1. DEFINITION

1. “Company” is the Indonesia Investment Authority or its successors, where applicable.
2. “PDP Regulations” are laws and regulations regarding personal data protection applicable in the Republic of Indonesia, including but not limited to Law No. 27 of 2022 on Personal Data Protection, and other relevant laws and regulations governing personal data protection.
3. “People with Disabilities” is every person who experiences physical, intellectual, mental, and/or sensory limitations for a long duration, and who, in interacting with the environment may experience obstacles and difficulties to participate fully and effectively with other citizens based on equal rights.
4. “personal data” is data about an identified or identifiable natural person individually or in combination with other information either directly or indirectly through electronic or non-electronic systems. Data where the identity has been removed (anonymised data) is not included in the classification of personal data.
5. “processing” or “process” is an event where the Company obtains, collects, uses, displays, announces, discloses, processes, opens access to, stores, transfers, provides, shares, manages, organises, destroys, and/or protects your personal data.
6. “you” are data subjects who are:
   1. employees, officers or owners of vendors, investment counterparties, and business partners of the Company; and
   2. Individuals interacting with us, including through electronic mail or phone conversations, accessing, and using our website.

‍

2. PERSONAL DATA WE COLLECT FROM YOU

1. Personal data that we collect directly from you, including:‍
   • Identification Information
     This includes details such as your full name, date of birth, age, gender, job title, nationality, tax identification number, identity card and/or passport, username, or other identifiers.‍
   • Contact Details
     ‍This includes your postal address, telephone number, and email address.‍
   • Financial Information
     Such data includes your bank account number or other payment details necessary for processing transactions or managing financial and investment-related matters.‍
   • Company and Professional Information
     This includes information about the company you are working for (e.g., company name, your position, and relevant corporate data), along with your professional qualifications and experience, particularly when representing an investment partner or co-investor.‍
   • Records of Communications
     These are records of any communications between you and us, including emails, phone calls, meetings, or other forms of correspondence. These records may include details related to requests, enquiries, reports, complaints, or business coordination.‍
   • Device and Automatic Information
     This includes technical data such as your login information, browser type and version, IP address, operating system, platform, device ID, and the duration and patterns of your interaction with our website. It also covers data from newsletter subscriptions and other technologies used to access the site.‍
   • Usage Information
     This refers to how you interact with and use our website, including your browsing patterns and activities.‍
   • Location Information
     This includes data about your location when using our website, often obtained from your mobile device, such as a unique identification code.‍
   • Investment-Related Data
     In certain cases, we may collect details about your role in investment activities, such as participation in investment committees, advisory boards, or co-investment decisions.‍
   • Marketing and Communication Preferences
     This includes your preferences for receiving marketing communications from us or third parties and your general communication preferences.
     ‍
2. Some of your personal data that we collect include specific personal data. Specific personal data include data related to biometric data, and/or financial data.
3. We may combine and/or merge personal data obtained from our website with other data/information obtained by us from other parties. This process allows us to optimise communication, and support business operations with our vendors, investment counterparties, business partners, and stakeholders.
4. We also collect, use, and share aggregated data, such as statistical or demographic data, which is not considered personal data as it does not directly or indirectly reveal your identity. For example, we may aggregate website visitors' usage data to calculate the percentage of users accessing a specific feature of our website. This helps us analyse general trends in how users interact with our website and enables us to improve both the website and our business operations.
5. If you do not provide the personal data we require, we may not be able to process you as a vendor, investment counterparties, and business partner of the Company, provide the information you want, or fulfil our obligations to you. 
6. We do not knowingly collect and process personal data of People with Disabilities. If you require this PDP Notice in an accessible format (e.g., in braille or audio form), please contact us through our contact details as set out in Section 17 of this PDP Notice.
7. Other than as set out above and if not requested, please do not provide, or disclose any of your personal data to us.

‍

3. YOUR PERSONAL DATA THAT WE COLLECT FROM OTHER SOURCES

1. We may also collect your personal data from other sources, including:‍
   • Parties within Your Company
     This includes individuals who interact directly with us, such as representatives of your company.‍
   • Referrals and Business Contacts
     We may receive your data from parties who recommended you to us, such as business contacts who suggested you as a potential investment partner, vendor, or business partner.‍
   • Publicly accessible sources
     This includes data collected from publicly available platforms, such as your company’s website or social media networking platforms.‍
   • Event Organisers and Co-Hosts
     If you have participated in or registered for events we have hosted or co-hosted with third parties, or events organised by third parties where we were present, we may collect your data from these organisers.‍
   • Website Usage Information
     Data may also be collected through analytics programs monitoring your activity on our website, including your participation in our events.‍
   • Communications via Social Media
     Any personal data shared with us through social media platforms may be collected.‍
   • Technical Information
     This includes data such as your location when you activate the geolocation function on our website, and may be collected through cookies, server logs, and other similar technologies.
     ‍
2. If you provide personal data about another person (such as data of certain executives (e.g. managers, directors and commissioners) of your company, or employees of suppliers, service providers, and other business partners of the Company) to us, or you ask us to share their personal data with a third party, you hereby confirm that they have been informed and understand the information in this PDP Notice about how we will use their personal data.

‍

4. PURPOSES AND LAWFUL BASES WE USE FOR PROCESSING 

1. We process your personal data with the following lawful bases:
   • To fulfil contractual obligations between us and you or to fulfil necessary matters to conclude an agreement with you;
   • To fulfil the Company’s legal obligations in accordance with the provisions of laws and regulations;
   • To fulfil legitimate interest of the Company; 
   • To fulfil the protection of your vital interests; and/or
   • When you have given explicit consent.

We process your personal data for the following purposes: 

2. If we ask for your consent to process your personal data, you may at any time object or withdraw such consent. In relation to your right to object or withdraw consent, please refer to Section 9 of this PDP Notice.
3. We may process your personal data for purposes other than those we have listed above. We will inform you of these purposes beforehand, such as through an update of this PDP Notice.

‍

5. SHARING AND/OR DISCLOSURE OF YOUR PERSONAL DATA AND THE RECEIVING PARTIES

1. We will maintain the confidentiality of your personal data, but we may share your personal data with third parties (who must also keep your personal data secure and confidential) in certain circumstances, as follows:

6. TRANSFER OF YOUR PERSONAL DATA OUTSIDE OF INDONESIA 

1. We may be required by prevailing laws, regulations, and internal policies to share your personal data to certain trusted third parties to fulfil specific purposes. This may include disclosures to government authorities, law enforcement agencies, or tax authorities in compliance with applicable regulations. In accordance with the PDP Regulations, data sharing may also occur for purposes related to national security, public interest, or law enforcement. Additionally, data may be shared with third parties as part of our operational needs, such as for payment processing, logistics, or other contractual obligations. 
2. Additionally, we may need to transfer your personal data outside of Indonesia for business purposes, such as to our affiliated companies, vendors, investment counterparties, and other business partners located outside of Indonesia, in order for those other providers to provide their services to us.
3. In sending your personal data overseas, please understand that the destination country may have different data protection regulations than Indonesia. In certain circumstances, the court, law enforcement officials, or regulatory bodies in such countries may have the right to access your personal data.
4. We will comply with the PDP Regulations and exercise all reasonable and sufficient measures, such as entering into a binding data transfer agreement with data recipients, or obtaining your explicit consent, to ensure that our overseas affiliates, investment counterparties, business partners, joint ventures, and all such third parties provide a level of protection comparable to our commitments under this PDP Notice.
5. When transferring personal data to organisations in other countries, we will ensure that they agree to apply an equivalent level of personal data protection that we apply. Where this is not possible (for example, if the laws and regulations stipulate that we must transfer personal data), We will ensure that the personal data is transferred in accordance with the applicable laws and regulations. Where a data protection authority does not consider certain countries to have an adequate level of personal data protection, we will establish appropriate safeguards (such as contractual safeguards), in accordance with the PDP Regulations, to ensure that your personal data is adequately protected.

‍

7. AUTOMATED PROCESSING OF YOUR PERSONAL DATA

1. We may use your personal data, including specific or sensitive personal data, for profiling purposes. Profiling involves processing your data using software that analyses factors to predict risks or outcomes. This process may be automated and used for decision-making related to the following matters:
   • Inspection of anti-money laundering and countering the financing of terrorism;
   • Identity and address check; 
   • Prevention of criminal offences or fraud; and
   • Conducting profiling and data analytics for:
     • system and process improvements;
     • risk and fraud management;
     • regulatory and compliance risk management;
     • generating investment insights; and
     • enhancing human resources processes.

   In addition, profiling or other automated methods may be used to make decisions regarding personalised communication through various media channels (e.g., email, chatbot) and to send you location-based services or personalised content such as e-newsletters, greetings, and other relevant information.

2. The above activity is known as ‘automated decision-making’, and we do this as part of the purposes for which we use your personal data and the lawful bases we have set out in Section 4 of this PDP Notice.
3. You may contact us to object automated decision-making on you, as we have set out in Section 9 of this PDP Notice.

‍

8. PERSONAL DATA STORAGE

1. We will retain your personal data for as long as you maintain an active relationship with us, whether as a website visitor, business partner, or project participant. Once you no longer actively engage with us or our projects, or business activities, we will retain your personal data for a period appropriate to the type of data and the purpose for which it was collected, or for as long as required or authorised by applicable laws and regulations.
   This includes data collected for purposes such as project coordination, business communications, or regulatory compliance. Additionally, personal data stored via our website may be retained for an extended period to meet ongoing business requirements, such as maintaining records, improving services, or fulfilling legal obligations. We will only retain your data for as long as necessary to fulfil these purposes. 
2. We retain your personal data in accordance with our internal record retention policy. When determining the relevant retention periods, the following factors may form part of the overall consideration:
   1. our contractual obligations and rights in relation to the personal data involved;
   2. legal obligation(s) under applicable law to retain data for a certain period;
   3. our legitimate interest where we have carried out a balancing test;
   4. guidelines issued by relevant data protection authorities; and
   5. the necessity to:
      1. maintain records of our business activities for analytical or audit purposes;
      2. comply with laws and regulations, including those related to data and document retention (e.g., prevention, detection, and investigation of money laundering and financing of terrorism);
      3. defend or pursue (potential) legal actions, disputes/litigation, including anticipating such actions related to our relationship with you or your company; 
      4. assist in monitoring and preventing fraud offences, offences, or compliance breaches related to the Company's investments and projects;
      5. ensure compliance with investment regulations and frameworks, including transparency obligations tied to foreign investment partnerships;
      6. support due diligence and risk management processes with co-investors, partners, or government agencies; and
      7. assist in fulfilling reporting requirements to relevant international stakeholders, including foreign investment partners and regulatory bodies.

3. The retention period for personal data is oftentimes linked to the time period to file a lawsuit. We will retain personal data beyond that period if:
   1. we must do so under an applicable legal obligation; or 
   2. there is a risk of a lawsuit requiring us to retain your personal data. 

   If we need to retain your personal data for a longer period of time, we will continue to protect such personal data.

4. We will delete, destroy, or remove the means by which the personal data can be associated with you as an individual if the personal data is no longer needed for the purposes we have outlined, if the retention period has elapsed. If you withdraw your consent or request deletion of your data, we will comply with your request in line with the PDP Regulations, except where we are required or authorised to retain the data for legal reasons or business purposes.
5. Please note that there is still the possibility that some of your personal data might be retained by the other party, including by the government institutions in some manner. In the event we share your personal data to the authorised government institutions and/or other institutions that may be appointed by the government authorities or have a cooperation with us, you agree and acknowledge that the retention of your personal data by the relevant institutions will follow their respective policy on data retention.

‍

9. YOUR RIGHTS AS A DATA SUBJECT

1. You have certain rights as a data subject, as set out below: