Internal Policies

1. Purpose and commitment

NMA Foundation and Bullyid App are committed to ensuring that every child, young person and vulnerable adult who interacts with our work is treated with dignity and respect and is protected from abuse, exploitation, harassment, discrimination and avoidable harm.

Safeguarding is everyone’s responsibility. We take a zero-tolerance approach to abuse, exploitation and sexual misconduct while recognising that effective safeguarding requires prevention, safe reporting mechanisms, appropriate responses, survivor-centred support, accountability and continuous learning.

Our approach is guided by the best interests of the child, informed and meaningful participation, privacy, confidentiality, non-discrimination, trauma-informed practice, proportionality, accessibility and the principle of do no harm.

2. Definitions

• Child: Any person under 18 years of age.
• Young person: For programme purposes, generally a person aged 15-24 unless a specific programme uses a different age range. A young person under 18 is also a child for safeguarding purposes.
• Vulnerable adult: An adult who may face heightened risk of abuse, exploitation or difficulty protecting their own interests because of disability, dependency, displacement, economic hardship, trauma, social exclusion, coercion, unequal power or other circumstances.
• Safeguarding: The policies, practices and actions used to prevent and respond to abuse, exploitation, harassment and other avoidable harm arising through our people, programmes, partnerships, data, technology or operations.
• Sexual exploitation and abuse (SEA): Any actual or attempted abuse of a position of vulnerability, differential power or trust for sexual purposes, including profiting socially, financially or politically from another person’s sexual exploitation. Sexual activity with a child is prohibited regardless of any claimed mistake about age or local age of consent, subject only to any narrowly applicable legal exception that the organisation has expressly recognised in policy after legal review.
• Sexual harassment: Unwelcome conduct of a sexual nature that could reasonably be expected or perceived to cause offence, humiliation, intimidation or an unsafe, hostile or offensive environment. It may occur in person or through digital communications.
• Online or technology-facilitated harm: Abuse or exploitation enabled, amplified or distributed through digital technologies, including harassment, stalking, doxxing, grooming, sextortion, non-consensual intimate imagery, sexualised deepfakes, impersonation, threats, hate, coordinated abuse and synthetic or AI-generated sexual content.
• Non-consensual intimate imagery (NCII): Intimate, nude or sexual images or videos created, obtained, shared, threatened to be shared or manipulated without valid consent, including digitally altered or AI-generated material where a real person is depicted or represented.
• Safeguarding concern: Information, an allegation, a disclosure, an observation or a reasonable suspicion that a person may be at risk of or has experienced abuse, exploitation, harassment or other safeguarding harm.

3. Safeguarding principles

3.1 Prevention

We identify and reduce safeguarding risks before activities begin and integrate safeguarding into programme design, recruitment, research, communications, digital services, product design, procurement and partnerships.

3.2 Protection and immediate safety

Any concern about abuse, exploitation, harassment, sexual violence, grooming, coercion or other harm will be taken seriously. Immediate safety and well-being take priority.

3.3 Best interests of the child

In decisions affecting a child, the child’s best interests are a primary consideration. Safety, age, maturity, views, family context, disability, risk of retaliation and access to appropriate support should be considered.

3.4 Participation and agency

Children and young people should be heard on matters affecting them. Participation must remain voluntary, age-appropriate, accessible and safe. No participant is required to disclose personal experiences of violence or trauma in order to take part.

3.5 Non-discrimination and accessibility

Safeguarding protections apply without discrimination. Activities should make reasonable efforts to be accessible to persons with disabilities and people facing language, displacement or other barriers.

3.6 Survivor-centred and trauma-informed practice

People who disclose harm will be listened to without blame, pressure or unnecessary questioning. Their privacy, choices, dignity and safety guide our response insofar as this is compatible with applicable law and safeguarding obligations.

3.7 Data minimisation and privacy

We collect and share only the personal information reasonably necessary for the activity, support or safeguarding purpose. Access to sensitive safeguarding and survivor data is restricted on a need-to-know basis.

3.8 Accountability and transparency

Safeguarding concerns are documented and managed through clear responsibilities, escalation routes and governance oversight while respecting confidentiality.

4. Expected behaviour and safeguarding Code of Conduct

Everyone representing NMA Foundation or Bullyid App must:

• treat children, young people, vulnerable adults, survivors, colleagues and participants with dignity and respect;
• maintain appropriate professional boundaries and avoid relationships that exploit power imbalances;
• avoid language or behaviour that humiliates, sexualises, intimidates, threatens, coerces or discriminates;
• never engage in sexual activity with a child;
• never exploit a participant, beneficiary or person seeking assistance for sexual, financial, professional or personal benefit;
• never exchange money, opportunities, assistance, employment, goods or services for sexual activity;
• never request sexual contact, intimate imagery or sexualised material from a participant or person seeking support except where a narrowly defined professional process requires information and the request is lawful, necessary, proportionate and covered by an approved protocol;
• avoid being alone with a child where this can reasonably be prevented, and use approved communication channels for programme interactions;
• never knowingly request, create, possess, distribute or facilitate child sexual abuse material;
• never use survivor or safeguarding material for humour, gossip, entertainment, demonstration or unauthorised training;
• protect confidential and personal information; and
• report safeguarding concerns promptly through the procedures in this Policy.

