Privacy Policy

1.1. Personal Data is data about an identified or identifiable individual, whether directly or indirectly, through electronic or non-electronic systems, in accordance with Article 1(1) of Law Number 27 of 2022 on Personal Data Protection (“PDP Law”).

1.2. A User is any person who creates an account and uses the Certive service, whether as a Document Holder, an Issuer, or a member of an Organization.

1.3. Issuer is a User who issues a Document through Certive, either as an individual or on behalf of an Organization.

1.4. Document Holder is a User who receives and holds a Document issued to them.

1.5. Verifier is anyone who checks the authenticity of a Document through a Certive verification link, with or without an active account.

1.6. Organization is an entity formed within Certive to issue Documents collectively on behalf of an institution.

1.7. Document is any digital file issued by an Issuer through Certive to have its integrity and provenance recorded.

1.8. Digital Fingerprint (Hash) is a unique representation of a Document’s contents, generated on the Issuer’s own device, which Certive records to prove a Document’s integrity without ever storing the Document itself.

1.9. Hash Registry is Certive’s internal database that stores the Digital Fingerprint of every Document ever issued, for the purpose of duplicate checking.

1.10. Crypto Wallet is a blockchain-based digital wallet that may optionally be linked to a Certive account.

1.11. Personal Data Controller is the party that determines the purpose of, and exercises control over, the processing of Personal Data; in this case, Baliola.

1.12. Personal Data Processor is a third party that processes Personal Data on behalf of, and based on the instructions of, the Personal Data Controller, as described in Section 4.

2.1. Information you provide directly. When you create and use an account, We collect your name, email address, and password (stored in encrypted form, never in plain text). When you establish or manage an Organization, We collect the institution’s name and information about invited members. When you take part in an Issuer eligibility review for the notary and law firm segment, We may request your professional registration number or business entity documents, as set out in Article 4.3 of the Terms of Service.

2.2. Document-related information. We collect issuance metadata consisting of the Document type, a brief description, the recipient’s email address, and the time of issuance, together with the Document’s Digital Fingerprint. We never collect or store the contents or the original file of the Document itself. Every file is processed directly on the Issuer’s device to generate its Digital Fingerprint, and only that derived value is sent to Certive. The Document type and brief description fields are filled in by the Issuer; Certive does not review or moderate the contents of these fields, so the Issuer is responsible for not including specific Personal Data, such as health data or children’s data, in them unless genuinely necessary, consistent with the Issuer responsibility statement in Article 7.5 of the Terms of Service.

2.3. Payment information. For paid Service Plans, transactions are processed through a third-party payment service provider. Certive does not store your credit card, debit card, or other payment instrument details directly on Our servers.

2.4. Crypto Wallet information. If you optionally link a Crypto Wallet, We only collect its public wallet address. Certive never requests, receives, or stores your Crypto Wallet’s private key.

2.5. Technical and log information. We collect IP addresses, device and browser type, authentication and login-attempt logs, and access logs for the Hash Registry as set out in Article 13.6 of the Terms of Service, for security and audit-trail purposes.

2.6. Information from Verifiers. For Verifiers who are logged in, We collect their verification history. For Verifiers who are not logged in, We only collect standard technical logs (such as IP address) necessary for system security, without any additional personal identity data.

3.1. We use the information collected to provide and operate Certive’s core service, including issuing, verifying, and revoking Documents.

3.2. We use your email address to verify your account identity, send issuance notifications and Verification Links, and secure your account.

3.3. We use the supporting documents you submit to conduct Issuer eligibility reviews and determine the Issuer Trust Level as set out in Article 9 of the Terms of Service.

3.4. We use the Digital Fingerprint and issuance metadata to prevent duplication, detect indications of abuse, and follow up on reports as set out in Article 11 of the Terms of Service.

3.5. We use payment information to process billing for Service Plans and the Web3 Staking program.

3.6. We use the information collected to fulfill legal obligations, including compliance with the PDP Law and official requests from competent authorities.

3.7. We use aggregated usage data to improve the quality, reliability, and security of the Certive service.

3.8. We may send marketing communications about Baliola’s products and services. These communications are optional, and you may unsubscribe at any time through the link included in each email.

4.1. Certive does not sell your Personal Data to any party.

4.2. Mandala Chain. The Digital Fingerprint, in the form of a secret-key-derived value as set out in Article 13.3 of the Terms of Service, is permanently recorded on the partner blockchain network. This record contains no Personal Data or Document content, but it is public and permanent on the blockchain network, so it cannot be deleted by anyone, including Baliola, once successfully recorded. The implications for the right to erasure are explained further in Section 6.5.

4.3. Third-party service providers. We share relevant information with payment service providers, email delivery services, the Key Management Service, and cloud infrastructure providers, as Personal Data Processors acting on Our instructions and bound by confidentiality obligations.

4.4. Document recipients. When an Issuer issues a Document, the recipient’s email address provided is used to send a notification and Verification Link, as an inherent part of the issuance service.

4.5. Competent authorities. We may disclose information where required by law, a court order, or other lawful legal process.

4.6. Business transactions. In the event of a reorganization, merger, acquisition, or transfer of Baliola’s business, your information may be transferred to the successor entity as set out in Article 23.4 of the Terms of Service, with notice to affected Users.

5.1. All data communication between a User’s device and the Certive system is encrypted, and passwords and other sensitive data are stored using industry-standard encryption.

