Skip to content

Privacy notice

Version 2026-10-22

This notice explains which personal data we collect when you register for Global Edufair 2026 and, if you also join it, the Career and Study Assessment, what we use it for, who can see it, how long we keep it and what your rights are. It follows Indonesia’s Personal Data Protection Law, Law No. 27 of 2022 (UU PDP).

1. Who manages your data

The data controller is the Global Edufair 2026 committee of Gelanggang Inovasi dan Kreativitas, Universitas Gadjah Mada (GIK UGM), which organises the event, at Jl. Pancasila No.1, Bundaran UGM, Caturtunggal, Depok, Sleman, Yogyakarta 55281.

2. What we collect

  • GEF registration: your full name, email, WhatsApp number and school or university, as you enter them when registering.
  • GEF registration: your major, enrollment year, UGM email (optional) and non-UGM email, kept as backup contact addresses for the committee.
  • GEF registration: your study plans (plans to study abroad, when, destination country, field of study and language score) and how you heard about GEF.
  • The university booths and seminars you choose.
  • Booth visits: which booths you visit and the check-in time, including check-ins the committee records for you.
  • When you agreed to this notice and which version, and a record of the emails sent with your unique code.
  • Career and Study Assessment, a separate registration that exists only if you sign up for it: email, full name, institution, enrollment year, grade, age, WhatsApp number, your chosen session, why you want to join, your display language, and the time of registration and your registration code (starting with ASM-); if you are under 18, also your tick that your parent or guardian has agreed (only yes or no is recorded; we hold no details of the parent or guardian).
  • Cookies and storage on your device: a random code that lets your phone be recognised when you open the e-ticket and scan booth QR codes (cookie valid for 180 days), a language cookie (1 year), and a draft of the form you have not sent yet. The draft is kept in the browser tab, is not sent to the server before you press the submit button, and is gone when the tab is closed, when the registration is sent, or (in the GEF registration form) when you choose “No” and leave the form through the link in the message that appears. In the Career and Study Assessment form the draft only reappears if you come back within 30 minutes.
  • Your IP address, used briefly to limit repeated attempts and never stored with your registration.

We don’t ask for your home address, date of birth, photo or ID number.

3. What we use it for

  • To record your registration and create your unique code and e-ticket.
  • To email GEF registrants their unique code, e-ticket link, seminar schedule and directions. Career and Study Assessment registrants are not sent any email.
  • To contact you on WhatsApp (a third-party service, only when the committee contacts you) when there is important information about the event or your Assessment session, such as a schedule change.
  • To recognise you when you scan a booth QR and record the visit as a stamp on your e-ticket.
  • To manage seminar seats and prepare the event, for example by estimating visitors per booth.
  • To understand what visitors are interested in, for example their major, year, the countries and fields of study they aim for and how they heard about GEF, so the event and its information fit better.
  • To organise the participants of each Career and Study Assessment session.
  • To write the event report for the committee.

Your data is never sold or used for advertising.

4. Legal basis

We process your data based on your consent (Article 20(2)(a) of UU PDP). You give it by choosing “Yes, I agree” in the GEF registration form, or by ticking the consent box in the Career and Study Assessment form. In the GEF registration form, if you choose “No”, the form cannot be submitted and nothing you typed is sent to the server. What you have typed stays in this browser tab until the tab is closed, and is deleted if you leave the form through the link in the message that appears. If the committee registers you (for example from a school list or a paper form), a committee member confirms that your consent, and your parent’s or guardian’s consent if you are under 18, has been obtained; that committee member’s account is recorded. We record when you agreed and to which version.

5. Participants under 18

UU PDP requires a parent’s or guardian’s consent to process the personal data of children under 18. If you are under 18, ask your parent or guardian before registering. In the GEF registration form, your parent’s or guardian’s agreement is part of the “Yes, I agree” you choose; in the Career and Study Assessment form you are also asked to tick that your parent or guardian has agreed.

6. Who can see your data

Only appointed GIK UGM committee members, signed in to the committee panel with their own accounts. Your data is not given to anyone outside the committee.

Technical service providers process the data only to run this service, on the committee’s instructions: Vercel (hosting), Neon (database, servers in Singapore) and Resend (email delivery).

7. How long we keep it

GEF registration data, Career and Study Assessment registration data and booth visit data is kept until the event is over and its report is written, then deleted no later than 6 months after the event day, unless the committee sets another period and announces it on this page. Export files and backup copies made by the committee are deleted by the same deadline; automatic backups at the database provider follow the provider’s own retention.

The device cookie expires after 180 days and the language cookie after 1 year. You can also remove the device cookie at any time with the “Remove this e-ticket from this device” button on the e-ticket page.

8. Your rights

  • Access: ask for a copy of the data we hold about you.
  • Correction: ask us to fix wrong data. The committee corrects your name, email, school/university and email language in the panel; for other answers in the form, such as your WhatsApp number, the committee gets help from the technical team or deletes your registration so you can register again.
  • Deletion: ask us to delete all your registration data. GEF and Career and Study Assessment registrations are deleted separately, so say which one you mean.
  • Withdraw consent: stop the processing of your data. Your registration is deleted too, so the e-ticket and unique code stop working.

9. How to use your rights

Send your request to gef@gikugm.com. Write from the email you registered with and include your unique code (your GEF code, or the registration code starting with ASM- for the Career and Study Assessment; if you lost it, give the full name and WhatsApp number you registered with), so the committee can confirm the request is really from you.

The committee acts on your request within 3 × 24 hours of receiving it.

10. How we protect your data

  • Every page uses an encrypted connection (HTTPS).
  • Registrant data can only be opened by committee members signed in with their own accounts; their passwords are stored as hashes.
  • Unique codes and e-ticket links are random and hard to guess, and repeated attempts are limited.
  • Each booth QR uses a secret key, and unusual visits are flagged for the committee to check.
  • We collect only what relates to the event and the Assessment session.

If a personal data protection failure happens, the committee tells you in writing within 3 × 24 hours, as UU PDP requires.

11. Changes to this notice

If this notice changes, the new version is published on this page with a new version number. Your consent is recorded against the version in force when you registered.