Global Data Protection Policy

Scope and Applicability

This Policy applies to all employees, contractors, partners, vendors, and third parties who process personal data on behalf of the Company. It governs all personal data collected through our websites, digital applications, global business activities, commercial transactions, and recruitment processes across all jurisdictions where we operate.

Core Data Protection Principles

We adhere strictly to internationally recognized data protection principles. Personal data shall be:

1. (a)Processed Lawfully, Fairly, and Transparently: Obtained with proper legal bases and clear notifications.
2. (b)Purpose-Limited: Collected strictly for specified, explicit, and legitimate business purposes.
3. (c)Data Minimized: Adequate, relevant, and limited to what is necessary for the stated purpose.
4. (d)Accurate and Up-to-Date: Maintained with reasonable steps to ensure inaccurate data is corrected or deleted without delay.
5. (e)Storage-Limited: Kept in a form that permits identification for no longer than is necessary.
6. (f)Secured with Integrity: Protected against unauthorized or unlawful processing, accidental loss, destruction, or damage using appropriate technical and organizational measures.

Legal Bases for Processing

We process personal data only when one or more of the following legal grounds apply:

1. (a)Consent: When the data subject has given clear, affirmative consent.
2. (b)Contractual Necessity: To perform a contract with the individual or take pre-contractual steps.
3. (c)Legal Obligation: To comply with regulatory or legal requirements.
4. (d)Legitimate Interests: To pursue legitimate commercial or operational interests, provided they do not override individual rights.

International Data Transfers

As a global enterprise operating across multiple jurisdictions, personal data may be transferred to and processed in countries outside the data subject's country of residence. Where cross-border data transfers occur, we implement appropriate safeguards to ensure an adequate level of data protection, including:

1. (a)Standard Contractual Clauses (SCCs) approved by relevant authorities.
2. (b)Binding Corporate Rules (BCRs) for intra-group transfers.
3. (c)Compliance with local cross-border transfer requirements (such as GDPR, CCPA, and Indonesia Personal Data Protection Law).

Data Security Measures

We implement robust technical, physical, and administrative security standards to safeguard personal data, including:

1. (a)Encryption: End-to-end encryption for data in transit and at rest.
2. (b)Access Control: Strict role-based access restrictions and multi-factor authentication.
3. (c)Infrastructure Security: Continuous monitoring, vulnerability assessments, and secure cloud environments.
4. (d)Employee Training: Regular data privacy and cybersecurity awareness programs for all personnel.

Data Subject Rights

Individuals whose personal data we hold possess specific privacy rights under applicable global laws, including the right to:

1. (a)Access: Request a copy of the personal data held about them.
2. (b)Rectification: Request correction of inaccurate or incomplete data.
3. (c)Erasure ("Right to be Forgotten"): Request deletion of data where legal grounds permit.
4. (d)Restriction & Objection: Restrict or object to the processing of their data.
5. (e)Data Portability: Request transfer of data to another controller in a structured format.
6. (f)Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing.

Data Breach Notification

In the event of a security incident leading to a personal data breach, we maintain a comprehensive incident response plan. We will notify relevant regulatory authorities and affected individuals within the timelines prescribed by applicable law (e.g., within 72 hours under GDPR/UU PDP guidelines) when required.

Contact Information & Data Protection Office

If you have questions, concerns, or wish to exercise your data privacy rights, please contact our Data Protection Office: