly used, machine-readable format and have it sent to another controller where technically feasible; and
• claim compensation for violations in the processing of your personal data, in accordance with the law.

What you can do yourself: view and end your sessions on My Devices, set or change your password, and add an email address or WhatsApp number. To change or remove an existing email address or number, or for any other request, please contact us.

How to make a request: email [email protected] with the subject “Privacy Request – Wafa SSO Portal”, stating your name, the email address or number on your account, your Wafa ID if you know it, and what you would like us to do. We may need to verify your identity first. We will respond within the time limits set by the PDP Law (for many requests, no later than 3 × 24 hours after we receive a complete and verified request). If we cannot fulfil a request, for example because the law requires us to keep the data, we will explain why.

If you are not satisfied with our response, you may lodge a complaint with the personal data protection authority in Indonesia.

13. Changes to this policy

We may update this policy when our services or the law change. We will publish the updated version on this page and change the “Last updated” date. For significant changes, we will also notify you through the portal, WhatsApp or email before the changes take effect.

14. Contact us