Privacy Policy & Research Data Governance

1. Legal & Regulatory Framework

Evorise Consulting ("Evorise", "we", "our") operates in full compliance with the statutory framework of the Republic of Indonesia and international development partner protocols, specifically:

• Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP): Operating as both a Data Controller and Data Processor with defined duties of data minimization, lawful processing, and notification protocols.
• Donor Data Protection Protocols: Aligning with institutional standards established by bilateral donors (e.g., DFAT, USAID, GIZ) and multilateral agencies (UN, World Bank) concerning research ethics, beneficiary safeguarding, and anonymization.
• Non-Disclosure Obligations (NDA): Enforcing strict project confidentiality ensuring client program identifiers, specific respondent identities, and preliminary findings remain protected under contractual and institutional covenants.

2. Information We Collect

We collect and process personal data solely to fulfill legitimate advisory, institutional research, recruitment, and stakeholder communication mandates:

3. Field Research & Beneficiary Informed Consent

Field data collection with grassroots communities, vulnerable groups, smallholder farmers, and informal sector workers requires heightened ethical governance:

• Child & Youth Safeguarding: Interviews with children under 18 require documented parental/guardian consent and child assent, conducted in adherence to our Child Protection Policy.
• Immediate De-Identification: Field records collected via mobile CAPI tools (KoboToolbox, ODK, SurveyCTO) are stripped of direct personal identifiers (names, national ID numbers) and replaced with unique alphanumeric tokens prior to analytic export.
• Geographic Aggregation: GPS coordinates collected for spatial diagnostic purposes are aggregated to village or district centroids to prevent pinpointing individual homesteads or facilities.

4. Purpose of Processing & Non-Disclosure

Evorise Consulting processes data exclusively for the following authorized purposes:

• Executing contracted monitoring, evaluation, and policy research engagements.
• Delivering evidence syntheses, anonymized baseline reports, and strategic advisory deliverables to client counterparts.
• Facilitating recruitment, screening, and contracting of field enumerators, facilitators, and research associates across Indonesia.
• Responding to partnership inquiries and institutional requests for proposal.

5. Data Storage, Security & Retention Protocols

We employ enterprise-grade technical and organizational safeguards to prevent unauthorized access, accidental alteration, disclosure, or destruction:

• Encryption: All field data transmitted from mobile devices is encrypted in transit using TLS 1.3 cryptographic protocols and stored in AES-256 encrypted cloud repositories.
• Access Control: Primary raw field datasets are restricted strictly to designated Lead Analysts and Data Managers under role-based access control (RBAC) and multi-factor authentication (MFA).
• Retention Schedule: Personal contact records collected during field research are securely deleted or purged within twelve (12) months following the formal delivery and acceptance of the final evaluation report, unless client contractual covenants mandate a specific audit retention period.

6. Your Rights under Indonesian PDP Law

Under Law No. 27/2022 (UU PDP), data subjects possess legally recognized rights regarding their personal data held by Evorise Consulting:

• Right to Information: The right to obtain clarity regarding the identity of the controller, legal basis, and purpose of processing.
• Right to Rectification: The right to update or correct inaccurate or incomplete personal records.
• Right to Erasure / Right to be Forgotten: The right to request deletion of personal information subject to statutory audit exemptions.
• Right to Withdraw Consent: The right to revoke previously granted consent at any time without punitive repercussions.
• Right to Object: The right to object to automated decision-making or specific analytical uses of their information.

7. Privacy Officer & Institutional Contact

To exercise your legal data rights, lodge an inquiry regarding data processing practices, or report a suspected data incident, contact our designated Data Protection Officer: