Last updated 24 October 2026 · TLP:CLEAR
1. Data Controller
The East Kutai Regency Government, through the Communication, Informatics, Statistics and Cryptography Office (Diskominfo), as the operator of KUTIM-CSIRT. Contact: csirt@kutaitimurkab.go.id. This policy refers to Law No. 27 of 2022 on Personal Data Protection.
2. Data We Collect
| Feature | Data | Purpose |
|---|---|---|
| Report an incident | Name, email, phone, institution (left blank if you choose to remain anonymous), report contents, evidence attachments. | Handling incidents and contacting reporters. |
| Track ticket & satisfaction survey | Ticket number, ticket access code, survey ratings and comments. | Showing ticket status and measuring service quality. |
| Service request | Name, position, regional government agency, email, phone, systems requested for testing, attachments. | Scheduling and delivering the service. |
| Advisory subscription | Email address, confirmation and unsubscribe times. | Sending a weekly summary; unsubscribe via the link in every email. |
| Self-assessment | Regional government agency name, contact name and email, questionnaire answers. | Providing assessment results and mapping guidance needs. |
| Phishing check | The URL being checked. This address is sent to the VirusTotal scanning service for analysis and is not linked to your identity. | Checking links. |
| Internal visit statistics | A daily random code (HMAC-SHA256) computed from the IP address, user agent, and date with a secret key, together with the page opened and the time. This code cannot be reversed to obtain the IP address and changes every day, so visits cannot be linked across days; this is why visitor numbers on this website are counted per day. IP addresses are not stored. | Counting visits without identifying people. |
| Server security logs | IP address, time, URL, user agent. | Detecting and investigating attacks against the website. |
Reporters are not asked to send their national ID number (NIK) or a photo of their ID card (KTP).
3. Third-Party Services
- Google Analytics 4: aggregate visit statistics (pages opened, device, approximate city-level location). Uses the
_gaand_ga_*cookies. You can decline it in section 7. - VirusTotal in the phishing check feature: the URL you check is sent to VirusTotal to be scanned, in accordance with the Google Privacy Policy, as Google operates VirusTotal.
- Google Maps on the Contact page: the office location map is loaded directly from Google's servers when that page is opened.
- Public forms are protected by browser-based proof-of-work anti-automation verification computed in your browser. This verification does not use any third-party service and does not send any data outside the website.
- The English version of this website is written as fixed text on the website itself. Page content is not sent to any translation service.
4. Cookies
| Cookie | Purpose | Duration |
|---|---|---|
kutim_clr | Marks that the anti-bot verification gate has been passed. | ±6 hours |
_ga, _ga_* | Google Analytics 4. Data is no longer sent if you decline (section 7). | According to Google's terms |
kutim_tanpa_ga | Remembering your choice to decline Google Analytics. | 1 year |
This website does not use session cookies for general visitors. The language is determined by the page address (the English version is under /en/), not by a cookie. The Live Cyber Attack Map page stores its display language choice in the browser's local storage (localStorage); this data is not sent to the server.
5. Who Can Access the Data
- KUTIM-CSIRT staff handling the ticket. The administration panel can only be accessed from the internal network of the East Kutai Regency Government, by staff accounts protected with multi-factor authentication (passkey / TOTP).
- The regional government agency whose system is affected, Gov-CSIRT Indonesia (BSSN), and law enforcement, only as far as needed to handle the incident, in accordance with RFC 2350 item 4.2.
- Evidence attachments are kept in private server storage and cannot be downloaded publicly. Data is not sold or used for advertising.
6. Retention and Your Rights
- Data is stored on East Kutai Regency Government servers for as long as needed for handling, reporting, and service audits.
- You have the right to request access to, correction of, or deletion of your personal data, and to withdraw your consent, by emailing csirt@kutaitimurkab.go.id (include your ticket number, if any). Requests are answered within 3 working days at the latest.
- If a personal data protection failure involving your data occurs, KUTIM-CSIRT will notify you in accordance with the Personal Data Protection Law (UU PDP).
7. Google Analytics Choice
Status: Google Analytics is active in this browser.
Your choice is stored as the kutim_tanpa_ga cookie in this browser. Internal visit statistics (hashed, without IP addresses) keep running because they do not use cookies.
8. Changes to This Policy
Changes are published on this page with a new effective date.