CORE privacy notice

1. Who we are

CORE is NPC Office's internal system for hiring, staff records, payroll and clients, run by Persekutuan Perdata Nicholas Pertiwi & Co, PT Monroe Schagg Internasional and PT Nicholas Pertiwi Konsultan. NPC Office is the controller of the personal data processed in CORE. Questions and requests about your data: management@npcoffice.com.

2. Whose data

Candidates who apply for a role at NPC Office, hiring managers, staff, people who sign in to CORE, and the contacts of NPC Office's clients.

3. Candidates' data

• From the job board you applied on (JobStreet, Indeed, Jora): your name, email, CV, and which board. Every CV is read by a screening system that matches it against the role's keywords. Only the top candidates are kept; the other applications are not stored.
• What you enter on your link, after you agree to it: your current and expected salary, when you could start, phone, city you live in, current company and title, and LinkedIn.
• Your recorded video answers. An AI produces a transcript and an assessment (communication, fit and values) with the evidence for it.
• During selection: interview schedules, the hiring manager's notes and marks, decisions, and any offer.
• Your signature on the job offer: when you accept an offer, we keep the signature you draw, the full name you type, the time, and the signed copy of the offer letter.
• Your signature on the employment agreement: when you sign the agreement, we keep the signature you draw, the full name you type, the time, and the signed copy of the agreement, which carries your signature and the signature of the company's signatory.
• If you are hired: what the employment contract and payroll need, such as your NIK, NPWP, PTKP status, BPJS numbers, bank account, and the documents you upload.

4. Staff and users' data

Employment and payroll records (including NIK, PTKP, BPJS numbers, bank account, salary, address, phone, emergency contact, contract, certificates and documents), leave, payslips, and CORE sign-in accounts. Hiring managers: name, email, and the assessments they give.

Attendance: the time of each sign-in and sign-out, how far your phone was from the office at that moment, how accurate that reading claimed to be, the reason you give when you are away from the office, and a device identifier (a random value held in a cookie and recorded as a hash). Your coordinates are never kept: the location is read once when you tap, the distance is worked out on the server, and the coordinates are dropped before anything is recorded. CORE does not track where you are at any other time.

5. Clients' data

The names, positions, emails and mobile numbers of a client's contacts (the PIC and who receives invoices), the client company's details, and what an offer letter holds: the services, prices and terms, the discussion about the offer, the client's answer, and the invoices we send them. When a client answers on their offer page, we record the name and position they type, the time, and the IP address.

6. Why, and on what basis

• Candidates: to assess your application for the role you applied for. Before we contact you, the basis is the application you sent. The details and recordings on your link are processed with your consent.
• Staff: to perform the employment contract and meet legal obligations, including tax and BPJS.
• Clients: to prepare and send offers, perform the services agreed, and meet tax obligations.

7. People make the decisions

AI helps screen CVs and assess recordings. No candidate is rejected or chosen by AI alone: a person at NPC Office signs every stage of selection.

8. Who can see it

• NPC Office staff, by role: the owners see everything, an office manager sees their own office.
• A hiring manager sees the shortlisted candidates for their role.
• A client sees their own offer letters and invoices through the link sent to their PIC and billing contacts.
• Service providers working for NPC Office: Supabase (database and file storage, in Singapore), Vercel (the application), Resend (email, United States), OpenAI (AI for CV screening, transcripts of recordings, assessments, and making a template from an uploaded document, United States), and JobTarget (job ad posting, United States).
• Government authorities where the law requires it.

9. Data sent outside Indonesia

Data is stored in Singapore. Email is processed by Resend and AI by OpenAI, both in the United States, under those providers' data processing terms.

10. How long we keep it

• Video recordings: deleted 90 days after the recording deadline or after the shortlist is set, whichever is later.
• Candidates who are not hired: deleted 6 months after the role is filled or closed, or after you are told you are not going forward, and no later than 12 months after applications closed.
• The signature on a job offer and the signed copy of the offer letter: for as long as the offer stands. A candidate who holds an offer is not erased, and both are deleted if the employment agreement is withdrawn and the offer reopens.
• The signature on an employment agreement and the signed copy of the agreement: for as long as the agreement is kept. A withdrawn agreement keeps both, and both are deleted if the candidate is erased.
• Staff: for the length of employment and for the periods the law requires.
• Attendance records and the device identifier: for the length of employment and for the periods the law requires, the same as the rest of your employment record.
• An offer letter that lapses without being accepted: deleted 30 days after it lapses, with its versions, discussion and PDFs. An accepted letter, the invoices and the rest of a client's data are kept for the periods tax law requires. An invoice is never deleted: a request to erase data anonymises the contact, and the invoice is kept for tax.

11. Your rights

You can ask to see, correct or delete your data, withdraw your consent, and object to a decision made by a system alone. Send requests to management@npcoffice.com. We respond within 3 × 24 hours.

12. Changes

If this notice changes, the effective date on this page is updated.