This policy explains how Universitas PGRI Semarang, through its ICT Unit (UPT TIK) as operator of SIMEKAR SSO and the Academic Parent service (the parent/guardian portal at https://simekar.upgris.ac.id/academic-parent), collects, uses, stores, shares, and deletes your personal data. By using the service you agree to the processing described below, in line with Indonesian Law No. 27 of 2022 on Personal Data Protection.
1. Data we collect
a. Data from your Google account (Sign in with Google). When a parent/guardian signs in to Academic Parent we only request the openid, email, and profile scopes, so we only receive: your Google account ID, name, email address and its verification status, and profile photo URL. We do not receive your Google password and do not access Gmail, Google Drive, contacts, calendar, or any other Google data.
b. Data you enter. The parent/guardian national ID number (NIK) to verify the relationship with the student, and the student’s NIK to link your child.
c. Technical data & security logs. IP address, browser type (user agent), time, and key activities (sign-in, NIK verification, linking, data views, transcript printing, failed attempts).
d. Cookies. A session cookie (required to keep you signed in), a language preference cookie, a visit statistics cookie, and Google Analytics on public pages for aggregate visit statistics.
2. How we use data
- To authenticate you and confirm that your email address is verified by Google.
- To verify that you are the student’s father, mother, or guardian by matching your NIK with the parent/guardian NIK recorded in the student’s data.
- To show the academic and financial records of your linked child: study plan, SPADA class attendance, semester grade reports, provisional transcript, and billing and payment history.
- To email the student when their account is linked by a parent/guardian, as a safeguard against misuse.
- To keep the service secure: rate limiting, abuse detection, and auditing.
Your data is not used for advertising, marketing profiling, or training artificial intelligence models.
3. Use of Google user data
Information received from Google APIs is used only to provide sign-in and account identity in Academic Parent as described in this policy. Its use and transfer adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, not transferred to other parties, and not read by humans unless you consent, for security purposes, or where required by law.
4. Data sharing
We do not sell or rent personal data. Data can only be accessed by:
- Verified parents/guardians, limited to the records of the child linked to them;
- The student concerned (the linking notice includes the parent/guardian account email);
- Authorised staff of UPT TIK and the University’s academic/finance units, for support and auditing;
- Competent authorities where required by law.
Service providers we use: Google (Sign in with Google & Google Analytics) and an email provider to send notifications.
5. Storage & security
- Data is stored on servers owned by Universitas PGRI Semarang and transmitted over encrypted connections (HTTPS).
- NIKs are not stored in plain form. The system keeps only a cryptographic fingerprint (HMAC-SHA256) for matching and a masked display (e.g. 3324********0001). The student NIK you enter is used only for matching at that moment and is recorded in masked form in the security log.
- Service credentials are stored encrypted; access is limited to authorised staff.
- Access rights to student data are re-checked every time data is opened. If the parent/guardian NIK in the student’s data changes and no longer matches, the link is revoked automatically.
- Verification attempts are limited, sessions expire after 30 minutes of inactivity, and forms are protected against request forgery.
6. Retention
Academic Parent account data is kept while the account is active. Security and activity logs are kept for at most 2 (two) years and then deleted. Temporary cached grade and attendance data is deleted automatically within minutes to hours. Students’ academic and financial records do not belong to this service; they are managed by the University under its academic records rules.
7. Your rights
Under the Personal Data Protection Law you have the right to:
- Know and request a copy of the personal data we hold about you;
- Correct inaccurate data;
- Unlink a student at any time using Unlink in Academic Parent;
- Request deletion of your Academic Parent account and all its links;
- Withdraw Google access at any time in your Google account settings.
Students who do not recognise a parent/guardian account linked to their data may ask for the link to be revoked.
8. How to request data deletion
Email [email protected] from the Google account email address you use, with the subject "Delete Academic Parent Account". Requests are processed within 14 working days; your account, masked NIK, and all child links will be deleted. Security logs required for auditing are kept until their retention period ends.
9. Who the service is for
Academic Parent is intended for adult parents or guardians of students. It is not directed at minors. Students, lecturers, and staff who sign in to SIMEKAR SSO with university accounts are subject to the University’s academic data management rules.
10. User responsibilities
You must use your own NIK and access only your own child’s records. Using another person’s NIK or attempting to access other students’ data is a violation and may be sanctioned under applicable law. Accounts suspected of misuse may be blocked.
11. Changes to this policy
This policy may be updated from time to time. The effective date at the top of this page will change, and significant changes will be announced on SIMEKAR SSO.
12. Contact
ICT Unit (UPT TIK), Universitas PGRI Semarang
Jl. Sidodadi Timur Nomor 24 - Dr. Cipto Semarang - indonesia
Phone: (024) 8316377, 8448217
Email: [email protected]