This Privacy Notice pertains to the personal data and information handled by PT Bank Maybank Indonesia Tbk (“Bank”) effective as of October 15, 2024, in compliance with the relevant terms and conditions governing the processing of Personal Data at the Bank.

The Bank recognizes the significance of Personal Data protection, as regulated by Law No. 27 of 2022 concerning Personal Data Protection and its implementing regulations as enacted and amended from time to time (hereinafter referred to as the "PDP Law"), which is applicable to the Bank. Accordingly, the Bank is dedicated to execute the stipulations of the PDP Law and associated regulations, ensure adherence to confidentiality and safeguard your Personal Data in compliance with the relevant legal frameworks.

This Privacy Notice defines "Personal Data" as information pertaining to identified or identifiable individuals, whether directly or indirectly, individually or in conjunction with other data, that can be utilized to identify, contact, or monitor the subject of such data through both electronic and non-electronic means, in accordance with the PDP Law, its associated regulations, and Section C of this Privacy Notice. Personal Data encompasses information found on identification cards that can be used to identify an individual (including your photograph), contact number, electronic mail address, personal financial information (which includes, but is not limited to, bank account information, credit card details, and transaction records), electronic mail address, along with your date and place of birth.

1. request information regarding Bank Services;
2. become a user of the Services or a customer of the Bank;
3. become (i) a business partner, contractor, agent, or supplier of the Bank; and/or (ii) have a legal relationship with the Bank for a specific purpose, such as the implementation of social and environmental responsibilities (corporate social responsibility).

1. You have thoroughly reviewed and comprehended all information presented in this Privacy Notice, including the processing of Personal Data conducted by the Bank as outlined herein;
2. You acknowledge and guarantee the authenticity, completeness, and accuracy of the Personal Data you submit to the Bank; and
3. You acknowledge and agree to adhere to the principles of Personal Data protection in accordance with the PDP Law should you, at any point in the future, receive Ppersonal Data from third parties, including the Bank, for any reason.

In specific circumstances, it may be necessary for you to furnish Personal Data pertaining to other individuals (including, but not limited to, a lawful spouse, family members, or other relevant parties) to the Bank.

1. The information pertaining to your identity encompasses your full name, photograph, place and date of birth, gender, signature (both wet and/or electronic), biometric data, and identity card, along with any Personal Data included therein (such as the Population Identification Number (NIK) and/or passport number), as well as the Tax Identification Number (NPWP).
2. Contact information, which encompasses email address as well as home and mobile telephone numbers.
3. Financial information encompases details pertaining to bank accounts and/or payment methods utilized in transactions for the delivery of the Services, credit assessment data, and financial background.
4. Device data encompasses information regarding the type and model of the device utilized to access the Services, the internet protocol (IP) address, and geographical location data (geolocation, as necessary for the provision of the Services). Additionally, cookies are employed to personalize any information that includes Personal Data used to access the Services. Users have the option to manage their cookie settings through their browser, although this may impact the speed and quality of the Services.
5. Additional personal information as per relevant legal statutes and regulatory requirements.
6. Data from external sources, encompases identity information, contact details, financial information, device data, and other personal information as specified above, which has been provided or acquired by the Bank from you.

1. Acquisition and Collection
   In the context of the acquisition and collection of Personal Data, the Bank will:
   1. Determine the basis for processing before acquiring and collecting Personal Data;
   2. Clearly define the purpose of acquiring and collecting Personal Data, considering the interests of the Personal Data subject;
   3. Limit the amount of Personal Data collected based on the predetermined purpose;
   4. Establish secure mechanisms for the acquisition and collection of Personal Data;
   5. Provide information regarding the purpose of processing before the acquisition and collection of Personal Data; and
   6. Apply the principles of Personal Data processing in the acquisition and collection of Personal Data in accordance with the provisions of the legislation
2. Processing and Analysis
   In the realm of processing and analyzing Personal Data, the Bank will:
   
   1. Establish mechanisms and/or standards for the application of data quality to guarantee that the Personal Data processed and analyzed is both accurate and complete;
   2. It is imperative to furnish the subjects of Personal Data with relevant information in instances where the processing and analysis of Personal Data extend beyond or supplement the original purposes established for such activities;
   3. Execute a Personal Data Protection Impact Assessment for the processing and analysis of Personal Data that presents a significant risk to the individuals concerned.
   4. Ensure the rights of individuals regarding their Personal Data to contest decisions that are exclusively derived from automated processing; and
   5. Implement the principles of Personal Data processing in relation to the handling and examination of Personal Data, in compliance with the relevant legislative provisions.
3. Storage Solutions
   In the realm of Personal Data storage, the Bank will undertake the following actions:
   1. Identify and implement appropriate security measures for both physical and electronic storage of Personal Data;
   2. Develop and enforce mechanisms for the retention of Personal Data;
   3. Establish the retention duration for Personal Data in compliance with applicable laws and regulations;
   4. Introduce strategies to mitigate the risk of Personal Data Protection breaches during storage by:
      1. Utilizing data encryption and/or masking techniques; 
      2. Generating backup copies of Personal Data; and
      3. Ensuring encryption and/or masking of backup copies of Personal Data;
   5. Restrict access to Personal Data to authorized individuals only; 
   6. Maintain awareness of, and document, the locations and media utilized for the storage of Personal Data; and
   7. Adhere to the principles governing Personal Data processing during storage in alignment with laws and regulations.
4. Amendment and Revision
   To ensure the accuracy and currency of Personal Data, the Bank will:
   1. Provide assistance to the Personal Data subject in completing, updating, and/or rectifying any errors and/or inaccuracies in their Personal Data;
   2. Confirm the Personal Data provided by the individual concerned; and
   3. Implement the principles governing the processing of Personal Data with respect to the correction and updating of such data, in compliance with the relevant legislative provisions.
5. Presentation, announcement, transfer, dissemination, or disclosure of information
   In relation to the presentation, announcement, transfer, dissemination, or disclosure of Personal Data, the Bank will:
   1. Ensure a valid basis for processing Personal Data prior to any presentation, announcement, transfer, dissemination, or disclosure, unless otherwise stipulated by applicable legislation;
   2. Adhere to the established criteria for transferring Personal Data beyond the jurisdiction of the Republic of Indonesia as mandated by law;
   3. Enforce Personal Data security measures in compliance with relevant legislation;
   4. Restrict the disclosure of Personal Data to the specific purposes of processing that have been clearly defined and consented to by the Personal Data subject, ensuring alignment with legal requirements;
   5. Uphold the principles governing Personal Data processing in the context of presentation, announcement, transfer, dissemination, or disclosure, in accordance with applicable legislation.
6. Deletion or Destruction
   In the context of the deletion or destruction of Personal Data, the Bank will:
   1. Delete or destroy Personal Data except during the retention period as required by applicable laws and regulations;
   2. Implement secure mechanisms for the deletion or destruction of Personal Data;
   3. Facilitate the fulfillment of the rights of Personal Data subjects to delete data, as long as it does not conflict with applicable laws and regulations;
   4. Act on requests from Personal Data subjects to delete valid/legal Personal Data and in accordance with applicable laws and regulations, by:
      1. Deleting or destroying Personal Data in accordance with applicable laws and regulations;
      2. Deleting or destroying Personal Data at all locations where Personal Data is stored;
      3. Keeping evidence of the deletion or destruction of Personal Data in the form of a deletion report; and
      4. Providing evidence of the deletion or destruction of Personal Data to the Personal Data subjects; and
   5. Apply the principles of Personal Data processing in the deletion or destruction of Personal Data in accordance with applicable laws and regulations.

1. The provision and processing of the Services you select or hold, which encompass:
   1. Delivery of the Services and information pertaining to the Services (including relevant updates over time);
   2. Adherence to regulatory requirements, including the application of Customer Due Diligence (CDD) principles, execution of Anti-Money Laundering Programs, Counter-Terrorism Financing measures, Prevention of Proliferation of Weapons of Mass Destruction protocols, and Anti-Bribery and Corruption Policies in connection with the Services provided to you;
   3. Addressing and resolving your inquiries related to the provision of the Services;
   4. Modifying, enhancing, and/or developing the Services, including updates and/or adjustments to applications/systems associated with the Services; and/or
   5. Addressing other requirements as necessary in relation to the provision/processing of the Services to you.
2. Implement and improve operational activities, and fulfill the provisions of applicable laws and regulations, which include:
   1. Conduct surveys, research and studies related to the provision of the Services, including generating analytical data generated through data analysis and/or usage patterns for the purpose of research, analysis, testing, product development, and cooperation with Third Parties;
   2. Collect payments for the provision of the Services;
   3. Perform activities in connection with accounting, auditing, taxation, and reconciliation related to the provision of the Services, as well as internal administrative processes;
   4. Carry out obligations under agreements to you and/or to related Third Parties (including but not limited to vendors and partners);
   5. Prevent, detect, investigate any suspicious transactions, criminal offenses, or prohibited activities including under applicable laws and regulations;
   6. Communicate with you through various media, including to respond to questions, comments or complaints;
   7. Process your participation in any production activities, contests, games, promotions, polls or surveys;
   8. Perform other internal activities necessary to provide the Services, such as troubleshooting software problems, bugs, operational issues, conducting data analysis, testing, and research, and to monitor and analyze usage and activity trends;
   9. Fulfill requests in connection with law enforcement and protecting the rights of the Bank and/or you; and/or
   10. Fulfill other needs as required in the provision of the Services to the extent related to the implementation/improvement of operational activities and to fulfill the provisions of applicable laws and regulations.
3. Product and Promotion Offers encompassing service offerings, product selections, competitions, prize draws, events, or alternative promotional activities tailored to align with your specific needs and profile. The Bank may communicate offers for products and services that are either owned or provided by the Bank and/or third parties through a variety of channels and methods, both verbally and in written form. This includes, but not limited to, push notifications, social media platforms, instant messaging applications (such as WhatsApp), SMS, telephone communications, emails, brochures, or other pertinent electronic and non-electronic media, in compliance with applicable regulations ("Other Offers").
4. The Bank may process Personal Data in the event that it engages in corporate actions and/or other transactions, which may include, but not limited to, mergers, splits, acquisitions, consolidations, restructurings, and/or other activities that necessitate the transfer of intellectual property rights, as such actions involve the processing of Personal Data.
5. The Bank may process Personal Data when directed or mandated by a duly authorized governmental body, for the purposes outlined and governed by relevant laws and regulations.

1. Explicit Consent: Your valid and explicit consent provided in connection with this Privacy Notice;
2. Fulfillment of Contractual Obligations: The necessity to fulfill contractual obligations in order to provide the Services to you and for other purposes as detailed in this Privacy Notice;
3. Legal Compliance: Compliance with legal obligations imposed by applicable laws and regulations;
4. Legitimate Interests: The performance of obligations and consideration of business requirements based on legitimate interests, while carefully balancing the objectives, needs, and interests of the Bank, as the Data Controller, against your rights as the Data Subject;
5. Additional Legal Grounds: Other lawful grounds for processing Personal Data in accordance with applicable statutory provisions.

The Bank may share or disclose your Personal Data to Third Parties for the purpose of further processing in accordance with the intended purposes and legal bases established by the Bank.

