Legal

Privacy Policy

Version 2026-10-20 · Effective 20 October 2026

In short: the Hub is a members-only network for Trisakti Mechanical Engineering alumni. We collect what you give us to run your account and profile, show it to other signed-in members as described below, and don't sell it, use it for advertising, or run analytics or ad trackers. You can download or delete your data yourself in Privacy & data settings.

1. Who runs the Hub

TMED Business Hub (“the Hub”, “we”) is operated by PT Ark Kreasi Digital, with Adwaya Raki as the responsible operator and contact, for the Trisakti Mechanical Engineering alumni community. The operator decides how and why personal data on the Hub is processed (the data controller). [Legal adviser to confirm how controller responsibility is described for PT Ark Kreasi Digital and Adwaya Raki]

The Hub is an independent alumni community. It is not officially endorsed by, affiliated with, or operated by Universitas Trisakti or its Mechanical Engineering Department, and the university does not receive members' data from the Hub.

Contact: adwaya.raki@gmail.com. Registration number and address: Business information.

2. What we collect

Information you give us

Category	Data	Required?
Account	NIM (student ID), full name, email address, password (stored only as a one-way bcrypt hash)	Yes
Terms acceptance	Which version of the Terms and this policy you accepted, and when	Yes (recorded at sign-up)
Profile	Major, class year, headline, bio, expertise/skills, profile photo	Optional
Career history	Work experience (title, company, type, location, dates, description); certifications (name, issuer, dates, credential link, proof file)	Optional
Contact details	Business phone/email, personal phone/email, LinkedIn link, business-card images (front/back)	Optional
Content	Posts (text, images, videos), comments, likes, @mentions, marketplace listings (title, description, price, category, photo), job posts, Billboard requests (title, description, image, duration)	Optional
Messages	Private messages and attachments (images, PDF, Word) you send to members; read status	Optional
Preferences	Email preferences, personal-contact visibility, your history of preference/consent changes	Set by you
Membership & payments (only if paid membership is introduced — not yet available)	Membership status, start and paid-through dates, renewal/cancellation status, and payment records (amount, currency, date, status and Xendit's reference numbers). Card or e-wallet details would be entered on the payment provider's page and never reach us.	Required for paid membership
Support & requests	What you send us by email or phone, and privacy requests made through the request form (type, details, status, dates)	Optional

Information created when you use the Hub

Notifications generated by activity (likes, comments, mentions, Community Info posts, Billboard decisions).
Link previews: when you post a link, our server fetches that page to show its title, description and image.
Technical data: the web server records requests (IP address, date/time, requested page, browser user-agent) as standard access logs, and the application logs errors. We don't store your search queries.
Records of data-export or deletion requests (which contain no personal details beyond an internal reference).

We don't collect your date of birth, government ID, precise location, or payment-card details, and we don't buy data about you from others.

3. Why we use it (and legal basis)

We process personal data only on the bases recognised by Indonesia's Personal Data Protection Law (UU No. 27 of 2022) and comparable laws:

Purpose	Data used	Basis
Create and secure your account, sign you in, reset passwords	Account data	Performing our agreement with you (the Terms)
Run the network: profiles, directory, expertise search, feed, marketplace, jobs, Billboard, messaging, notifications	Profile, content, messages	Performing our agreement with you; optional fields are shared only because you choose to add them
Prevent duplicate accounts (your NIM is not checked against university records)	NIM, name, email	Performing our agreement; legitimate interest in one account per person
Run paid membership: take the annual fee through Xendit, renew, cancel, handle failed payments and payment questions	Membership and payment records, email	Performing our agreement; legal obligations for financial records [Accountant to confirm]
Keep an audit trail of admin decisions and payment-state changes	Account ids, action, date (no other personal data)	Legitimate interest in accountability and resolving disputes
Email notifications about activity and Community Info posts	Email, names, post excerpts	Legitimate interest in keeping members informed — you can switch these off at any time
Password-reset and other security emails	Email	Performing our agreement (these can't be switched off)
Keep the Hub safe: rate-limiting, abuse prevention, moderation, fixing faults	Technical data, content reported to us	Legitimate interest in security and integrity
Record your acceptance of the Terms and your preference changes	Acceptance and consent records	Legal obligation / legitimate interest in demonstrating compliance
Comply with law or valid legal requests	As required	Legal obligation

We do not use your data for advertising, profiling for marketing, automated decisions with legal effect, or selling to third parties.

4. Who can see what

Every page and API on the Hub requires you to be signed in, so “members” below means signed-in Hub members — not the general public.

Information	Visible to
Name, profile photo, major, class year, headline, bio, expertise, work experience, certifications (including proof files), posts, comments, likes, marketplace listings, job posts	All members
Business phone/email, LinkedIn link, business card	All members (only if you add them)
Personal phone/email	Only you by default. If you set them to “Visible to members”, all members.
Billboard ads	All members once approved; the Hub admin sees requests while pending
Private messages and attachments	You and the member you're talking to
Login email, NIM, password hash, email preferences, consent records	Only you (in your settings and data export)
Membership and payment status	You and the Hub admin. Other members don't see it.

Uploaded files (photos, videos, documents, attachments) are only delivered to signed-in members, and each file follows the same rule as the thing it belongs to: profile photos, business cards, post media, listing photos and certification proofs go to members; chat attachments only to the two people in the conversation; Billboard images to members once approved, and before that only to you and the Hub admin. Having a file's address is not enough to open it. Remember that anyone you share a file with can download and keep a copy.

