A. Introduction

PT Sigap Prima Astrea (hereinafter referred to as the “Company” or “SIGAP” or “We”) understands the importance of protecting the personal data of every individual who interacts with Us. Therefore, We are committed to protecting and maintaining the personal data of individuals who are identified or identifiable, either independently or in combination with other information, directly or indirectly, through electronic or non-electronic systems (“Personal Data”), in accordance with Law No. 27 of 2022 concerning Personal Data Protection and its applicable implementing regulations.

This Privacy Notice explains how We collect, use, disclose, store, share, disseminate, process, and delete (“Processing of Personal Data”) and/or cooperate or have legal relationships with third parties (“Third Parties”) to process Personal Data in connection with the products, services, activities, and other features that We provide and offer directly or through media such as websites, applications, and/or systems (if any) (“Products and/or Services”).

This Privacy Notice applies to any Processing of Personal Data carried out by Us when You:

1. access and/or use media such as Our websites, applications, and/or systems;
2. become a prospective user or user of Our Products and/or Services; and/or
3. become (i) Our partner, contractor, and/or supplier, and/or (ii) have a legal relationship with Us for a specific purpose, such as the implementation of corporate social responsibility programs.

(collectively hereinafter referred to as “You”), whether through this website or other websites, through applications operated or provided by Us, or through Processing of Personal Data carried out at Our offices, operational locations, assignment areas, activities, events, or other locations, or through other means in connection with the provision of Our Products and/or Services.

B. Your Representations and Warranties in Relation to the Provision of Personal Data

By using Our website or application, Our Products and/or Services, or providing Your Personal Data to Us or a Third Party appointed by Us, whether directly or through Your authorized representative, You represent and warrant that:

1. You have read and understood the entire contents of this Privacy Notice and understand the Processing of Personal Data carried out by Us; and
2. all Personal Data You provide is genuine, complete, and accurate.

Under certain circumstances, You may provide Personal Data of other individuals (such as Personal Data of Your lawful spouse, family members, or other parties, including persons You represent) to Us.

In such circumstances, You represent and warrant that You have obtained valid and explicit consent from such individual as the Personal Data subject, and You understand that such representation and warranty constitutes a valid legal basis for Us to carry out the Processing of Personal Data of the relevant individual or party.

You must provide evidence of such consent to Us whenever requested, as necessary. If the Personal Data You provide is incorrect, inaccurate, or unlawfully obtained, all resulting consequences, including legal consequences, shall be Your personal responsibility as the provider of such Personal Data.

C. Types of Personal Data We Collect and How We Obtain and Collect It

The Personal Data We collect consists of general and specific Personal Data, including but not limited to:

1. Identity Data: Your personal and contact information, including Your name, home address, identification card number, gender, telephone number, email address, place and date of birth;
2. Geographical Data: information regarding Your location, through activation of the geolocation function on Your mobile device;
3. Biometric Data: information that enables unique identification of an individual, such as facial images;
4. Communication Records: records of communications between You and Us, including when You contact Us, such as to submit questions, reports, or complaints, including but not limited to requests to update Personal Data. We collect and retain such communication records and other Personal Data that You provide in such communications;
5. Usage Data: information regarding Your use of Our Products and/or Services and technical information, such as information regarding the frequency of Your use of Our Products and/or Services;
6. Device Data: information regarding Your device and internet connection, such as Your device type, device IP address, operating system, browser type, website You use, other device characteristics, diagnostic data, cookies, pixel tags, and/or other technologies used to distinguish You from other users of Our Products and/or Services (which You may disable by adjusting the settings on Your device); and
7. Other Personal Data when You use Our Products and/or Services.

For certain purposes, You may be required to provide Your Personal Data in order to fulfill legal obligations or perform an agreement. Failure to provide Personal Data for such purposes may be considered a failure to fulfill legal obligations or an inability to enter into an agreement with Us.

We may collect information from various sources in accordance with applicable laws and regulations, including Personal Data collected by Third Parties and/or from public sources, whether newly collected or historical data, as part of Our efforts to always provide the best Products and/or Services to You.

We may obtain and collect Your Personal Data through various activities and means, including:

1. when You access websites, applications, or other platforms provided by Us in connection with Our Products and/or Services;
2. when You or Your authorized representative attend events organized by Us, whether online or physically, including participation in promotional programs;
3. when You conduct transactions with Us through the facilities provided;
4. when You visit Our branches or offices;
5. through Third Parties.

D. Purposes of Processing Your Personal Data

We process Your Personal Data for purposes including:

1. providing Our Products and/or Services to You, including responding to Your questions, comments, or complaints;
2. detecting, preventing, and handling issues relating to Our Products and/or Services;
3. managing Our day-to-day business activities and internal administrative processes, including but not limited to documentation, audits, and taxation;
4. performing obligations under agreements with You and/or Third Parties, including providing notifications regarding changes to Our Products and/or Services;
5. communicating with You through various media such as email, telephone, SMS, in-app messaging, push notifications, and social media;
6. verifying Your identity by telephone or other means;
7. offering, marketing, and promoting Our Products and/or Services as well as Products and/or Services of SIGAP Affiliates, including announcements, promotional materials, greetings, and invitations to participate in activities originating from SIGAP Affiliates or Third Parties;
8. processing Your participation in activities, contests, games, promotions, polls, and surveys;
9. understanding and analyzing usage and sales patterns of Our Products and/or Services based on the needs and preferences of Our customers for research, analysis, testing, development of Products and/or Services, and cooperation with Third Parties;
10. preventing, detecting, and investigating suspicious transactions, criminal acts, or activities prohibited under applicable laws and regulations;
11. fulfilling requests relating to law enforcement and protecting Our rights and/or Your rights;
12. developing, improving, and providing Products and/or Services that meet Your needs; and/or
13. fulfilling other needs as necessary.

We may process the Personal Data You provide for other Processing purposes that We will communicate to You in advance, as required or permitted by applicable laws and regulations.

E. Legal Basis for Processing Personal Data

We process the Personal Data You provide for the purposes described above (see Section D of this Privacy Notice) based on one of the following legal bases:

1. Valid and Explicit Consent: You may withdraw Your consent at any time; however, withdrawal of Your consent may affect Your experience in using Our Products and/or Services;
2. Performance of an Agreement with You: We may process the Personal Data You provide to perform agreed obligations, including providing Our Products and/or Services as requested by You;
3. Compliance with Legal Obligations: We may process the Personal Data You provide to carry out certain actions required of Us under applicable laws and regulations;
4. Protection of Vital Interests: We may process the Personal Data You provide to protect Your vital interests, such as interests relating to Your safety; and/or
5. Legitimate Interests: We may process the Personal Data You provide to pursue Our legitimate interests or those of a legitimate Third Party, provided that such interests do not violate Your interests and rights.

F. Processing of Your Personal Data by Third Parties

For the Processing of Personal Data in accordance with the purposes described in this Privacy Notice, We may provide partial or full access to and/or disclose Your Personal Data to (i) companies affiliated with PT Sigap Prima Astrea, directly or indirectly, as deemed necessary by the Company to conduct the Company's business activities and/or business plans in accordance with the purposes set out in Section D of this Privacy Notice (“SIGAP Affiliates”) and (ii) Third Parties.

Such Third Parties may include:

1. Research and/or marketing companies relating to the promotion of Our Products and/or Services.
2. Companies providing information technology-related features, including infrastructure, cloud computing, software, big data analytics, and machine learning, including data cleansing, data insight, and credit scoring services.
3. Companies providing payment transaction processing services, including payment gateways, fund transfers, electronic wallets, electronic money, and other payment system service providers relating to transactions conducted through the Products and/or Services.
4. Companies cooperating with Us to offer products and/or services relating to Our Products and/or Services.
5. Professional advisors and external auditors, including legal advisors, financial advisors, and other consultants.
6. Government authorities, whether within or outside the jurisdiction of the Republic of Indonesia, in accordance with applicable laws and regulations.
7. Other parties as part of a proposed or completed transaction, such as mergers, acquisitions, purchases and/or transfers of assets, financing, restructuring, and/or other transactions, including due diligence processes forming part of such transactions.
8. Other parties in accordance with applicable laws and regulations.

G. Retention of Personal Data

Unless prohibited by applicable laws and regulations and with reference to this Privacy Notice, We will retain and use the Personal Data You provide for as long as We need it to carry out the purposes of Processing of Personal Data that We have communicated, including other purposes such as fulfilling legal obligations, resolving disputes, and performing agreements.

We will continue to retain the Personal Data You provide for a certain period for the following purposes:

1. Maintaining business records for analysis, internal reporting, and/or audit purposes;
2. Complying with retention requirements under applicable laws and regulations;
3. Providing evidence for or enforcing claims and/or disputes that are ongoing or may arise;
4. Improving Your experience with Us and ensuring that You receive any benefits to which You are entitled; or
5. Handling complaints relating to Our Products and/or Services.

You understand and agree that We may delete the Personal Data You provide when such Personal Data is no longer required for the purposes described above.

H. Storage of Personal Data and Transfer of Personal Data Overseas

By using Our websites or applications, Products and/or Services, You understand and agree that Your information may be transferred, stored, used, processed, and/or transferred to data centers designated by Us, which may be located outside Indonesia and managed by Third Parties that may have different data protection rules.

Under certain circumstances, courts, law enforcement agencies, regulatory bodies, or security authorities in such other countries may have the right to access the Personal Data You provide.

Nevertheless, the Processing of Your Personal Data in connection with Your use of Our websites, applications, Products and/or Services will continue to be governed by this Privacy Notice in accordance with applicable laws and regulations.

I. Rights of Personal Data Subjects

As a Personal Data subject, You have rights regarding how Your Personal Data is processed, and We are committed to enabling You to exercise such rights, subject to applicable laws and regulations, including their limitations and exceptions, as follows:

1. The right to obtain information;
2. The right to obtain access to and/or copies of Personal Data;
3. The right to complete, update, and/or correct errors and/or inaccuracies in Personal Data;
4. The right to terminate the Processing of Personal Data;
5. The right to delete Personal Data;
6. The right to data portability;
7. The right to interoperability;
8. The right to withdraw consent to the Processing of Personal Data where We process Personal Data based on Your consent;
9. The right to delay or restrict the Processing of Personal Data proportionally; and
10. Other rights under applicable regulations.

If You wish to submit a request to exercise any of the rights described above, You may submit such request through the contact channels stated in Section M of this Privacy Notice.

We will verify and screen all requests to exercise Your rights as a Personal Data subject. For this purpose, We may ask You to provide supporting information or documents to substantiate Your request.

Once verified, We will inform You of the consequences of exercising the relevant right. After obtaining Your approval of such consequences, We will process Your request within the timeframe specified by applicable laws and regulations.

Nevertheless, please understand that under applicable laws and regulations and under certain circumstances, We may reject Your request to exercise the rights described above, including requests to delete or destroy some or all of the Personal Data under Our control.

We may charge administrative fees for each request to exercise Your rights as a Personal Data subject in accordance with applicable laws and regulations.

J. Cookies, Pixel Tags, and Other Technologies

We use cookies, pixel tags, and/or other technologies to distinguish You from other users of Our websites or applications by storing, generally, information that does not identify an individual, such as session information, including the number of times You visit Our websites or applications and Your location when accessing Our websites or applications.

By using Our websites or applications, You may use cookies, pixel tags, and/or other technologies.

You may also disable such features by discontinuing use of Our websites or applications or by adjusting the settings on Your device, including disabling, controlling, or deleting cookies, pixel tags, and/or other technologies if You wish to do so.

However, if You choose to do so, this may affect the quality of Your experience when using Our websites or applications.

K. Security of Personal Data

We highly value Your Personal Data and make reasonable efforts to protect all Personal Data. We continuously strive to improve the standards for protecting Your Personal Data.

However, You understand that transmission of information through online facilities is not completely secure, and We shall not be responsible for any losses arising from damage to or loss of Your Personal Data occurring outside Our control, including actions by unauthorized third parties.

Therefore, We strongly recommend that You always maintain and update the security of the access credentials You create and use in connection with Our websites, applications, and software, and that You do not disclose Your account password stored on Our websites or applications to any party.

In the event of an incident relating to the protection of Personal Data, You understand and agree that We may send notification of such incident to You electronically.

L. Changes and Updates to the Privacy Notice

We may amend, supplement, and/or replace this Privacy Notice from time to time, by providing notice to You, to ensure that this Privacy Notice remains consistent with the procedures and practices We apply in Processing Personal Data.

We will provide the latest version of this Privacy Notice through Our websites and/or applications. Therefore, please check periodically to determine whether any changes have been made to Our Privacy Notice.

If You use Our websites, applications, or Products and/or Services after any changes or updates to this Privacy Notice become effective, You will be deemed to understand and agree to be bound by such changes or updates.

N. Language

This Privacy Notice may be translated into languages other than Bahasa Indonesia. In the event of any inconsistency between the Bahasa Indonesia version of this Privacy Notice and any other language version, the Bahasa Indonesia version shall prevail.