How we handle your drillhole database, and what we promise about it.

Scope of this page

This page describes how ACALA handles two kinds of information: personal data belonging to identifiable people, and confidential technical and commercial data belonging to client organisations. The law treats them differently. In practice we protect them with the same controls, because a drillhole database and a list of course participants sit on the same laptop.

It applies to consulting engagements, training delivered on client data, software implementation and support, and the correspondence around all of them. It does not replace the confidentiality clause in your engagement contract or a signed non-disclosure agreement; where those say something stricter, they win.

Controller and processor

Under Law No. 27 of 2022 on Personal Data Protection, and using the equivalent language of the GDPR where a client is subject to it, our role depends on what we are doing.

• We are the controller for the personal data of people who contact us, subscribe to our updates, apply for a job, or attend one of our public events. We decide why we hold it and for how long. That is covered in the privacy policy.
• We are the processor for personal data inside material you give us for an engagement, for example the names of geologists in a drillhole logging table or the staff list in a training booking. You decide why it exists; we act on your instructions.
• For your technical and commercial data the concept of controller does not apply, because it is not personal data. It is confidential information, and it is protected by contract, not by data protection law. We treat it as the more sensitive of the two.

Where we act as processor we act only on documented instructions, we do not use the data for our own purposes, and we do not transfer it onward without your permission except where the law compels us and, where we are allowed to, we tell you first.

Handling mine data

Most of what clients send us would move a share price if it leaked before it was announced. We work on that assumption from the first email.

• Transfer. We prefer a link from your own system or a secure transfer service over an email attachment. Where a client insists on email, we accept it, but we say plainly that email is not a secure channel.
• Separation. Each engagement lives in its own project area. Data from one client is never visible inside another client’s project, and we do not merge client datasets to build a reference database.
• Named access. Only the people assigned to your engagement can open your project. Assignment is by name, not by department.
• No secondary use. We do not use your data to train models, to build demonstration material, or to enrich anything we sell. Where we want to use anonymised project experience in an article or a conference paper, we ask you first, in writing, and we accept a refusal without argument.
• Synthetic alternatives. Where a training course or a demonstration needs realistic data and confidentiality prevents using yours, we build a synthetic dataset that behaves like the deposit rather than borrowing another client’s.

Technical measures

What we actually do, rather than what a template would claim.

• Transport encryption on the website, with HTTPS forced for every request and older insecure requests upgraded.
• Access to project storage requires an individual account. Accounts are removed when someone leaves, as part of the leaving process rather than a periodic review.
• Working machines are full-disk encrypted and locked when unattended.
• Backups are taken before any change to a live system and kept in a location separate from the working copy.
• Website administration is limited to the smallest number of accounts that can do the job, and third-party components are kept current.
• Retired tools are removed rather than left switched off; in 2026 we removed an analytics tool, a recruitment plugin and a slider library from the site once they stopped being used, because unused code is a way in.

We do not claim a certification we do not hold. We hold ISO 9001 and ISO 14001. We are not ISO 27001 certified, and we will tell you that in a tender rather than let a checkbox imply otherwise.

Organisational measures

• Every member of staff is bound by a confidentiality obligation that survives the end of their employment.
• Sub-contractors and associates sign the same obligation before they see client material, and they are named to you if you ask.
• Competent Persons and Specialists are bound in addition by the ethical codes of the professional bodies they belong to, which carry their own confidentiality duties and their own sanctions.
• Access to a project ends when a person’s role in it ends.
• Requests to hand over client data to anyone outside the engagement, including a parent company or a prospective investor, go to the client for approval first, whoever is asking.

Sub-processors and where data sits

We keep the list short on purpose. The services that can touch data in the ordinary course of business are: our website and email hosting in Indonesia; a transactional email service used to deliver form notifications; a customer relationship tool used for our own subscriber list; and, where you choose to use it, WhatsApp for correspondence.

Client project data is not stored in the website, the mailing tool or WhatsApp. It sits in project storage under our control. Where an engagement requires a cloud environment, including a Dassault-hosted 3DEXPERIENCE tenant, that is agreed with you in writing beforehand, along with the region the data sits in.

Some of these services are operated by companies outside Indonesia, so a transfer abroad can occur. Where that happens we rely on the transfer conditions permitted by Law No. 27 of 2022 and, for clients subject to the GDPR, on standard contractual clauses. If your policy forbids a transfer outside a particular jurisdiction, tell us at the quotation stage and we will design the engagement around it or decline it.

Return and destruction

At the end of an engagement we return the deliverables and, if you ask, the working files. We keep a project archive so that we can answer a later question, reproduce a number, or defend the work if a regulator or an auditor challenges it. That archive is kept for the period in the engagement contract; where the contract is silent, five years, which reflects the professional obligation attached to a signed technical report.

You can ask for earlier destruction and we will do it, except where a law, a regulator or a professional body requires us to retain a record. If that exception applies we tell you which one, rather than refusing without a reason. Destruction means deletion from working systems and from backups as they cycle, and we confirm it in writing when it is complete.

If something goes wrong

If we become aware of unauthorised access to, or disclosure of, data belonging to you, we contain it first, then tell you. Our target is to notify the affected client without undue delay and in any case within 72 hours of confirming an incident, with what we know at that point rather than waiting for a complete picture. Where personal data is involved and the law requires notification of the authority or the individuals, we support you in making it and, where we are the controller, we make it ourselves.

We keep a record of incidents, including those that turned out to be harmless, because the pattern is more useful than any single event.

Business continuity

Project data exists in more than one place, so the loss of a single machine does not lose the work. Engagements that carry a deadline with a regulator or an exchange are staffed so that more than one person understands the work in progress. Where an engagement is critical enough that you need a formal continuity commitment, ask for it at the quotation stage and we will put it in the contract or tell you we cannot meet it.

Software licence compliance

We do not install, activate or support GEOVIA software on a licence that does not cover the intended use, and we will not help a client work around a licence limit. If we notice that a configuration exceeds what a client has licensed, we say so privately and give the client the chance to put it right. This protects the client as much as the vendor: an audit finding is more expensive than a licence.

Standards and frameworks we work to

Our management system is certified to ISO 9001 for quality and ISO 14001 for environmental management. Technical reporting follows SNI 4726 and KCMI in Indonesia and, where a listing requires it, JORC 2012, SAMREC or NI 43-101. Personal data handling follows Law No. 27 of 2022, and we apply GDPR-equivalent handling for clients and visitors it covers rather than maintaining two standards.

Certification covers how we run the business. It does not certify any individual estimate; that rests on the Competent Person who signs it.

Due diligence questions

If your procurement process needs a security questionnaire completed, a sub-processor list, or evidence of the controls above, send it to office@acala.co.id. We answer them, and we answer “no” where the honest answer is no.