Data Protection & Compliance | Mine Data Security

Scope of this page

This page applies to PT Acala Genesa Sumberdaya, trading as ACALA (“ACALA”), which operates this website as MinexCoal, and to every engagement delivered under that name — GEOVIA Minex licence supply, implementation, data migration, training and retained support.

Our Privacy Policy explains what we do with personal data collected through this website. This page is broader: it covers how we are organised to protect all data entrusted to us, including the technical and commercial data that makes up a mining project.

If you are completing a supplier due-diligence questionnaire, this page and a signed Data Processing Agreement normally cover it. Where your questionnaire asks something not answered here, write to privacy@minexcoal.com and we will answer directly rather than sending you back to a policy.

Controller & processor roles

Situation	Our role	What that means
Enquiries and our own client records	Controller	We decide why and how the data is used, within our Privacy Policy
Project data you give us to work on	Processor	We act only on your documented instructions and do not use it for our own purposes
Training delegate records you supply	Processor	Held for the course and certification, then returned or deleted as you direct

Where we act as processor we will sign a Data Processing Agreement on your paper or ours, covering instructions, confidentiality, security, sub-processing, assistance with data subject requests, breach notification, and return or deletion at the end. Ask and we will send our standard form.

Handling mine data

Borehole databases, quality and washability data, seam models, reserve statements and mine plans are treated as strictly confidential by default — no separate instruction from you is needed to trigger that.

Purpose limitation — used only to perform the engagement you have commissioned.
No secondary use — never used to benchmark, train models, populate demonstrations or build our library materials.
No cross-client exposure — each client’s data is kept in its own segregated workspace with separate access control.
Anonymised training twins — where you want us to train on realistic data but cannot release the real thing, we build a dataset that preserves seam geometry and quality behaviour without identifying the deposit. That twin belongs to you too.
Named-person access — only consultants assigned to your engagement can open your data, and we can tell you exactly who they are.

Technical measures

Encryption at rest on all workstations and servers holding client data (full-disk encryption as a minimum).
Encryption in transit — TLS for all transfers; we do not accept project data over unencrypted email.
Multi-factor authentication on every account that can reach client data, where the platform supports it.
Least privilege — access granted per engagement and revoked when it closes, not left standing.
Patching — operating systems and applications kept current; monthly review cycle.
Endpoint protection and device management on all machines used for client work.
Secure transfer — we provide a protected upload route for large files rather than asking you to email them.
Backups encrypted, with restore tested quarterly.

Organisational measures

Written confidentiality undertakings from every employee and contractor, surviving the end of their engagement with us.
Background checks appropriate to the role, where lawful in the jurisdiction.
Security awareness training at onboarding and annually thereafter.
Clear desk and clear screen when working at client sites.
No personal devices used for client project work.
Offboarding checklist revoking all access on the day someone leaves.
Named accountable owner for data protection: the Director.

Sub-processors

We keep the list deliberately short: a hosting provider for this site and its server logs, a business email provider, a file transfer service for project data, and a video conferencing service for remote sessions. The named list, with server locations, is available on request from privacy@minexcoal.com — we answer due-diligence questionnaires rather than making you guess.

Each is bound by a data processing agreement and may not use your data for its own purposes. We give 30 days’ notice before adding or replacing a sub-processor that would handle your project data, and you may object.

We do not share your project data with software vendors, including Dassault Systèmes, unless you instruct us to — for example when a support case requires a reproduction dataset. In that situation we tell you first and let you decide what is sent.

International transfers

Where a provider processes data outside your country, we rely on an adequacy decision, standard contractual clauses, or an equivalent lawful mechanism. Under Indonesia’s Law No. 27 of 2022 we transfer personal data abroad only where the receiving jurisdiction offers an adequate level of protection, there are adequate binding safeguards in place, or the data subject has consented.

Tell us if your contract or internal policy requires project data to remain in a specific country and we will confirm before the engagement starts whether we can meet that.

Return & destruction

At the end of an engagement, on your instruction, we will either return your project data in an agreed format or destroy it — and confirm in writing which we did and when.

Absent an instruction, we hold project data for 90 days after closure so that follow-up questions can be answered, then delete it. We retain the minimum necessary record of the engagement itself — scope, correspondence, invoices — for the periods set out in our Privacy Policy.

Incident response

Stage	Target
Detection to internal escalation	Immediately on discovery
Containment begins	Within 4 hours
Affected clients notified	Without undue delay, and no later than 24 hours after confirmation
Supervisory authority notified, where required	Within 72 hours of becoming aware
Written incident report	Within 10 business days of closure

Notification tells you what happened, what data was involved, what we have done, and what we recommend you do. We would rather tell you about an incident that turns out to be minor than have you learn about a serious one from somebody else.

Business continuity

Client deliverables are held in redundant storage with daily backup. Where an engagement is critical to your reporting calendar, we name a second consultant familiar with the project so that illness or resignation does not stall your month end — the same single-point-of-failure problem we are usually hired to fix.

Software licence compliance

We will not work on unlicensed software. Not as a favour to the vendor — because an audit finding lands on you, and because a consultant who is relaxed about your licence position is relaxed about your data too.

We may ask for evidence of valid licensing before starting work, and will decline to proceed without it.
We do not install, distribute or assist with cracked, keygen-patched or otherwise circumvented builds.
Where a licence audit we run for you finds under-licensing, we tell you privately and help you remediate. We do not report it to the vendor; that is your disclosure to make.
Where it finds over-licensing — which is more common — we tell you that too, even though fewer seats means a smaller renewal.

Regulatory frameworks

We operate with reference to:

Indonesia Law No. 27 of 2022 on Personal Data Protection, for data subjects in Indonesia.
EU and UK GDPR, where a client or data subject falls within their scope.
Resource reporting codes — JORC, SAMREC, NI 43-101 and, in Indonesia, the KCMI Code and SNI 5015:2019, insofar as confidentiality of pre-disclosure resource and reserve information is concerned. We treat unpublished estimates as price-sensitive until you tell us they are public.
Export control and sanctions screening before engaging a new client or supplier.

We do not currently hold ISO 27001 or SOC 2 certification. We say so plainly rather than implying an accreditation we do not have; the controls above are what we actually operate.

Anti-bribery & ethics

We do not offer, give, solicit or accept bribes, facilitation payments or improper inducements, in any jurisdiction, for any reason. This applies to our people, our contractors and anyone acting on our behalf.

Gifts and hospitality are limited to what is modest, infrequent, transparent and lawful. Any concern about our conduct can be raised confidentially at legal@minexcoal.com. We do not retaliate against anyone who raises one in good faith.

Your audit rights

Where we process data on your behalf, you may audit our compliance once in any twelve-month period on 30 days’ written notice, or more often where a regulator requires it or following a confirmed incident.

In most cases a completed questionnaire and a documentation review satisfy this without an on-site visit. Where a visit is needed, it happens during business hours, subject to confidentiality obligations to our other clients, and at your cost unless the audit finds a material breach on our side.

Governing language

This page is published in Indonesian and English. Both versions are intended to carry the same meaning.

Where the two versions differ, the Indonesian version governs and is the binding text. The Indonesian version is at id/compliance.html; this English version is provided as a translation.

This follows Law No. 24 of 2009 on the Flag, Language, Emblem and Anthem, which requires agreements involving an Indonesian party to be made in Indonesian.

Contact

Data protection, DPA requests and due-diligence questionnaires: privacy@minexcoal.com.

Security incidents, including anything you believe involves our systems: security@minexcoal.com — monitored during business hours, with 24/7 escalation for active incidents.