Personal Data Protection Notice

Each of the capitalized terms shall have the following meanings:

1. "Privy Account" is every account issued by Privy, with the name PrivyID, where each account owner will be given a userID, choose a password, and can store his/her Personal Data.
2. "Privy Application" is a mobile application (mobile apps) operated by PT Privy Identity Digital.
3. "Basic Data" is Personal Data required by Privy to be able to issue a PrivyID and create a Privy Account.
4. "Personal Data" is any data that identifies or can be used to identify an individual, alone or in combination with other data/information, directly or indirectly, in electronic and/or non-electronic systems, which is divided into Specific/Sensitive Personal Data and General Personal Data.
5. "Specific/Sensitive Personal Data" is Personal Data that is sensitive and requires a specific and higher level of protection compared to protection for other Personal Data in accordance with applicable laws and regulations. For example, Specific/Sensitive Personal Data includes and is not limited to personal financial data/information, children's Personal Data, biometric data, criminal records, health information, genetic data and other data whose processing may have major impacts according to applicable laws and regulations.
6. "General Data" is Personal Data that is general in nature and does not fall into the category of Specific/Sensitive Personal Data, including but not limited to; full name, gender, address, place and date of birth, telephone number, email address, occupation, identification number issued by an authorized institution (such as, among others; Resident Identity Card (KTP), Driving License (SIM) or passport), nationality, as well as the profile and unique identification number that Privy issues to Users of the Privy Services.
7. "Marketing Communications" means advertisement, communication, and marketing related to Services.
8. "Privy Services" means services for issuing Electronic Certificates, creating Privy Electronic Signatures (PrivySign), Privy Document Management System, PrivyPass, Electronic Seals, PrivyChat, PrivyHub, PrivyPal, and/or other Privy Services stated by Privy from time to time, either through Privy Site or Application.
9. "Processing" or "To Process" or "Being Processed" means collecting, processing, processing, disclosing, storing, securing, analyzing, deleting and/or destroying User Personal Data for the purposes of the Privy Services.
10. "User" means every individual including but not limited to Indonesian Citizens (WNI) and/or Foreign Citizens (WNA) or legal entities/business entities who access the Privy Platform and/or use the Privy Services.
11. "Third Party" is an individual and/or legal entity/business entity that collaborates with Privy and can be proven by a document that binds the rights and obligations of each party.
12. "Privy" means PT Privy Identitas Digital and/or its subsidiaries, affiliated companies that have a direct or indirect relationship with PT Privy Identitas Digital.
13. "PrivyID" means an alphanumeric code issued by Privy, which can be associated with a unique name (username), to identify Users when using Privy Services.
14. "Site" means any URL that uses the domain with the address "https://privy.id/" or other sites stated by Privy from time to time.
15. "Electronic Signature" is a signature consisting of Electronic Information that is attached, associated or related to other Electronic Information that is used as a verification and authentication tool created with the Privy Services.
16. "Electronic Certificate" is a certificate issued and/or provided by Privy which is electronic and contains an Electronic Signature and identity indicating the legal subject or parties in the Electronic Transaction.
17. "Electronic Information" is one or a collection of electronic data, including but not limited to writing, sound, images, maps, plans, photos, Electronic Data Interchange (EDI), electronic mail (e-mail), telegram, telex, telecopy or the like, processed letters, signs, numbers, access codes, symbols, or perforations that have meaning or can be understood by a person capable of understanding them.

To create a Privy Account and utilize Privy Services, User are required to provide their Personal Data to Privy accurately, clearly, precisely, and comprehensively. In the event that a User fails to provide the obligatory Personal Data as specified herein, or provides statements and guarantees, information, or Personal Data that are false, unclear, inaccurate, and/or incomplete, Privy retains the right to reject the application for creating a Privy Account for User and to suspend or terminate partially or entirely the Privy Services granted to the User.

