Back to Login

Privacy Policy

Last updated: April 28, 2026 (policy version 2026-04-28)

1. Introduction

The Global Mobility Information System ("System") is operated by the Directorate for Internationalization of Education, Universitas Indonesia ("we", "us", "our"). We are committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR) and Indonesia's Personal Data Protection Law (UU PDP No. 27/2022) .

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our System.

2. Data Controller

The data controller responsible for your personal data is:
Directorate for Internationalization of Education
Universitas Indonesia
Depok, West Java, Indonesia
Contact: io-ui@ui.ac.id

3. Personal Data We Collect

We collect and process the following categories of personal data:

  • Identity Data: full name, date of birth, nationality, passport number, gender, photo
  • Contact Data: email address, phone number, mailing address
  • Academic Data: institution name, faculty, degree level, GPA, transcripts, study program details
  • Professional Data: employment history, language proficiency, certifications
  • Documents: uploaded files such as transcripts, recommendation letters, insurance proof
  • Account Data: login credentials (email and hashed password), role, verification status
  • Technical Data: IP address, browser type, access timestamps for security and audit logs

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

  • Consent (GDPR Art. 6(1)(a) / UU PDP Art. 20): You provide explicit consent when registering and submitting your application.
  • Contract Performance (GDPR Art. 6(1)(b)): Processing is necessary to manage your mobility program application and enrollment.
  • Legitimate Interest (GDPR Art. 6(1)(f)): For system security, fraud prevention, and improving our services.
  • Legal Obligation (GDPR Art. 6(1)(c) / UU PDP Art. 16): To comply with university regulations and government reporting requirements.

5. How We Use Your Data

Your personal data is used for the following purposes:

  • Processing and managing mobility program applications
  • Verifying your identity and academic credentials
  • Communicating application status, decisions, and program information
  • Facilitating coordination between partner institutions
  • Generating statistical reports (anonymized) for program evaluation
  • Ensuring system security and preventing unauthorized access

6. Data Sharing

We may share your personal data with:

  • Partner Institutions: Universities and organizations participating in mobility programs, as necessary for application processing.
  • Government Authorities: When required by law or regulation (e.g., immigration, education ministry reporting).
  • Service Providers: Trusted third-party services for email delivery, file storage, and system hosting, bound by data processing agreements.

We do not sell your personal data to any third party.

7. International Data Transfers

As a global mobility platform, your data may be transferred to partner institutions in other countries. When data is transferred outside Indonesia or the EU/EEA, we ensure appropriate safeguards are in place, including standard contractual clauses or adequacy decisions, in compliance with GDPR and UU PDP requirements.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy, and for a maximum of 5 years after the conclusion of your mobility program or the last activity on your account, unless a longer retention period is required by law. After this period, your data will be securely deleted or anonymized.

9. Your Rights

Under GDPR and UU PDP, you have the following rights regarding your personal data:

  • Right of Access: Request a copy of your personal data we hold.
  • Right to Rectification: Request correction of inaccurate data.
  • Right to Erasure: Request deletion of your data, subject to legal retention requirements.
  • Right to Restrict Processing: Request limitation of data processing.
  • Right to Data Portability: Receive your data in a structured, machine-readable format.
  • Right to Object: Object to processing based on legitimate interests.
  • Right to Withdraw Consent: Withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact us at io-ui@ui.ac.id . We will respond within 30 days.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Password hashing using industry-standard algorithms (bcrypt)
  • Role-based access control limiting data access to authorized personnel
  • Regular security audits and audit logging of system access
  • Secure file storage with access controls

11. Cookies and Tracking

We rely on two categories of cookies and tracking technology. You can review and change your choices at any time via in the footer.

11.1 Essential

These cookies are required for the System to function and cannot be turned off. They are first-party cookies set by this site only:

  • access_token , refresh_token , user — keep you signed in and refresh your session silently in the background.
  • kc_id_token , kc_provider — let us terminate your Single Sign-On session with Keycloak when you log out.
  • sso_state , sso_pkce , sso_provider — short-lived (10 minutes) security cookies used during the OAuth/SSO redirect flow to protect against cross-site request forgery.

11.2 Analytics & Error Monitoring (opt-in)

With your consent, we use Sentry (sentry.io) to capture errors and a small sample of performance data so we can fix bugs and keep the System reliable. Sentry does not set HTTP cookies; instead it uses your browser's local storage. We strip personal identifiers (your name, email, IP, request bodies) from events before they leave your browser, and we configure Sentry not to record full session replays.

Server-side error logs. We also operate Sentry on our backend servers strictly for error tracking. This processing relies on our legitimate interest (GDPR Art. 6(1)(f)) in keeping the service stable and secure. Trace sampling is disabled and identifying request data is scrubbed before send. You may object to this processing by contacting us at the address in section 13.

11.3 What we do not use

We do not use third-party advertising, marketing, or social-media tracking cookies. We do not use Google Analytics, Mixpanel, Hotjar, Meta Pixel, or any similar product on this site.

11.4 Your choice

On your first visit you will see a consent banner. If you select Reject All or close the banner without consenting, only Essential cookies are loaded and Sentry is not initialised in your browser. You may revisit your decision at any time from the footer link.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-system notification. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact:

Directorate for Internationalization of Education
Universitas Indonesia
Email: io-ui@ui.ac.id