The operator, as administrator of the system, can technically access the database, including messages, but does so only when necessary to run, secure or troubleshoot the Hub, to handle a report or request, or where required by law.

We don't sell or rent personal data. We share it only as follows:

Other members, as described in section 4.
Hosting provider — the Hub is planned to run on a Hostinger virtual private server, which stores all Hub data. [Server region to be confirmed in the Hostinger account]
Payment provider (planned, not active) — The Hub intends to use Xendit as its payment provider, subject to Xendit reviewing and approving the Hub; no payment account is active. If paid membership is introduced, the provider would take payments on its own payment page and receive what it needs to take and renew them (for example your payment-method details, name and email, and the amount) under its own terms and privacy policy, and would send us the payment's status and reference numbers. This section will be updated before any payment is accepted.
Email delivery provider — notification and password-reset emails are sent through an SMTP service, which processes your email address and the message content [Owner to confirm provider, e.g. Google Workspace/Gmail].
Linked websites — when a post includes a link, our server requests that page (the site sees our server, not you). When you view the preview, your browser loads the preview image directly from that site, which then sees your IP address. Links you follow (LinkedIn, job application links, etc.) take you to sites with their own privacy policies.
Authorities — where we're legally required to, or to protect members' rights, safety or property.
Successor operator — if the Hub is transferred to another operator (for example an official alumni association), members would be told in advance.

The Hub loads no analytics, advertising, social-media pixels or third-party fonts/icons — these are served from our own server.

6. Where data is stored

Data is stored on the Hub's server [Hostinger server region to be confirmed]. The email provider, and the payment provider if payments are introduced, may process data in other countries. Where data is transferred outside Indonesia, we rely on the safeguards required by applicable law [Legal adviser to confirm once the server region and providers are confirmed].

7. How long we keep it

Your account and everything linked to it — for as long as your account exists. When you delete your account, your profile, posts, comments, likes, listings, job posts, experience, certifications, Billboard ads, messages (in both directions of your conversations), notifications, consent records and uploaded files are deleted straight away.
Individual items — deleting a post or certification, or replacing your profile photo or business card, removes the item and its file.
Payment records (only if paid membership is introduced) — kept after you delete your account, without the link to your account, for as long as financial-record rules require. [Accountant to confirm the period] Received payment events are logged with a fingerprint of their content, not the content itself.
Admin audit trail — kept as a record of decisions; if your account is deleted, entries no longer point to it. [Owner to set retention period]
Password-reset links — expire after 1 hour.
Sign-in sessions — a record of each sign-in (an internal id, your account and timestamps; no IP address or device details) lasts until you sign out or 7 days pass; expired records are deleted within a day and signed-out ones after 30 days.
Data-request log — a minimal record that an export or deletion was carried out (date, type, and an internal reference that can't identify you on its own) [Owner to set retention period].
Privacy requests sent to the operator — kept as a record of how each request was handled; unconfirmed requests' links expire after 24 hours; the free-text details are erased if you delete your account [Owner to set retention period].
Server logs [Owner to set and configure retention, e.g. 30 days].
Backups [Owner to confirm whether database backups are taken and how long they're kept; deleted data disappears from backups when they expire].
Inactive accounts — not automatically deleted at present [Owner to decide on an inactivity period].

8. Security

We use reasonable technical measures, including: password hashing (bcrypt), hashed one-time reset tokens, sign-in sessions that expire after 7 days and end immediately when you sign out, reset or change your password, or use “Sign out everywhere”, members-only access checks on every request and on every uploaded file, rate-limiting on sign-in and sensitive actions, upload type restrictions, and HTTPS on the live site. No system is perfectly secure; if we become aware of a breach affecting your data, we'll notify you and the relevant authorities as the law requires.

9. Your rights & choices

Depending on the law that applies to you, you have the right to be informed, to access, correct and update your data, to obtain a copy, to have it deleted, to withdraw consent, to object to or restrict certain processing, and to complain.

Access / copy: Settings → Privacy & data → “Download my data” (a JSON file of everything linked to your account).
Correct: edit your profile, experience, certifications and contact details at any time.
Delete: Privacy & data settings → “Delete my account” (requires your password).
Notification emails: switch off in settings or with the unsubscribe link in any notification email.
Personal contact details: choose “Only me” in Settings → Privacy & data, or remove them from your profile.
Anything else (objection, restriction, a correction you can't make yourself, questions, or if you can't sign in): use the privacy request form or email adwaya.raki@gmail.com. To protect your account, requests are confirmed from your account's email address before we disclose or delete anything, and you can follow their status in your settings. [Owner to confirm response time commitment consistent with UU PDP]

You can also complain to the data-protection authority where you live.

10. Age requirement

The Hub is for adult alumni. You must be 18 or older to create an account. We don't knowingly collect data from anyone under 18; if you believe a child has an account, contact us and we'll remove the account and its data.

11. Cookies & browser storage

The Hub uses only essential browser storage and one essential cookie (so your browser can load the files you're allowed to see), and no tracking. See the Cookie Policy.

12. Changes & contact

We'll update this policy when the Hub changes. The version and effective date are shown at the top; for material changes we'll tell members on the Hub and ask you to review and accept the new version.

Questions or requests: adwaya.raki@gmail.com.