A. Introduction

PT Jindi Material Indonesia (hereinafter referred to as the “Company”, “Jindi”, “we”, “us”, or “our”) recognizes the importance of protecting the personal data of each of our customers. Accordingly, we are committed to safeguarding and protecting the personal data of identifiable individuals, whether directly or indirectly identifiable, either independently or in combination with other information through electronic and non-electronic systems (“Personal Data”), in accordance with Law No. 27 of 2022 concerning Personal Data Protection and its implementing regulations, as amended from time to time.

This Privacy Notice explains how we collect, use, disclose, store, share, disseminate, process, and delete Personal Data (“Personal Data Processing”), and/or engage with third parties (“Third Parties”) to process Personal Data in connection with the products, services, activities, and other features that we provide or offer directly or through websites, applications, and/or systems (if any) (collectively, the “Products and/or Services”).

This Privacy Notice applies to any Personal Data Processing carried out by us when you:

• Access and/or use our websites, applications, and/or systems;
• Become a prospective user or user of our Products and/or Services; and/or
• Become (i) our partner, contractor, and/or supplier, and/or (ii) have a legal relationship with us for a specific purpose, including but not limited to the implementation of corporate social responsibility (CSR) programs,

(collectively referred to as “you” or “your”), whether through this website, any other website, applications operated or provided by us, or through Personal Data Processing conducted at our showrooms, offices, workshops, exhibitions, or by any other means in connection with the provision of our Products and/or Services.

B. Representations and Warranties Regarding the Provision of Personal Data

By using our website or application, our Products and/or Services, or by providing your Personal Data to us or to any Third Party appointed by us, either directly or through your authorized representative, you represent and warrant that:

• You have read and fully understood the contents of this Privacy Notice and understand the Personal Data Processing activities carried out by us; and
• All Personal Data provided by you is true, complete, accurate, and up to date.

In certain circumstances, you may provide us with the Personal Data of another individual (such as your lawful spouse, family members, or other parties, including those whom you represent). In such circumstances, you represent and warrant that you have lawfully obtained the explicit consent of such individual as the Personal Data subject. You further acknowledge that such representation and warranty constitute a lawful basis for us to process the Personal Data of the relevant individual. You shall provide evidence of such consent at any time upon our request, as necessary. If any Personal Data provided by you is false, inaccurate, incomplete, or unlawfully obtained, you shall bear sole responsibility for any consequences arising therefrom, including any legal consequences.

C. Types of Personal Data We Collect and How We Obtain It

The Personal Data we collect may include general and specific categories of Personal Data, including but not limited to:

Identity Data

Personal and contact information, including your name, residential address, identification card number, gender, telephone number, email address, place of birth, and date of birth.

Geolocation Data

Information relating to your location obtained through the geolocation functionality enabled on your mobile device.

Biometric Data

Information enabling the unique identification of an individual, such as facial images.

Communication Records

Records of communications between you and us, including inquiries, reports, complaints, and requests for updates to Personal Data. We may collect and retain such records together with any Personal Data contained therein.

Usage Data

Information regarding your use of our Products and/or Services, including technical information such as usage frequency.

Device Data

Information concerning your device and internet connection, including device type, IP address, operating system, browser type, device characteristics, diagnostic data, cookies, pixel tags, and other technologies used to distinguish you from other users of our Products and/or Services.

Other Personal Data

Any other Personal Data collected when you use our Products and/or Services.

For certain purposes, you may be required to provide Personal Data in order to comply with legal obligations or to perform a contract. Failure to provide such Personal Data may result in the inability to fulfill legal obligations or enter into or perform contractual arrangements with us.

We may collect information from various lawful sources, including Third Parties and publicly available sources, whether historical or newly acquired, in order to provide you with the best possible Products and/or Services.

We may obtain and collect your Personal Data through various activities and channels, including:

• When you access our website, application, or other platforms;
• When you or your authorized representative attend events organized by us, whether online or offline;
• When you conduct transactions with us;
• When you visit our branches or offices; and
• Through Third Parties.

D. Purposes of Personal Data Processing

We process your Personal Data for purposes including but not limited to:

• Providing our Products and/or Services to you, including responding to inquiries, comments, and complaints;
• Detecting, preventing, and resolving issues related to our Products and/or Services;
• Managing our daily business operations and internal administrative processes, including documentation, auditing, and taxation;
• Fulfilling contractual obligations with you and/or Third Parties;
• Communicating with you through various channels, including email, telephone, SMS, in-app messaging, push notifications, and social media;
• Verifying your identity;
• Offering, marketing, and promoting our Products and/or Services and those of Jindi Group Companies;
• Processing your participation in events, contests, promotions, surveys, and related activities;
• Understanding and analyzing usage patterns and sales trends for research, analytics, testing, product development, and collaboration with Third Parties;
• Preventing, detecting, and investigating suspicious transactions, criminal acts, or prohibited activities;
• Complying with law enforcement requests and protecting our rights and/or your rights;
• Developing, improving, and delivering Products and/or Services tailored to your needs; and/or
• Fulfilling any other legitimate business purposes as required.

We may process your Personal Data for additional purposes that will be notified to you beforehand, where required or permitted by applicable laws and regulations.

E. Legal Basis for Personal Data Processing

We process your Personal Data based on one or more of the following lawful grounds:

1. Your Explicit Consent – You may withdraw your consent at any time; however, such withdrawal may affect your ability to use our Products and/or Services.
2. Performance of a Contract – Processing necessary for the performance of contractual obligations, including the provision of Products and/or Services requested by you.
3. Compliance with Legal Obligations – Processing necessary to comply with applicable laws and regulations.
4. Protection of Vital Interests – Processing necessary to protect your vital interests, including matters relating to your safety.
5. Legitimate Interests – Processing necessary for our legitimate interests or those of a Third Party, provided such interests do not override your rights and freedoms.

F. Processing of Personal Data by Third Parties

For the purposes set out in this Privacy Notice, we may provide access to and/or disclose your Personal Data to:

• Companies directly or indirectly owned or controlled by Jindi (“Jindi Group Companies”); and
• Third Parties,

where such disclosure is necessary for the purposes described in Section D of this Privacy Notice.

Such Third Parties may include:

• Research and marketing service providers;
• Information technology service providers, including cloud computing, software, big data analytics, machine learning, data cleansing, data insights, and credit scoring providers;
• Payment processing service providers, including payment gateways, fund transfer operators, e-wallet providers, electronic money issuers, and other payment system operators;
• Business partners offering products and services related to our Products and/or Services;
• Professional advisers and external auditors, including legal counsel, financial advisers, and consultants;
• Government authorities, both within and outside the Republic of Indonesia, as required by applicable laws;
• Parties involved in corporate transactions, including mergers, acquisitions, asset purchases or transfers, financing arrangements, restructuring, and related due diligence activities; and
• Other parties as required or permitted by applicable laws and regulations.

G. Personal Data Retention

Unless otherwise prohibited by applicable law, we will retain and use your Personal Data for as long as necessary to fulfill the purposes outlined in this Privacy Notice, including compliance with legal obligations, dispute resolution, and enforcement of agreements.

We may retain Personal Data for the following purposes:

• Maintaining business records for analysis, internal reporting, and auditing;
• Complying with statutory retention requirements;
• Establishing, exercising, or defending legal claims;
• Enhancing your experience and ensuring you receive any benefits to which you are entitled; and
• Handling complaints relating to our Products and/or Services.

You acknowledge and agree that we may delete or anonymize your Personal Data when it is no longer necessary for the purposes described above.

H. Storage and Cross-Border Transfer of Personal Data

By using our website, application, Products, and/or Services, you acknowledge and agree that your information may be transferred to, stored, processed, and/or accessed in data centers designated by us, which may be located outside Indonesia and operated by Third Parties. Such jurisdictions may have different data protection laws from those applicable in Indonesia.

In certain circumstances, courts, law enforcement agencies, regulatory bodies, or security authorities in those jurisdictions may have lawful access to your Personal Data.

Notwithstanding the foregoing, the processing of your Personal Data shall remain subject to this Privacy Notice and applicable laws and regulations.

I. Rights of Personal Data Subjects

Subject to applicable laws and regulations, you are entitled to exercise the following rights:

• The right to be informed;
• The right to access and obtain copies of Personal Data;
• The right to complete, update, and correct Personal Data;
• The right to terminate processing;
• The right to erasure or deletion;
• The right to data portability;
• The right to interoperability;
• The right to withdraw consent;
• The right to delay or restrict processing proportionately; and
• Any other rights provided under applicable laws.

Requests to exercise your rights may be submitted through the contact details provided in Section M of this Privacy Notice.

We reserve the right to verify your identity and request supporting documentation before processing any request. We may also refuse requests where permitted under applicable laws and regulations, including requests to delete or destroy Personal Data.

We may charge reasonable administrative fees for processing requests where permitted by applicable law.

J. Cookies, Pixel Tags, and Other Technologies

We use cookies, pixel tags, and similar technologies to distinguish you from other users of our website or application and to enhance your user experience.

You may disable such technologies by adjusting your device or browser settings. However, disabling cookies and similar technologies may affect the functionality and quality of your experience when using our website or application.

K. Personal Data Security

We highly value your Personal Data and implement reasonable measures to safeguard it. We continuously strive to enhance our data protection standards.

However, you acknowledge that no method of transmission over the internet or electronic storage is completely secure. Accordingly, we shall not be liable for any loss, corruption, or unauthorized access to Personal Data beyond our reasonable control, including acts committed by unauthorized third parties.

We strongly recommend that you maintain appropriate security measures for your accounts, devices, and software, and that you do not disclose your account credentials to any third party.

In the event of a Personal Data protection incident, you acknowledge and agree that we may provide notification electronically where required by applicable law.

L. Amendments and Updates to this Privacy Notice

We may amend, supplement, or update this Privacy Notice from time to time by providing notice to you, to ensure that it remains aligned with our Personal Data Processing practices and applicable legal requirements.

The latest version of this Privacy Notice will be made available through our website and/or application. You are encouraged to review this Privacy Notice periodically for any updates.

Your continued use of our website, application, Products, and/or Services following the effective date of any amendment constitutes your acknowledgment and acceptance of such amendment.

M. Contact Us

If you require further information regarding this Privacy Notice or our Personal Data Processing activities, please contact us at:

Email: privasi@jindimaterialindonesia.com

N. Language

This Privacy Notice may be translated into languages other than Bahasa Indonesia. In the event of any inconsistency or discrepancy between the Indonesian version and any translated version, the Indonesian version shall prevail and govern.