Privacy Policy

1The short version

• We do not sell anyone’s personal data, and we never will.
• We run no advertising trackers and no third-party analytics.
• IP addresses are never stored raw — only a salted hash that cannot be reversed.
• Image metadata, including the GPS coordinates phone photos quietly carry, is stripped before the file is stored.
• Registrant data belongs to the organizer of that event. We process it on their behalf, not for purposes of our own.

The rest of this document says the same thing in more detail, and it binds.

2Our two roles, and why that matters to you

We wear two different hats, and your rights differ depending on which one we are wearing.

If you are a registrant and cannot reach the organizer, write to us at info@yarnext.com with a subject prefixed [privasi]. We will pass it on and, if the organizer still does not respond within a reasonable time, we may act ourselves as far as the law allows.

3What data we collect

We do not ask for specific categories of personal data ourselves. If an event’s form asks for them — dietary needs that reveal belief, accessibility needs that reveal a health condition — it is that event’s organizer asking, and the lawful basis is their responsibility.

4Lawful basis for processing

For data we control ourselves, we rely on the bases below, under Indonesian Law No. 27 of 2022 on Personal Data Protection and, for data subjects located elsewhere, the equivalent rules of that place.

For registrant data, the lawful basis is set by the organizer as controller. We process it only on their documented instructions.

5What we do not do with your data

• We do not sell, rent, or trade personal data to anyone.
• We do not use registrant data to train artificial intelligence models.
• We do not use one organizer’s registrant data to market anything, to other organizers or to their registrants.
• We do not combine data from several organizers into a single profile of a person.
• We do not place tracking pixels in email sent on an organizer’s behalf.

6Who data is shared with

We share data only with parties genuinely needed to run the service, and only as far as that need goes.

The current subprocessor list and the regions they process in is set out in the Data Processing Addendum. New subprocessors are announced before they begin processing data.

If our business is sold, merged, or restructured, data may pass to the successor. In that case this policy continues to apply until the successor tells you what changes, and you remain free to stop using the service.

7Cross-border processing

Some providers we use process data outside Indonesia. For every such transfer we make sure one of these holds: the destination country provides an equivalent level of protection, standard contractual clauses bind the recipient, or you have consented to the transfer.

You may ask which basis was used for a particular transfer.

8How long data is kept

The figures below are not a marketing promise — they are what actually holds inside the system.

9How data is protected

Most of the measures below are architectural decisions rather than settings that can be changed later.

• Isolation between organizers is enforced by the database itself through row-level security, not only by application code. A coding mistake still does not let one organizer see another organizer’s rows.
• IP addresses are stored as salted hashes. The salt is what makes those hashes irreversible by trying the whole address space.
• Sign-in codes, verification codes, event access codes, and invitation tokens are stored salted and hashed — never raw, and never displayable again.
• The type of an uploaded file is sniffed from its own bytes, never from the filename or the content type the uploader sent.
• Image metadata, including GPS coordinates, is stripped before the file is stored.
• Registrant answer files are never served from a public address. They can only be fetched through a path that requires a session, and every fetch writes an audit row.
• Every export and every bulk view of personal data writes an audit row naming who, when, and for which event.
• Traffic to the service is encrypted with TLS.
• Staff access to production data is limited to those who need it to maintain the service, and it is logged.

If you find a vulnerability, report it to info@yarnext.com with a subject prefixed [keamanan]. We do not pursue good-faith reporters.

10Your rights over your data

Under applicable law, you have the right to:

• know what data we hold about you and obtain a copy of it;
• correct data that is wrong or incomplete;
• have your data deleted, so far as no legal duty requires us to keep it;
• restrict or object to certain processing, including marketing;
• withdraw consent you previously gave, without affecting the lawfulness of processing before the withdrawal;
• receive your data in a machine-readable form and move it to another service;
• lodge a complaint with the competent data protection authority.

Send your request to info@yarnext.com with a subject prefixed [privasi]. We answer within 30 calendar days at the latest. If a request is complex and needs longer, we tell you why before that deadline passes.

For registration data belonging to an event, take your request to that event’s organizer first. We cannot delete or change registration data at a third party’s request without the organizer’s instruction, unless the law orders otherwise — which is precisely what keeps one organizer’s data safe from anyone else’s interference.

We may ask you to prove your identity before acting on a request. Granting a request without that check is the easiest way to hand someone’s data to whoever claims to be them.

11Children

This service is not directed at children. We do not knowingly collect children’s data without the consent of a parent or guardian. Where an event is meant for children, its organizer is responsible for obtaining that consent.

If you know of children’s data collected without a valid basis, tell us at info@yarnext.com and we will delete it.

12Cookies

This service uses a small number of cookies, all of them to deliver a function you asked for — none for advertising or cross-site tracking. The full list, with each cookie’s lifetime, is in the Cookie Policy.

13Marketing email and how to stop it

Transactional email — sign-in codes, verification, tickets, cancellation notices — cannot be turned off while you use the service, because without it the service cannot work.

Marketing email goes only to people who ticked the box themselves. That box is never pre-ticked. Every such message carries an unsubscribe link that works in one click.

Addresses that bounce repeatedly, or whose owner marks our mail as spam, go onto a suppression list and we stop sending there. If you stopped receiving mail you were expecting, contact us and we will restore your address.

14If there is a data breach

If a personal data protection failure occurs, we notify the affected data subjects and the competent authority within 3 times 24 hours of becoming aware of it, as Law No. 27 of 2022 requires.

That notice states what data was affected, when and how it happened, what we have done, and what you should do. Organizers, as controllers, are notified without undue delay so that they can meet their own obligations.

15Changes to this policy

This policy can change as the service or the law changes. Material changes are announced by email and by a notice inside the panel at least 30 days before they take effect. The effective date of this version is shown at the top of the page.

16Contacting us

[ISI: nama badan hukum lengkap, mis. PT Contoh Karya Nusantara], [ISI: alamat terdaftar lengkap beserta kode pos], Indonesia. For personal data matters: info@yarnext.com, subject prefixed [privasi].

You also have the right to complain to the data protection authority where you live or where the alleged breach took place.