Privacy Statement

Data on this portal is controlled by PT Pertamina Bina Medika IHC through the ICT Cybersecurity function of the ICT Directorate.

From your IHC account: name, email address, username, job title, employee number, phone number, unit or entity, and profile photo. This is copied from the Entra ID directory rather than typed again into the portal.

From incident reports: your account of what happened and any attachments you include, plus the reporter's identity if you choose to report while signed in.

From change requests: the content of the submission, approval documents, and the trail of its review and approval.

From account registration: identity number, place and date of birth, address, nationality, company name, and the stated purpose.

From event attendance and online training: attendance, results, and certificates.

From using the portal: IP address, access time, and a record of data changes in the audit trail.

Handling incident reports and submissions through to closure, including contacting you if more detail is needed.

Deciding who may open what inside the portal.

Producing security reports and statistics for management — in aggregate, not per person.

Keeping a trail of changes so every action on the data can be traced back. That audit trail is what makes misuse provable, and for that reason it cannot be deleted on request.

The portal runs inside the IHC network. Data here is never sold and is never shared for marketing.

The portal connects to Microsoft Entra ID for authentication and employee data synchronisation, and may connect to the security tooling ICT Cybersecurity uses for incident handling.

Data may be passed to the authorities — BSSN or law enforcement among them — where regulation requires it or where it is needed to handle an incident.

Incident records, submissions, and audit trails are kept for as long as they are needed for operations, evidence, and compliance.

Account data follows the life of your account in the IHC directory.

You may ask what this portal holds about you, and ask for corrections where something is wrong.

Profile data comes from the IHC directory. Corrections are made in the directory and flow into the portal — not the other way round.

Requests about personal data go to the email address shown below.

Incident reports can be sent without signing in. If you report without an account and leave out your details, we cannot come back to you for more information, and handling may be slower as a result.

This portal uses only the cookies it needs to work: a session marker, a form security marker, and your language choice. There are no advertising cookies and no third-party tracking.

Questions about this statement can be sent to the ICT Cybersecurity team at the email address shown at the foot of every page.