Privy may process Personal Data of Privy Users, whether of a general and/or spesific/sensitive nature, in a condition as follows:

1. At the time of User Account Creation for Privy

   Privy asks the User’s Basic Data for the purpose of creating a Privy account. Such Personal Data is including but not limited to:

   1. Full name;
   2. Place and date of birth;
   3. National Identification Number (NIK) information;
   4. The copy (image) of User Identity Card (KTP) issued by Indonesia’s Government. Privy may request other supporting documents including but not limited to Family Card (KK), Driving License (SIM), Passport, Limited Stay Pemit Card (KITAS), and/or certificate from company as a supporting document for the identification and authentication process of the Electronic Certificate application, if required (including the information contained therein);
   5. Phone number;
   6. E-mail address; and/or
   7. Biometric data.

   In addition to the Basic Data above, Privy may collect and process additional data to the extent necessary in connection with the development and/or provision of Privy’s Services. Where such additional data has not been previously specified in this PDP Notice and requires consent under applicable laws and regulations, Privy will obtain the User’s written or recorded consent prior to collecting or processing such additional data.

2. Data that Privy collects automatically

   When Users use Privy Services, Privy will automatically collect Personal Data such as IP Address, login information, client browser & version, timestamp of activities, operating system, and User transaction data related to the use of Privy Services.

3. User-provided data

   At the time User uses Privy Services, including Privy Services through Third Party, User may provide other Personal Data (other than those referred to in points (A) and (B) above) to Privy from time to time.

   1. Privy uploads, collects, and uses User’s Contacts List and Image contained in the User's device for the use of PrivyChat service, where the data is needed to make data synchronization easier between the User's PrivyID and other User’s PrivyID to communicate with and/or recognize each other in connection with the Privy Services.
   2. All forms of documents, messages, images and/or attachments uploaded and/or shared by User on Privy Application in connection with the use of Privy Services including but not limited to PrivyChat and PrivySign.
   3. User location data, where the data is processed by Privy from the device used by the User when the User enters the User's Privy Account and/or uses the Privy Services, including carrying out the document signing process.

   Privy provides transparency to Users in managing and controlling their Personal Data. Privy will only process Users’ Personal Data on a limited basis for the purpose of providing Privy’s Services, in accordance with the terms and conditions previously communicated and/or based on the User’s consent.

4. Data that Privy collects from Third Party

   User can create Privy Account through Third Party to access or use the services provided by the Third Party. The Third Party that provides the Privy Account creation service is the registration authority. The registration authority will then forward the Personal Data that the User provided at the time of registration to Privy to create a User's Privy Account.

5. Cookies

   In improving Services quality, Privy uses cookies as long as the User uses the Privy Services, to recognize and remember certain information on the User's browser including session management, service personalization, and User activity recording. User can choose to disable cookies in the User's browser. If the User disables cookies, certain functions of the Site's services will be limited.

1. User’s Consent. For example, Privy may request the User’s consent to send information related to Privy’s Services or Third Party services collaborating with Privy via email, in-platform notifications on Privy, Short Message Service (SMS), chat applications (e.g.: WhatsApp), push notifications, recorded calls, and via email. Every consent request will be accompanied by clear information regarding the purpose of processing and how you can manage or withdraw that consent.
2. Performance of a contractual obligation between Privy and the User and/or Third Party, where there is a need to process the User’s Personal Data in order to execute the agreement. For example, Privy process Personal Data such as your Basic Data to enable electronic identity verification through the Privy Platform.
3. Compliance with legal obligations of Privy under laws and regulations, orders via official letter from officials and/or government agencies, court orders and/or judgments, and/or directives issued by state administrative authorities. This includes, but is not limited to, audits by competent authorities, court orders or subpoenas requiring Personal Data processing, and reporting to officials and/or government agencies for the purposes of crime prevention, compliance audits, or law enforcement.
4. Fulfillment of Privy’s interests, taking into account the purpose, needs, and balance of interests between Privy and User. This includes, but is not limited to, personalization to improve the quality of Privy Services for User, marketing activities, and audit purposes. This processing basis is carried out with consideration between Privy’s interests and the rights of the User as the Personal Data Subject.

Privy processes User's Personal Data for the following purposes:

1. General Purpose
   1. Provide Privy Services, such as:
      1. Issuing PrivyID, creating Privy Account, as well as issuing, managing, and revoking Electronic Certificates issued by Privy.
      2. Collecting, recording, and analyzing data related to user activities involving Privy Services.
      3. Notify User regarding transactions and/or activities occurring within the Privy Application or other systems connected to the Privy Application.
   2. The transmission of information regarding the Privy Services, updates, developments, and/or enhancements of the Privy Services, or services provided by Third Party collaborating with Privy.
   3. Internal purposes, including but not limited to audits and analysis related to the development, maintenance, testing, troubleshooting, enhancement, and customization of Privy Services to meet the needs and preferences of User.
   4. Fulfillment of Privy’s obligation to competent authorities in accordance with applicable laws and regulations.
   5. Personalization of the Privy Application and/or Services for User provided by Privy and/or Third Party collaborating with Privy.
   6. Processing User request in connection with Privy Services, including but not limited to access, correction, updating, and/or deletion/destruction of the User’s Personal Data within the Privy system, as well as contacting the User regarding such User request.
   7. Other purposes as long as those purposes are not prohibited by applicable laws and regulations. Privy will inform User about those other purposes when seeking the User’s consent if required by applicable laws and regulations.
2. Marketing Communications Purpose

   Privy has the right to deliver advertising materials, communications, and marketing related to the Services (“Marketing Communications”), including but not limited to personalized content based on the User’s attributes or demographic characteristics as determined by the User’s profile.

   The delivery of such information may be carried out by Privy or by Third Party in partnership with Privy, including sponsors and advertisers. These Marketing Communications may be distributed through various media, including but not limited to:

   1. Privy’s official platforms (such as Privy’s official social media, as well as Privy Application and Website);
   2. Short Message Services (SMS);
   3. Messaging applications (such as WhatsApp and Telegram);
   4. Push notifications; and/or
   5. Email.

   Privy will ensure that every delivery of such Marketing Communications is carried out in accordance with applicable laws.

Privy will openly provide access, transmit, convey, deliver, and/or disclose (hereinafter referred to as the “Disclosing” or “Disclosure”) User's Personal Data, which is contained in the Privy system. The Disclosure of the User’s Personal Data is carried out in affiliation with Privy and other parties (as mentioned in this PDP Notice) for the following purposes and for other purposes permitted by applicable laws and regulations:

1. To enable Privy to provide the Privy Services and/or to perform or render services to User, including but not limited to disclosures to:
   1. Other User, as party directly associated with the User in relation to the User’s utilization of the Privy Services;
   2. Agents, contractors, or Third Party who provide services to Privy enabling Privy to provide services to its User in connection with the use of their Personal Data. These Agents, contractors, or Third Party render services to Privy in the form of verification, authentication, analysis, promotions, fraud detection, payment, or other User support. Privy ensures that such agents, contractors, or Third Party will only utilize the User's Personal Data as necessary to support Privy Services and protect User’s Personal Data according to the applicable laws and regulations;
   3. The organization or legal entity to which the User is associated and registered through the Privy Services;
   4. Other Third Party that assist Privy in providing Privy Services, such as the providing services that handle complaints, insurance, enabling Third Party services to be offered within the Privy Application, processing all forms of User activities within the Application or platforms connected to the Application, and other lawful purposes as long as they are not prohibited by applicable laws and regulations.
2. Fulfillment of legal obligations and laws and regulations related to the process of law enforcement and/or preventive measures in connection with unlawful activities, criminal acts allegations, legal violations, or laws and regulations. In this regard, Privy may disclose User’s Personal Data to individuals, organizations, entities, or governmental authorities, or legitimate law enforcement agencies, who can provide valid evidence to Privy and demonstrate that they are authorized and/or obligated by legal rules and/or competent authorities that impose a legal obligation on Privy to disclose User's Personal Data to said party.
3. The activities of consolidation, merger, acquisition, buy and sell assets, restructuring, financing, or any other corporate actions in accordance with the applicable laws and regulations, which in their implementation involve Privy as the party undertaking such activities with other parties or with respect to other companies, or Privy as the party being consolidated or merged with another company or being acquired by another company or receiving financing from another company (even if such activities are subsequently not pursued).
4. To prevent any User uncertainty, Privy does not engage in the sale and/or distribution of User’s Personal Data to any party other than those explicitly consented to by the User in this PDP Notice. Privy ensures that only User, Third Party, and/or other parties authorized by the User, are permitted to access and/or view electronically uploaded document or Personal Data contained within the User Privy Account.
5. In the event that the User grants consent to a Third Party to utilize the Privy Account to access or avail service provided by Third Party, the utilization of the User’s Personal Data by the Third Party is subject to the terms and conditions and/or privacy policy of the Third Party.
6. The User acknowledges that Privy may disclose User’s Personal Data outside the territory of the Republic of Indonesia in connection with the Privy Services. In relation to this matter, Privy will ensure that Personal Data transfer activities are carried out to countries that have an equivalent level of Personal Data Protection, based on agreements that regulate the Personal Data Protection with valid and binding legal force, and/or have obtained your consent in accordance with the applicable laws and regulations.

Privy may utilize artificial intelligence (AI)-based systems, tools, or technologies as part of Personal Data Processing activities in its internal operations, product development, service provision, data analytics, and other supporting business functions. In this context, the use of AI may involve automated processing of Personal Data as regulated under applicable laws and regulations.

Any output generated by AI systems will be subject to internal review, validation, and oversight prior to implementation and use, and will undergo relevant evaluations to ensure compliance with applicable legal and regulatory requirements.

For example, AI may be used for the following purposes:

1. Enhancing operational efficiency, including identifying trends, news or information, and optimizing internal processes.
2. Handling User inquiries regarding the Privy Services through the chatbot features.
3. Developing and enhancing other Privy Services, which will be communicated to users from time to time.

Privy implements appropriate technical and organizational measures to ensure that data processing activities related to the use of AI are carried out in a secure, lawful, and responsible manner. Privy may also update, modify, enhance, or discontinue the use of certain AI technologies from time to time as part of its ongoing evaluation of technological suitability, regulatory developments, security considerations, and business needs.

1. Privy makes careful security and storage efforts to protect the confidentiality of User's Personal Data from time to time.
2. Any content (including message) uploaded and sent by Users to the Privy Services will be stored securely and sent confidentially using industry standards for securing electronic information.
3. Privy will notify the User in the event that there is a failure to protect the confidentiality of the User's Personal Data in the Privy electronic system in accordance with the provisions of applicable laws and regulations.
4. Privy maintains access to all data and information, including but not limited to recorded conversation messages, Personal Data or electronic documents that Users upload via User's Privy Account into the Privy system related to Privy Services so that only Users and other parties who are granted permission by Users to access and/or view such data and information.
5. Privy sets high standards for information security, it is important to note that Privy has been certified to ISO 27001:2022 regarding Information Security Management System and ISO 27701:2019 regarding Privacy Information Management System.
6. The User is responsible for maintaining the confidentiality of the User's Privy Account details, including the User's password and One Time Password (OTP) that Privy may send to the User from time to time to anyone, and must always maintain and be responsible for the security of the device that the User uses to access Privy Services.

User’s Personal Data is processed and stored in Indonesia, at Privy‑owned processing and storage facilities that are secure and comply with applicable information‑security standards.

Privy processes, in particular stores, Personal Data in accordance with applicable laws and regulations, taking into account the following conditions:

1. Commencement of Processing. Personal Data processing begins from the time the User provides consent to this Privacy Notice, including when the User creates an X account, and/or through the collection of Personal Data based on an agreement between X and a Third Party, or on other lawful basis for personal data processing in accordance with applicable laws and/or as set out in Article 3 of this PDP Notice;
2. Retention Period. Personal Data is retained:
   1. for as long as the User continues to use Privy Services;
   2. in accordance with the data retention period set out in Privy’s Certification Practice Statement; and/or
   3. for as long as it is necessary to fulfill legal obligations, dispute resolution, audits, or ensure compliance with applicable regulations.
3. Termination of Processing. Personal Data processing continues until:
   1. the purpose of the data processing is achieved;
   2. a request for withdrawal of consent or erasure is submitted by the User;
   3. the applicable retention period as required by law has expired; and/or
   4. the expiration of legal and/or contractual obligations between Privy and the relevant parties.

