Privacy Policy

Selong Bay School is operated by Yayasan Selong Bay Sekolah, a registered Indonesian non-profit foundation, based at Dusun Serangan, Selong Belanak, Kecamatan Praya Barat, Kabupaten Lombok Tengah, Nusa Tenggara Barat, Indonesia. This policy covers www.selongbayschool.com and the parent/admin portal at /account, /admin, and /student.

For anything in this policy, or to exercise any of the rights described below, contact us at hello@selongbayschool.com or the school office.

From anyone visiting the website: whatever you submit through the Contact form or Student Enrolment form on the Admissions/Contact pages: name, email, phone number, and your message or enquiry details.

From parents and guardians using the parent portal:your account email address; your child's name, date of birth, nationality, class, and programme; emergency contact and medical/allergy/dietary information you provide for your child's safety; photographs of your child you upload or that staff post to their learning feed; identity documents you choose to upload (passport copy, KITAS copy, birth certificate); attendance check-in/out records and the signature used to confirm them; invoices and the fee/payment details on them (we do not collect or store card numbers; fees are paid by bank transfer); and lunch orders you place.

From students with their own login:a login email and whatever is needed to show them their own class's lessons and Google Classroom assignments.

From school staff:a work email and password (stored as a one-way hash, never in plain text) used to sign in to the admin dashboard, and records of the actions a staff member takes there (e.g. who signed a compliance form on the school's behalf, who recorded an attendance check-in).

Automatically: our hosting provider keeps standard technical logs (like IP address and browser type) for security and reliability, the same as almost any website. We do not run any analytics or advertising tracking on this site. See Cookies below.

We use personal data to:

• respond to enquiries and process admissions and enrolment;
• educate and care for enrolled students: attendance, learning profiles and term reports, lesson plans, work samples, and Google Classroom coursework;
• keep students safe, including administering first aid and contacting you in an emergency;
• administer fees, generate invoices, and manage lunch and activity bookings;
• communicate with families about school life, events, and administrative matters;
• meet our own legal and regulatory obligations, including reporting to the Indonesian Ministry of Education where required; and
• keep the website and portal secure and working properly.

We do not use personal data for advertising, and we do not sell personal data to anyone, under any circumstances.

We process personal data in line with Indonesia's Law No. 27 of 2022 on Personal Data Protection (“PDP Law”). For enrolled families, this is primarily on the basis of the contract between you and the school (enrolment), your explicit consent (for example, the Photography & Social Media Consent and Personal Data Consent forms signed at enrolment), and our legitimate interest in running the school safely and effectively. For website visitors, submitting a form is treated as consent to be contacted about that enquiry.

The parent, student, and admin portals use a single, essential session cookie so you stay logged in as you move between pages. It is not used to track you across other websites and is not shared with advertisers. We do not run Google Analytics, Facebook Pixel, or any similar tracking on this site.

A few pages embed third-party content that can set its own cookies once it loads: the map on our Contact page (Google Maps) and, where enabled, our Instagram feed (via SnapWidget). These are controlled by Google and SnapWidget respectively under their own privacy policies, not ours.

We only share personal data with the people and services that need it to help us run the school, and never sell it. The main services we use are:

• Brevo: sends transactional emails (form confirmations, login links, invoices, notifications) on our behalf.
• Vercel and Neon: host this website, our database, and uploaded files (photos and identity documents) securely.
• Google Workspace / Google Classroom / Google Calendar: used by staff to sync coursework and assignments, and to schedule meetings with parents; connected only when a staff member sets it up, and only for the class/child data needed to make that feature work.

Within the school, access to a child's record is limited to the staff who need it: their assigned teacher(s) can see academic and class information, while medical notes, financial records, and identity documents are visible only to the school office/admin and to that child's own parent or guardian.

We may also disclose personal data if required by Indonesian law or a valid request from a public authority, or to protect the safety of a student or others in an emergency.

Selong Bay School is a school, so a large part of what we do necessarily involves personal data about children. That data is provided to us by parents/guardians (or by the child, under school supervision, for things like classwork), used only for the educational, safety, and administrative purposes described in this policy, and is never used to market anything to children directly. Photos of a child are only used publicly (on our website, social media, or promotional material) with the specific consent given on the Photography & Social Media Consent form at enrolment, which a parent can withdraw at any time by contacting the school office.

We keep a website enquiry only as long as needed to respond to it and for a reasonable follow-up period. For enrolled families, we keep personal data for as long as your child is enrolled at Selong Bay School, and for a reasonable period afterwards to meet our academic, financial, and legal record-keeping obligations, after which it is securely deleted or anonymised.

We use industry-standard measures to protect personal data: connections to this site and the portal are encrypted (HTTPS), passwords are never stored in plain text, and access to family records inside the admin dashboard is limited by staff role, as described above. No system is completely immune to risk, but we take reasonable, ongoing steps to keep your information secure and will let you know if we ever become aware of a breach affecting your data.

Some of the service providers listed above operate infrastructure outside Indonesia. Where personal data is processed or stored outside Indonesia, we rely on those providers' own security and privacy safeguards, and only use providers who are contractually bound to protect your data to a comparable standard.

Under the PDP Law, and as a matter of course for our own families, you may:

• ask what personal data we hold about you or your child, and request a copy of it;
• ask us to correct information that is inaccurate or out of date;
• ask us to delete personal data we no longer have a valid reason to keep;
• object to, or withdraw consent for, a particular use of your data (for example, photography consent); and
• ask us any question about how your data is used.

Parents can already update most of their own child's contact, medical, and dietary information directly in the parent portal at any time. For anything else, write to hello@selongbayschool.com and we will respond as promptly as we can. This is always subject to our own legitimate record-keeping and legal obligations, which may mean some data cannot be deleted immediately.

We may update this policy from time to time, for example as the school introduces new features or as Indonesian data protection rules evolve. The “Last updated” date at the top of this page will always reflect the current version. For any material change affecting enrolled families, we will also let you know directly.

Questions about this policy or your personal data are always welcome:

See also our Terms of Service.