Applicant Privacy Notice
PT Spectrum Group Indonesia. Version 2026-10-23.3.
01Who we are
The controller of your personal data is PT Spectrum Group Indonesia (“Spectrum Group”, “we”).
Jl. Raya Casablanca Kav. 88
Lantai 10 Unit E & Lantai 26 Unit D
Menteng Dalam, Tebet
Jakarta Selatan 12870, Indonesia
For questions about your personal data, contact privacy@spectrumgroup.id.
02What this notice covers
This notice explains how we process your personal data when you apply for a job through job.spectrumgroup.id or make a request about your data.
We give you this notice before asking for your consent, so you can decide with full information. The Indonesian version is provided alongside it.
03The data we collect
| Category | Data | Why we need it |
|---|---|---|
| Identity and contact | Full name, email, city of residence, phone number (optional) | To identify you and contact you about your application |
| Education and experience | Secondary education, highest education, years of relevant full-time experience, years of other relevant experience (such as internships or university teams) | To check that your background matches what the role needs |
| Professional | Your CV, portfolio, cover letter and other supporting documents (optional, up to 5 PDFs), LinkedIn or website URL (optional), GitHub profile (optional), your message (optional) | To assess your experience and skills |
| Eligibility | Whether you can legally work in Indonesia; confirmation you are at least 18 | To make sure we can lawfully employ you |
| Application record | Role applied for, reference number, submission time, language, consent record (notice version and the statements you agreed to) | To manage your application and prove your consent |
| Data requests | Name, email, request type and details | To handle and record requests about your rights |
Data we do not ask for. We do not ask for specific (sensitive) personal data, such as health, biometric, genetic, criminal record or personal financial data, nor for your photo, date of birth, religion, marital status or ID card number (NIK). If your CV contains any of it, we do not use it in our assessment.
Technical data. This site sets no cookies and uses no analytics or trackers. Our hosting provider processes your IP address briefly to serve the site and protect it from abuse. We do not store your IP address with your application.
04Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Assessing your application for the role you applied for, and contacting you about it | Your explicit consent |
| Scheduling interviews and preparing a job offer at your request | Steps at your request before an employment contract |
| Keeping your application in our talent pool for other roles | Separate, optional explicit consent |
| Handling your rights requests and demonstrating our compliance | Legal obligation |
| Keeping the site secure and preventing abuse | Legitimate interest, balanced against your rights |
We do not use application data for marketing and we do not sell it.
05Who can see your data
- Our internal hiring team: the people who run recruitment, the managers and engineers involved in assessing you, and the leaders who make the decision.
- Our data processor: Cloudflare, Inc., which provides hosting, database and file storage for this site under a written data processing agreement. Cloudflare processes the data only on our instructions.
- Professional advisers or authorities, only where the law requires it or to defend our legal rights.
06Transfers outside Indonesia
Your application, CV and any supporting document are stored by Cloudflare in the Asia-Pacific region (application details) and North America (PDF files), outside Indonesia. Here is what that means:
- Purpose: storing your application securely so our team can review it.
- Safeguard: a binding data processing agreement with Cloudflare that requires security measures and limits use of the data to serving us.
- Risk: data stored outside Indonesia may be subject to the laws of the country where it is held, including access requests from local authorities.
- Mitigation: data is encrypted in transit and at rest, access is limited to our hiring team, and data is deleted automatically on schedule.
If we cannot ensure an equivalent or adequate level of protection, we will ask for your consent before any transfer.
07How long we keep it
| Data | Retention |
|---|---|
| Application without talent pool consent | 12 months from submission, then deleted automatically |
| Application with talent pool consent | 24 months from submission, then deleted automatically. If you withdraw talent pool consent, the 12-month period applies, or immediate deletion if it has passed |
| Candidates we hire | Moved to the employee file and covered by our employee privacy notice |
| Data request records | 3 years after the request is closed, to show how we handled it |
You can ask us to delete your data earlier at any time. We will tell you once it has been deleted.
08Automated decisions
Every application is reviewed by a person. We do not make hiring decisions based solely on automated processing, including profiling. If that ever changes, we will update this notice and tell you in advance, and you have the right to object.
09Security
We protect your data with encryption in transit (HTTPS) and at rest. CVs are never publicly accessible. Access to applications is limited to our hiring team through authenticated sign-in.
If a personal data protection failure occurs, we will notify you and the personal data protection authority in writing within 3×24 hours.
10Your rights
You have the right to:
- information about our identity, legal basis and purpose of processing;
- correct or update your data;
- access and obtain a copy of your data;
- end processing and have your data deleted or destroyed;
- withdraw your consent;
- object to decisions based solely on automated processing;
- delay or restrict processing;
- sue and receive compensation for violations in the processing of your data;
- obtain and/or use your data in a portable form.
Use the data request form or email privacy@spectrumgroup.id. We act on access, correction, consent withdrawal and restriction requests within 3×24 hours of verifying them, and on other requests without undue delay. If you withdraw consent for assessing your application, we stop processing it and cannot continue assessing your application.
If you are not satisfied with our response, you can complain to the personal data protection authority. Until that authority is fully established, supervision is carried out by the Ministry of Communication and Digital Affairs (Komdigi).
11Children
This application form is only for applicants aged 18 or over. We do not knowingly accept applications from children, because processing children’s data requires verified consent from a parent or guardian.
13Changes to this notice
The version of this notice is shown at the top of this page and recorded with every consent. If we change our processing purposes materially, we will ask for your fresh consent before using your data for the new purpose.