1. You hereby give explicit consent for the Bank to transmit, store, use, and process your Personal Data on servers located in data centers designated by the Bank. These data centers may be managed by Third Parties, in compliance with relevant laws and regulations. Nonetheless, the processing of your Personal Data related to the Services will remain subject to this Privacy Notice in accordance with applicable legal requirements.
2. Once your Personal Data is no longer necessary for the provision of the Services or the purposes of processing described in this Privacy Notice, the Bank will take appropriate steps to delete, destroy, anonymize, and/or restrict access to or processing of your Personal Data for any purposes other than those specified in this Privacy Notice.
3. Additionally, some of your Personal Data may still be retained or controlled by Third Parties, including government agencies, for the purposes of processing outlined in this Privacy Notice. Should the Bank disclose your Personal Data to relevant governmental authorities and/or other institutions, you represent, acknowledge and understand that the retention of your Personal Data by such entities will be governed by their respective data retention policies, which may limit certain rights you have as a Data Subject under applicable legal provisions.
4. The Bank is committed to maintaining appropriate physical, technical, and procedural safeguards to protect your Personal Data against loss, misuse, copying, damage, alteration, and unauthorized or unlawful access or disclosure, including incidents of loss or damage.
5. Furthermore, while the Bank implements what it deems best practices and optimal measures to secure your Personal Data (including utilizing security methods and technologies provided both internally and by Third Parties that assist in safeguarding the Personal Data you provide), the Bank cannot provide an absolute guarantee of complete security for the Personal Data you submit. Nonetheless, the Bank will continue to strive diligently to protect and secure your Personal Data, and it will also assume responsibility for the activities of Third Parties with whom it collaborates.
6. If needed, you may obtain further information regarding Bank's measures to protect your Personal Data by contacting the Bank through the channels or contact information provided in Section K of this Privacy Notice.

If you use or access websites, applications, and/or systems related to the Services in other countries (outside the Republic of Indonesia) where Bank’s websites, applications, and/or systems are accessible (“Destination Country”), the Bank may transfer your Personal Data from your country of origin (“Origin Country”) to the Destination Country to enable you to access Bank’s websites, applications, and/or systems outside the Republic of Indonesia. You hereby acknowledge and consent to the transfer of your Personal Data from your Origin Country to the Destination Country as described in this Privacy Notice.

Additionally, the Bank may also transfer your Personal Data outside the jurisdiction of the Republic of Indonesia, and if necessary, details regarding such transfers can be provided to you.

1. The right to receive information;
2. The right to access and/or obtain copies of your Personal Data;
3. The right to complete, update, and/or rectify errors and/or inaccuracies in your Personal Data;
4. The right to terminate Personal Data Processing;
5. The right to request the deletion of your Personal Data;
6. The right to data portability, allowing you to obtain and/or use your Personal Data from the Bank as the Data Controller in a format that is commonly used and/or machine-readable;
7. The right to interoperability, enabling you to utilize and transfer your Personal Data to other Data Controllers;
8. The right to withdraw consent for Personal Data Processing;
9. The right to suspend or limit Personal Data Processing in a proportional manner; and
10. The right to seek legal remedies and obtain compensation in the event of a violation of Personal Data Processing due to Bank’s fault or negligence that directly affects you.

If you wish to submit a request to exercise your rights as stated above, you may do so through the channels/contact information specified in Section K of this Privacy Notice.

The Bank will verify and assess all requests you submit to exercise your rights as a Data Subject and will respond within 3 x 24 hours from the receipt of your request. To process your request, the Bank may require you to provide information or supporting documentation to substantiate your request. Upon verification, the Bank will inform you of the implications of exercising your rights. After obtaining your consent regarding these implications, the Bank will fulfill your request within the timeframe specified by applicable laws and regulations.

1. National defense and security interests;
2. Law enforcement interests;
3. Public interests related to the administration of the state;
4. Interests in supervising the financial sector, monetary interests, payment system stability, and the stability of the financial system conducted in the context of state administration;
5. Statistical and scientific research interests;
6. Obligations to comply with applicable laws, such as those pertaining to the implementation of Customer Due Diligence (CDD) processes and/or the prevention of criminal activities;
7. Requests deemed irrelevant to the Personal Data Processing activities conducted by the Bank or to you as a Data Subject;
8. Risks to the physical or mental health or safety of the Data Subject or others; and/or
9. Impacts on the disclosure of Personal Data belonging to third parties.

Without prejudice to any prohibitions or restrictions under applicable laws, the Bank also reserves the right to deny your request to exercise your rights as a Data Subject if you have ongoing rights and obligations with the Bank, its partners/agents, or third parties.

The Bank reserves the right to modify, enhance, and/or replace this Privacy Notice periodically (with notification to you) to ensure that it remains consistent with the procedures and practices employed by the Bank in the Processing of Personal Data, including adherence to applicable laws and regulations.

You can regularly access this Privacy Notice on Bank’s website and/or application.