Privacy Policy of Wafa HRIS

Effective date: 5 October 2026  ·  Last updated: 5 October 2026  ·  Applies to: hris.wafaindonesia.or.id

HRIS Wafa is Wafa Indonesia’s human resource information system for our employees. It handles employee records, attendance (with location and photo verification), leave and permission requests, business trips, overtime, daily work reports and Mutaba’ah, our daily Quran recitation log.

This Privacy Policy explains how HRIS processes the personal data of our employees and of people whose details employees provide, such as emergency contacts. It is written in line with Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (the “PDP Law”).

1. Who we are

HRIS is operated by Yayasan Syafa’atul Qur’an Indonesia (YAQIN), known as Wafa Indonesia (“Wafa”, “we”, “us” or “our”), a foundation established under the laws of the Republic of Indonesia and your employer. Wafa Indonesia is the personal data controller for the processing described in this policy. HRIS currently uses its own sign-in with your email address and password, separate from the Wafa SSO Portal.

2. Personal data we process

Health-related data and personal financial data are specific personal data under Article 4 of the PDP Law. We process them only where necessary, for example to administer sick leave or salary as required by law, and restrict access to HR and authorised approvers. Religion and marital status are recorded for HR administration only.

If you give us details of other people, such as emergency contacts or family members named in leave documents, please make sure they know about it.

3. How we use your data and our legal bases

4. Location and photos at clock-in

• Location only when you clock in or out. Your browser asks for permission to use your location. HRIS reads it once at clock-in and once at clock-out. It does not track you at any other time.
• Office area check. Your coordinates are compared with your branch’s location and permitted radius (100 metres by default). During an approved business trip the area check is switched off, but your coordinates are still recorded as evidence of attendance.
• Selfie photo. A photo is taken with your device’s camera at clock-in and clock-out and uploaded directly to our private storage through a link that is valid for 5 minutes. Authorised HR staff can view it through links valid for 15 minutes. Photos are used only for manual checks against proxy attendance. We do not use facial recognition or any other biometric identification.
• Automatic deletion. Attendance photos and supporting documents are deleted automatically 100 days after upload.
• Maps. When you or HR view the location of an attendance record, the map is loaded from OpenStreetMap, so those coordinates are sent to OpenStreetMap to display it.
• If you refuse permission. You can refuse location or camera access, but GPS attendance will not work. Please contact HR, who can record your attendance manually.

5. Automatic attendance records

HRIS sets your attendance status (for example present, late or half day) automatically from your schedule. Every night at 23:59, it creates an “absent” record for scheduled employees who did not clock in on a working day that is not a holiday, and it creates the day’s daily report and Mutaba’ah entries. These records may be used for leave, overtime and payroll. If a record is wrong, you can submit an attendance correction or a permission request, which is reviewed by a person (your supervisor or HR). You also have the right to object to decisions based solely on automated processing (Article 10 of the PDP Law).

6. Who can see your data within Wafa

• You can see your own data, requests and their approval timeline.
• Supervisors and leaders see the data of their own team needed to approve requests and monitor attendance.
• HR administrators see employee data needed for HR administration, including the history of changes.
• Super administrators have full access, including system records, and are limited to a small number of people.

7. Who we share your data with

7.1 Within Wafa

HRIS sends your name, phone number, email address and employee number to Wafa SSO so that you receive a Wafa ID. Your job title and department may also be recorded in your Wafa Account to set your access rights in other Wafa applications, as described in the Wafa SSO Portal privacy policy.

7.2 Service providers

7.3 Authorities

We may disclose personal data where required by law, for example to tax or employment authorities, or in response to a court order or a lawful request from a competent authority. We do not sell, rent or trade personal data.

8. International data transfers

Our servers are located in Singapore, so HRIS data is stored outside Indonesia. Map and push notification providers may also process limited data in other countries. Singapore has a comprehensive data protection law (the Personal Data Protection Act 2012). We transfer personal data outside Indonesia only in accordance with Article 56 of the PDP Law: the destination country provides a level of protection equal to or higher than the PDP Law, or adequate and binding safeguards are in place, or, where neither applies, with your consent.

9. How long we keep your data

When the period ends, we delete the data or anonymise it so it can no longer identify you.

10. How we protect your data

• All connections are encrypted with HTTPS. Passwords are stored only as a one-way hash (bcrypt) and cannot be read by anyone, including Wafa staff.
• Access is role-based and limited by level, as described in section 6.
• Photos and documents are kept in private storage that is not publicly accessible. They can only be opened through links that expire after 15 minutes, and they are deleted automatically after 100 days.
• Changes to employee data, contracts, attendance, leave balances, overtime and corrections are recorded in an audit trail, and original attendance times are kept when a correction is approved.
• Push notification content is encrypted so that push services cannot read it.

Your sign-in is stored in your browser, so please sign out when using a shared device. If a personal data breach occurs, we will notify you and the relevant authority in writing no later than 3 × 24 hours, as required by Article 46 of the PDP Law.

11. Data stored in your browser

HRIS does not use advertising, analytics or tracking cookies.

12. Your rights

Under the PDP Law (Articles 5–13) you have the right to:

• be informed about who processes your data, why and on what basis;
• access your personal data and obtain a copy;
• correct or update data that is inaccurate or incomplete;
• end processing, delete or destroy your data, subject to legal exceptions (for example, records we must keep under employment, tax or accounting laws);
• withdraw consent where processing is based on consent, such as push notifications;
• object to decisions based solely on automated processing, such as automatic attendance statuses;
• delay or restrict processing in proportion to its purpose;
• data portability: receive your data in a commonly used, machine-readable format and have it sent to another controller where technically feasible; and
• claim compensation for violations in the processing of your personal data, in accordance with the law.

You can view most of your data in HRIS, change your password, turn notifications on or off, and submit attendance corrections. For anything else, contact HR or email [email protected] with the subject “Privacy Request – HRIS”, stating your name, employee number and what you would like us to do. We will respond within the time limits set by the PDP Law (for many requests, no later than 3 × 24 hours after we receive a complete and verified request). If we cannot fulfil a request, we will explain why. You may also lodge a complaint with the personal data protection authority in Indonesia.

13. Changes to this policy

We may update this policy when HRIS or the law changes. We will publish the updated version on this page, change the “Last updated” date and inform employees of significant changes before they take effect.

14. Contact us