Privacy Policy of Wafa SIFA

Effective date: 5 October 2026  ·  Last updated: 5 October 2026  ·  Applies to: sifa.wafaindonesia.or.id, including the partner registration form and partner certificate links

SIFA (Sistem Informasi Wafa) is Wafa Indonesia’s information system for running our programs. Authorised Wafa staff use it to manage partner institutions (lembaga mitra), foundations (yayasan) and regional Wafa units, our professional staff (trainers, munaqosyah examiners and academy teachers), activities such as trainings and munaqosyah (Quran proficiency examinations), assignments, incentives and the related administration. SIFA also hosts a public form that institutions use to register as Wafa partners.

This Privacy Policy explains what personal data SIFA processes, why, who we share it with, how long we keep it and what rights you have. It is written in line with Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (the “PDP Law”).

1. Who we are

SIFA is operated by Yayasan Syafa’atul Qur’an Indonesia (YAQIN), known as Wafa Indonesia (“Wafa”, “we”, “us” or “our”), a foundation established under the laws of the Republic of Indonesia. Wafa Indonesia is the personal data controller for the processing described in this policy. Sign-in to SIFA is provided by the Wafa SSO Portal, which has its own privacy policy.

2. Whose data we process

• Wafa staff who use SIFA;
• professional staff (SDM Profesional): trainers, munaqosyah examiners (munaqisy), academy teachers and others assigned to Wafa activities;
• supporting staff (SDM Pendukung) who help run activities;
• contact persons (PIC) of partner institutions, foundations, regional Wafa units (Wafa Daerah) and regional partnerships (Kemitraan Daerah);
• people who fill in the partner registration form, and the people they name in it;
• students and teachers of partner institutions, and other participants in Wafa activities; and
• contacts of prospective partners recorded in our accounting system.

3. Personal data we process

Some of this data is specific personal data under Article 4 of the PDP Law: children’s data and personal financial data (bank accounts and incentive amounts). We give it extra protection and restrict access to staff who need it.

If you give us data about other people, for example the contacts you name in the registration form, please make sure they know about it and about this policy.

4. How we use your data and our legal bases

We do not use personal data in SIFA for advertising.

5. Automated competency levels

SIFA calculates each professional staff member’s competency level per field (from OJT through ahli) automatically, based on the qualifications recorded in their profile. The level, together with the role in an activity, determines the incentive grade and therefore the incentive rate. If you think your level is wrong, you can ask us to check the qualifications used, correct them and review the result. You also have the right to object to decisions based solely on automated processing (Article 10 of the PDP Law).

6. Who we share your data with

6.1 Within Wafa

• Authorised Wafa staff, each with access limited to what their role requires.
• Wafa SSO: links between your account and your SIFA records, and name and contact details for the Wafa ID registry.
• SiMumtaz: institution and professional staff data needed to run munaqosyah; SiMumtaz in turn sends participants, results and certificates to SIFA.
• Khidmah: professional staff can see and update their own profile.
• Wafa Certificate Verification (Sertifikat): when someone checks a partner certificate, it shows the institution’s code, name, region and partnership status.

6.2 Service providers

6.3 Other disclosures

Partner certificates can be downloaded through a link containing a long, hard-to-guess code, which we send to the institution. Anyone who has the link can download that certificate, so please share it with care. We may also disclose personal data where required by law, a court order or a lawful request from a competent authority, or to protect the rights and safety of Wafa, our partners or the public.

We do not sell, rent or trade personal data.

7. International data transfers

Our servers are located in Singapore, so SIFA data is stored outside Indonesia. Odoo and Google may also process data in other countries. Singapore has a comprehensive data protection law (the Personal Data Protection Act 2012). We transfer personal data outside Indonesia only in accordance with Article 56 of the PDP Law: the destination country provides a level of protection equal to or higher than the PDP Law, or adequate and binding safeguards are in place, or, where neither applies, with your consent.

8. How long we keep your data

When the period ends, we delete the data or anonymise it so it can no longer identify you.

9. How we protect your data

• All connections are encrypted with HTTPS. Sign-in uses the Wafa SSO, and sessions are held in an HttpOnly, Secure cookie.
• Access is role-based: each staff member can only see and change what their job requires.
• Changes to important records are kept in an audit trail showing who changed what and when.
• Communication between Wafa systems is authenticated, digitally signed and runs over internal networks.
• The public registration form only works through an invitation link and is protected against automated abuse with rate limits and spam protection.

If a personal data breach occurs, we will notify the affected people and the relevant authority in writing no later than 3 × 24 hours, as required by Article 46 of the PDP Law.

10. Cookies and similar technologies

We do not use advertising, analytics or tracking cookies in SIFA. If you use a shared computer, delete the registration form draft by clearing your browser data, or submit the form before leaving.

11. Children’s data

SIFA contains data about students of partner institutions, many of whom are children. Under Article 25 of the PDP Law, processing children’s data requires special care and the consent of a parent or guardian. Students’ data reaches us from their institution, mostly through SiMumtaz, and the institution is responsible for informing parents or guardians and obtaining any consent required before sharing it with us. We collect only what our programs need: we do not record a child’s own phone number or email (we use the parent’s or guardian’s contact instead), access is limited to authorised staff, and the public certificate check never shows a child’s date of birth or detailed scores. Parents or guardians can exercise their child’s rights by contacting us directly or through the institution.

12. Your rights

Under the PDP Law (Articles 5–13) you have the right to:

• be informed about who processes your data, why and on what basis;
• access your personal data and obtain a copy;
• correct or update data that is inaccurate or incomplete;
• end processing, delete or destroy your data, subject to legal exceptions (for example, financial records we must keep, or certificates that must remain verifiable);
• withdraw consent where processing is based on consent;
• object to decisions based solely on automated processing, such as the competency level calculation described in section 5;
• delay or restrict processing in proportion to its purpose;
• data portability: receive your data in a commonly used, machine-readable format and have it sent to another controller where technically feasible; and
• claim compensation for violations in the processing of your personal data, in accordance with the law.

Professional staff can view and update parts of their own profile in the Khidmah app. For anything else, email [email protected] with the subject “Privacy Request – SIFA”, stating your name, how you are connected to Wafa (for example, the institution you represent) and what you would like us to do. We may need to verify your identity first. We will respond within the time limits set by the PDP Law (for many requests, no later than 3 × 24 hours after we receive a complete and verified request). If we cannot fulfil a request, we will explain why. You may also lodge a complaint with the personal data protection authority in Indonesia.

13. Changes to this policy

We may update this policy when our services or the law change. We will publish the updated version on this page and change the “Last updated” date. For significant changes, we will also inform affected users and partners before the changes take effect.

14. Contact us