A person’s silence, lack of resistance, dependency, previous participation or inability to freely choose does not constitute consent.

5. Working with children, young people and vulnerable adults

Activities involving participants under 18 or adults at heightened risk require an activity-specific safeguarding assessment. Depending on the activity, safeguards may include:

• age-appropriate information about the activity;
• informed permission from a parent or legal guardian and the child’s own informed assent where required or appropriate;
• appropriate supervision and safe venues or digital platforms;
• limits on one-to-one interactions;
• accessible information about complaints and support;
• reasonable accessibility accommodations;
• clear withdrawal options without penalty; and
• a referral or escalation plan for disclosures or immediate safety concerns.

Children and vulnerable adults will never be pressured to participate in research, campaigns, storytelling, interviews, photographs or programme activities. Refusing or withdrawing consent will not affect access to services to which they are otherwise entitled.

A parent or guardian’s consent does not remove the organisation’s obligation to consider the child’s own views, welfare and privacy.

6. Reporting a safeguarding concern

Anyone associated with NMA Foundation or Bullyid App who witnesses, receives a disclosure of, or reasonably suspects abuse, exploitation or other safeguarding harm must report the concern promptly. A person does not need proof before raising a concern. A reasonable safeguarding concern is sufficient.

Reports may include concerns about:

• a child or vulnerable person experiencing harm;
• misconduct by staff, volunteers, consultants, contractors, fellows, experts or partners;
• sexual harassment, exploitation or abuse;
• inappropriate relationships or communications;
• online exploitation, sextortion or image-based abuse;
• misuse of personal data, digital evidence or intimate imagery;
• retaliation against someone reporting a concern; or
• suspected criminal conduct.

Primary reporting route: report [AT] bullyid.org.

If the concern relates to the Safeguarding Focal Point, or the person does not feel safe using that route, the report must be made to the alternative authorised Board/governance contact published by the organisation. Before public release of this version, the current name and secure contact details of that alternative contact must be confirmed.

A safeguarding report may be made without first confronting the person alleged to have caused harm.

7. Responding to concerns and incident management

When a safeguarding concern is received, NMA Foundation or Bullyid App will:

1. prioritise immediate safety and urgent protection needs;
2. listen without blaming or unnecessarily interrogating the person reporting harm;
3. record only information necessary for safeguarding and response;
4. share information strictly on a need-to-know basis;
5. assess whether specialist legal, psychological, medical, child-protection, digital-security or emergency support is required;
6. assess applicable reporting, referral and preservation obligations rather than applying a blanket rule that every concern must automatically be sent to police or government;
7. escalate or refer matters where required by law or where a lawful and proportionate step is necessary to protect a person from serious harm;
8. manage allegations involving staff or representatives through appropriate disciplinary, PSEA, HR and governance procedures;
9. preserve relevant evidence without unnecessary duplication or exposure; and
10. take reasonable steps to protect reporters, survivors and witnesses from retaliation.

Safeguarding records will be stored securely and, where appropriate, separately from ordinary programme records. No internal investigation should compromise the safety of the affected person, contaminate digital evidence or interfere with a lawful external investigation.

8. Relevant legal and good-practice framework

This Policy should be read and implemented consistently with applicable Indonesian law and any additional safeguarding requirements of funders, regulators, professional bodies or partners. Relevant frameworks include, as applicable:

• Indonesian child-protection legislation, including Law No. 35 of 2014 amending Law No. 23 of 2002 on Child Protection and subsequent applicable amendments;
• Law No. 12 of 2022 on Sexual Violence Crimes;
• Law No. 27 of 2022 on Personal Data Protection;
• Law No. 1 of 2024, the second amendment to the Electronic Information and Transactions Law;
• Government Regulation No. 17 of 2025 concerning governance of electronic systems in child protection;
• Minister of Communication and Digital Regulation No. 9 of 2026 implementing the child-protection electronic-system framework; and
• other applicable implementing regulations, professional rules, donor safeguards and legally binding obligations.

Where there is uncertainty about a legal reporting obligation, handling of child sexual material, disclosure to authorities, age-assurance requirement or an individual’s immediate safety, the organisation should obtain qualified legal or safeguarding advice promptly.