The User hereby gives express consent to Privy to conduct the User’s Personal Data Processing as described in this PDP Notice and in accordance with applicable laws and regulations. Such consent is granted taking into account the purpose of the processing, operational needs, and the balance between Privy’s interest and User’s rights.

User’s consent is considered valid and binding under the following conditions:

1. User has registered and is registered as an official user of Privy Services;
2. User knowingly and voluntarily submits Personal Data to Privy for the purposes as defined in this PDP Notice;
3. User's Personal Data has been stored, recorded, and/or processed in Privy’s systems and/or infrastructure;
4. User provides explicit consent through digital or non-digital means provided by Privy, including through agreements, forms, or other lawful consent;
5. User uses or accesses Privy’s Site, Application, platform, or other Privy Services to the extent that the processing of Personal Data is necessary for the provision of such services;
6. User engages in communication, interaction, or requests information via Privy’s official communication channel (including email or official social media);
7. User uses Third Party services that are connected or integrated with Privy’s systems and consents to the data processing required by such services;
8. User understands and agrees that Privy may appoint Third Parties, subject to applicable personal data protection laws and regulations, to carry out the purposes of data processing; and/or
9. User continues to use Privy Services following the implementation of any updates or changes to this PDP Notice, provided that such updates have been communicated to the User.

Privy provides User the rights associated with User’s Personal Data in accordance with applicable laws and regulations, wherein User possess the following rights:

1. Revocation of Consent/Deletion Request

   1. User has the right to revoke their consent and ask Privy to end processing, delete and/or destroy User's Personal Data from the Privy system. Before this can be processed, User must fulfill the verification requirements carried out by Privy.
   2. Privy has the right to request reasons for deleting Personal Data from Users. Requests to delete Basic Data can only be made by notifying Privy via Privy contact.
   3. Implementation of requests for deletion of Personal Data will be carried out in accordance with the applicable laws and regulations.
   4. The impact of Basic Data deletion is Privy Account closing, and Privy will delete/destroy User Personal Data from the Privy system and stop processing User Personal Data.
   5. If the User decides to withdraw consent for the processing of Personal Data for Marketing Communications purposes, the User may follow the “unsubscribe” instructions provided in each such communication. If, after such withdrawal of consent, the User continues to receive marketing communications from Privy, the User may submit a report or complaint through the complaint channels as set out in Article 14(b). Such report will be followed up by Privy in accordance with its applicable policies and procedures.

2. Access Request

   User has the right to request and obtain a copy of the User’s Personal Data stored on the User’s Privy Account. Granting access and the copy of data to User will be carried out in accordance with the provisions of the applicable laws and regulations.

3. Change Request

   1. The User has the right to change, correct, add, update, complete, and/or rectify any errors or inaccuracies regarding the User Personal Data stored within the Privy system. Changes of Personal Data in the form of Basic Data can only be made by giving notice to Privy through Privy’s contact. Meanwhile, for categories other than Basic Data, this can be done through the Privy Application. For request to changes e-mail address and/or cell phone number can be made by the User through the User’s Privy Account with proof of conformity to the User's biometric data. Privy reserves the right to request supporting documents and/or verify changes, additions, or updates to such information and Personal Data in accordance with Privy's procedures. Implementation of the change request will be carried out in accordance with the applicable laws and regulations.
   2. Privy has the right to revoke User’s request as stated in point (a), if:
      1. User's request is irrelevant to the User's Personal Data stored by Privy, including and not limited to if the party requesting the Personal Data of another party where the party does not have authority over the Personal Data and/or cannot legally prove that the party has authority over the Data Personal requested; and/or
      2. Privy is not permitted to carry out User requests by the competent authority and/or Privy's internal policies in accordance with applicable laws and regulations.

