Donate

PUPA Center — Privacy Policy

Last updated: 18 July 2026

A note for young readers: if you are under 18 or have a guardian, please read this policy together with your parent or guardian, so you can decide together how your information is shared with us.

1. Who We Are

PUPA Center (Yayasan Perisai Unggul Pelita Anugrah) “PUPA,” “we,” “us” is a development center based in Tangerang, Indonesia, providing life-skills and work-readiness support for neurodivergent young adults. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website or communicate with us, including through our WhatsApp and Telegram messaging services.

Contact: Email: info@pupacenter.org · Ruko Prominence Blok 38E No. 42-43, Jl. Sutera Barat Boulevard, Alam Sutera, Tangerang 15143, Indonesia · +62 818 533 698

2. Scope

This policy covers personal data we process when you:

  • Visit our website at pupacenter.org;
  • Contact PUPA through our WhatsApp lines or Telegram;
  • Are a parent, guardian, or family member of a person enrolled with or enquiring about PUPA;
  • Are a prospective participant, partner, donor, volunteer, or member of the public who contacts us.

Our messaging services use the WhatsApp Business Platform (Meta) and the Telegram Bot Platform. Your use of WhatsApp and Telegram is also governed by their respective privacy policies.

3. Website Visitors

Our website is an informational site. We keep what happens in your browser to a minimum:

  • No tracking. We do not use advertising cookies, analytics services, or tracking scripts of any kind.
  • Technical data. Our hosting provider (Cloudflare) processes standard technical information — such as your IP address and the pages requested — as necessary to deliver the site securely and reliably. We do not use this information to identify visitors.
  • Fonts. Our pages load fonts from Google Fonts, which means your browser sends a standard request (including your IP address) to Google’s servers. This is governed by Google’s privacy policy.
  • Settings stored on your device. If you choose a language with the language toggle, or adjust our accessibility settings (such as text size or contrast), those preferences are saved in your own browser’s local storage so the site remembers them. They are never transmitted to us, and you can clear them at any time through your browser settings.
  • External links. Links to WhatsApp, Instagram, YouTube, and Google Maps take you to services governed by their own privacy policies.

4. The Personal Data We Collect

Depending on how you interact with us, we may collect:

  • Contact information: your phone number, name (or the name you give us), and the messaging channel you use.
  • Message content: the messages you send us and our replies, for the purpose of responding to you and providing our services.
  • Relationship context: information you choose to share about your situation or enquiry (for example, that you are a parent enquiring about our programs, or scheduling and attendance information for an enrolled participant).
  • Donation records: if you donate by bank transfer or QRIS, the name and transfer details that appear on our bank records, which we keep for accounting and as required by law.

Sensitive Personal Data

Some information you may share — relating to health, disability, or a person’s developmental needs — is treated as specific personal data (“data pribadi yang bersifat spesifik”) under Indonesia’s Personal Data Protection Law (UU No. 27 of 2022). We handle this category with heightened care:

  • We do not retain diagnoses, medical conditions, medication details, therapy notes, or behavioral-incident details in our automated contact records.
  • Where continuity is helpful, we keep only generalized, non-clinical summaries (for example, “parent enquiring about life-skills programs”), not clinical or medical specifics.
  • Sensitive information is processed only as necessary to provide support and route you to the right member of our team.

5. How We Use Your Data

We use your personal data to:

  • Respond to your enquiries and provide our support services;
  • Coordinate scheduling, attendance, and program logistics for enrolled families;
  • Send service notifications (such as attendance updates) to families who have agreed to receive them;
  • Route your enquiry to the appropriate member of PUPA staff;
  • Maintain a record of our communications so our team can assist you effectively;
  • Record and account for donations;
  • Improve the quality and safety of our services.

We process your data on the basis of your consent, our legitimate interest in operating PUPA and responding to you, and to fulfill our services to enrolled families. For specific (sensitive) personal data concerning an enrolled participant, we rely on the consent of the participant or their guardian.

6. Automated Messaging and Human Handling

Our WhatsApp and Telegram services use automated assistance to help us respond promptly and to handle routine notifications. Conversations involving personal judgment or sensitive matters are handled by, or escalated to, PUPA staff. We do not use your messages to make automated decisions that produce legal or similarly significant effects on you without human involvement.

7. Who We Share Data With

We do not sell your personal data. We share it only:

  • Within PUPA’s team, with staff who need it to assist you;
  • With service providers who help us operate (for example, our messaging platform providers and secure hosting/storage providers), under appropriate confidentiality and data-protection terms, and only as necessary;
  • Where required by law, in response to a lawful request from law enforcement or a competent authority under applicable regulations, or to protect the safety of a person where we believe in good faith there is a risk of serious harm.

Our messaging is delivered through Meta (WhatsApp) and Telegram, which process message delivery on their infrastructure. Some of our providers may process data outside Indonesia; where they do, we take steps consistent with UU PDP No. 27/2022 for such transfers.

8. How Long We Keep Your Data

We keep personal data only as long as necessary for the purposes above:

  • Communication records are retained for as long as needed to provide and account for our services, then deleted or anonymized.
  • Contact summaries are kept while a relationship is active and are removed or anonymized when no longer needed. We use soft-deletion to preserve necessary audit integrity before permanent removal.
  • Donation records are kept for the period required by accounting and tax regulations.
  • We do not retain sensitive clinical detail in automated records (see Section 4).

9. How We Protect Your Data

We apply technical and organizational measures appropriate to the sensitivity of the data, including access controls limiting data to staff who need it, secured storage for sensitive documents, and encryption in transit. No system is perfectly secure, but we work to protect your information and to limit what we collect and retain.

If a breach happens: in the event of a personal-data breach affecting your data, we will notify you in writing (electronically or otherwise) and report to the competent authority within the timeframe required by UU PDP No. 27/2022 — no later than 3×24 hours after we become aware of it — including what happened, what data was involved, and what we are doing about it.

10. Your Rights

Under UU PDP No. 27/2022, you have rights regarding your personal data, including to:

  • Access the personal data we hold about you;
  • Correct inaccurate or incomplete data;
  • Withdraw consent and request that we stop processing or delete your data, subject to legal retention requirements;
  • Object to certain processing;
  • Lodge a complaint with the relevant authority.

To exercise any of these rights, contact us at info@pupacenter.org. We will respond within the timeframe required by law.

11. Children and Participants

PUPA supports young adults, and we communicate primarily with parents and guardians. Where we process personal data concerning a child (under 18 under Indonesian law) or a person who has a legal guardian, we do so with the consent of the parent or guardian as required by UU PDP No. 27/2022, and we handle that data with particular care.

12. Changes to This Policy

We may update this policy from time to time. We will post the updated version here with a revised “Last updated” date. If we make significant changes to how we handle personal data, we will take reasonable steps to inform families we are actively in contact with, for example through our WhatsApp channels.

13. Contact Us

If you have any questions about this policy or how we handle your personal data, contact:

PUPA Center: Email: info@pupacenter.org · Ruko Prominence Blok 38E No. 42-43, Jl. Sutera Barat Boulevard, Alam Sutera, Tangerang 15143, Indonesia · +62 818 533 698

This policy reflects our practices as of the date above and our commitment to handling your personal data responsibly under Indonesia’s Personal Data Protection Law (UU No. 27 Tahun 2022).