5.2. The Digital Fingerprint is generated directly on the Issuer’s own device. The original Document file is never sent to or stored on Certive’s servers, a privacy commitment designed in from the product’s earliest design stage (privacy by design).

5.3. The secret key used to derive the final hash value is stored in a managed Key Management Service, is never hardcoded, and supports periodic rotation with version tracking.

5.4. Access to the Hash Registry is internally restricted, and every access is logged as part of Baliola’s security audit trail.

5.5. Certive temporarily restricts repeated failed login attempts, and a login session automatically expires after a certain period to prevent unauthorized access.

5.6. We continuously evaluate and update our information security practices in line with evolving threats and applicable industry standards.

5.7. Notification of a Personal Data Protection failure. In the event of a Personal Data Protection failure affecting the confidentiality, integrity, or availability of your Personal Data, Baliola will provide written notice to you no later than 3 (three) calendar days (72 hours) after becoming aware of the failure, in accordance with Article 46 of the PDP Law, together with the remediation and recovery steps taken or to be taken. In certain circumstances that seriously affect public services or the broader public interest, notice will also be given to the public generally.

In accordance with Law Number 27 of 2022 on Personal Data Protection, you have the following rights over your Personal Data.

6.1. The right to obtain information regarding the clear identity, legal basis, purpose of the request and use, and accountability of any party requesting your Personal Data.

6.2. The right to access and obtain a copy of the Personal Data We hold about you.

6.3. The right to complete, update, and/or correct errors and/or inaccuracies in your Personal Data. We will act on this request no later than 3 (three) calendar days after it is received in full, in accordance with Article 30 of the PDP Law.

6.4. The right to delay and restrict the processing of your Personal Data, in part or in whole. We will act on this request no later than 3 (three) calendar days after it is received, in accordance with Article 41 of the PDP Law.

6.5. The right to stop processing, delete, and/or destroy your Personal Data, subject to one important exception you should understand: a Digital Fingerprint already permanently recorded on the blockchain cannot be deleted by anyone, including Baliola, due to the tamper-proof nature of the blockchain network. That record contains no Personal Data or Document content of yours. Account data, issuance metadata, and other personal information stored in Certive’s internal systems can be deleted or anonymized at your request, except for any part that must be retained for legal compliance.

6.6. The right to withdraw consent you have given for the processing of Personal Data, provided that withdrawal does not conflict with other applicable laws and regulations.

6.7. The right to object to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects you.

6.8. The right to data portability, namely to obtain and use your Personal Data in a commonly used format readable by electronic systems, and to transfer it to another Personal Data Controller, to the extent technically feasible.

6.9. The right to sue and receive compensation for a violation in the processing of Personal Data concerning you, in accordance with applicable law.

6.10. The right to file a complaint with the Personal Data Protection supervisory institution mandated under Article 58 of the PDP Law. As of the date this Privacy Policy was last updated, that institution has not yet been formally established by the Government of the Republic of Indonesia. Pending its operation, sector-specific complaints regarding compliance with the PDP Law may be submitted to the Ministry of Communication and Digital Affairs, without prejudice to your right to file a complaint with the supervisory institution once it is formally operational.

6.11. You may exercise the rights above by contacting Us through the channel in Section 10. For requests that do not have a fixed timeframe under the PDP Law, We will respond within a reasonable period.

7.1. Certive uses essential cookies necessary to maintain your login session and support security features, including the restriction of repeated failed login attempts.

7.2. Certive may use analytics cookies to understand aggregate platform usage patterns, to improve service quality.

7.3. You may manage or decline non-essential cookies through your browser settings. Declining essential cookies may impair your account’s login and security functions.

7.4. Certive does not use third-party cookies for advertising purposes.

8.1. Your account data is stored for as long as your account remains active, and for a certain period after account closure to meet legal, audit, or dispute-resolution needs.

8.2. Issuance metadata and the Digital Fingerprint in the Hash Registry are stored for as long as the relevant Document remains actively recorded on the blockchain, since they are needed as a reference for duplicate checking and ongoing verification, as set out in Article 7.4 of the Terms of Service.

8.3. A Digital Fingerprint already recorded on the blockchain network is permanent and has no retention period, because it cannot be deleted by anyone after being recorded, including by Baliola itself.

8.4. Payment data is stored for the period required under applicable Indonesian tax and accounting law.

8.5. After an account is closed, Personal Data no longer needed will be deleted or anonymized, except for any part that must be retained for legal compliance as set out in Section 6.5.

9.1. Baliola has the right to update this Privacy Policy from time to time to reflect changes in the service, technology, or applicable law, including developments in the PDP Law’s implementing regulations and the establishment of its supervisory institution.

9.2. Material changes will be communicated to Users through their registered email or a notice within the Certive platform, at least seven calendar days before taking effect, consistent with Article 21.2 of the Terms of Service.

9.3. Continued use of the Certive service after the effective date of a change is deemed acceptance of the updated Privacy Policy.

10.1. Any question, request to exercise a right over Personal Data, or complaint relating to privacy may be submitted through email: support@baliola.io.

10.2. Baliola will respond to every request received within the timeframe set out in Section 6, or within a reasonable period for requests that do not have a fixed timeframe under the PDP Law.

Still have questions about your privacy? Our team is ready to help you understand how Certive protects your data. Contact Us at support@baliola.io.