User hereby agrees to release, hold harmless, indemnify, and defend Privy, including any officers, directors, employees, or agents of Privy from and against any and all requests, claims, losses, liabilities, liabilities, costs, damages, and expenses (including but not limited to legal fees and indemnity expenses) resulting directly or indirectly from:

1. Any loss due to Personal Data that is intercepted, intercepted, accessed, stolen, disclosed, altered, or destroyed by an unauthorized Third Party, due to factors beyond Privy's control and/or contrary to this Privacy Notice and the applicable laws and regulations, including those resulting from User error or negligence;
2. the security and confidentiality of Personal Data that have undergone Processing, Disclosure, and/or storage by the User to the public or Third Party, whether the Processing, Disclosure, and/or storage are conducted by the User or any party other than Privy, and such Processing, Disclosure, and/or storage occurs not due to the negligence and/or fault or Privy in protecting the User’s Personal Data;
3. all risks and/or consequences arising from the negligence and/or personal errors committed by the User in maintaining the security and confidentiality of the User’s Personal Data; and/or;
4. all consequences arising from the utilization of any media and/or application that the User employs to Disclose, Process, and/or store the User’s Personal Data, including, among other things, internet networks and cloud storage services.

1. These Terms of Use are governed and construed based on the laws of the Republic of Indonesia.
2. User and Privy agree that all disputes or disputes arising from or relating to matters regulated in this PDP Notice (including all disputes or disputes arising from unlawful acts or violations of one or more terms and conditions in this PDP Notice) will be resolved by reference to the applicable laws and regulations, particularly those related to the personal data protection:
   1. Each party, either User or Privy ("First Party") is obliged to provide written notification to the other party ("Second Party") regarding the occurrence of a Dispute ("Dispute Notification"). Disputes must be resolved by deliberation and consensus within a maximum period of 30 (thirty) calendar days from the date of the Dispute Notification (“Deliberation Settlement Period”);
   2. If the Dispute cannot be resolved by deliberation and consensus until the end of the Deliberative Settlement Period, the First Party and the Second Party agree that the Dispute will be referred to and resolved by the Indonesian National Arbitration Board ("BANI") according to the BANI Arbitration Rules and Procedures located at Wahana Graha Floor 1 and 2, Jl. Mampang Prapatan No. 2 Jakarta 12760, with the following conditions:
      1. The language used in arbitration is Indonesian;
      2. The place of arbitration is Jakarta, Indonesia;
      3. The First Party and the Second Party will jointly appoint one (1) arbitrator who will be the sole arbitrator to resolve the dispute;
      4. Arbitration costs and legal fees must be borne by the losing party;
      5. The arbitration award is final and binding on the First Party and the Second Party.

In the event that these PDP Notice are displayed in a variety of language choices and there is a discrepancy between one language and another, the Indonesian text will prevail.

1. Notice from Privy
   
   1. Every notification from Privy addressed to Users or Users will be announced through the Site and sent via electronic mail (email), short message service (SMS), or push notifications through the Privy Application installed on the User's device registered with Privy.
   2. Any written notification from Privy addressed to User regarding failure to protect User Personal Data that occurs in the Privy system and/or Third Party systems collaborating with Privy will be sent via electronic mail (email address) or short message service (SMS) no later than 3x24 (three times twenty four) hours since the failure became known to Privy. This notification is carried out in accordance with applicable laws and regulations, including those related to the protection of Personal Data.
2. Notice from User
   1. Any notification from a User or User addressed to Privy relating to Privy Services becomes effective when the notification is received by Privy via the electronic mail address (e-mail address) helpdesk@privy.id, through a physical document sent to PT Privy Identity Digital with the address Jl. Kemang Raya No. 15C, 4^th Floor, Bangka Village, Mampang Prapatan District, South Jakarta 12730, Indonesia, and/or through Third Party who collaborate with Privy in providing Privy Services based on User’s consent.
   2. Any notification from a User relating to this PDP Notice or Personal Data can be submitted by the User to Privy via e-mail address at dpo@privy.id.

1. Privy has a right to review and change this PDP Notice from time to time to ensure that the provisions of this PDP Notice remain consistent with the evolving nature of Privy Services in the future and/or in the event of changes to applicable laws and regulations. In relation to such changes, Privy will notify Users about the changes through notifications as described in Article 15(a) above.
2. User understands and agrees that the User is responsible for periodically reviewing this PDP Notice to be informed of the latest information regarding this PDP Notice from time to time.