PRIVACY POLICY ON PARTNER
PT BANK MANDIRI (PERSERO) Tbk

Welcome to our Privacy Policy. We want to provide you with clarity and certainty about how we collect, use, and protect your personal information. By reading this Privacy Policy, we hope that you feel calm and confident that your privacy is our top priority.

In this Privacy Policy, we state that PT Bank Mandiri (Persero) Tbk (hereinafter referred to as “Bank”) and PT Mitra Transaksi Indonesia (“MTI”) as the Personal Data Controller, will strive to provide security and protection for your convenience in transactions.

We highly prioritize the security of your Personal Data. With full responsibility, this Privacy Policy explains in detail the definition, type, legality, and purpose of processing Personal Data. In addition, we explain the control and transfer of Personal Data, the processing period, and the procedure for change in the Privacy Policy. We take all these steps with reference to Law Number 27 of 2022 concerning Personal Data Protection and its amendments, better known as the “PDP Law”, as well as the applicable and relevant laws and regulations, so that you feel comfortable and confident in providing your Personal Data to us.

To clarify, the type, basis for processing, and purpose of processing your Personal Data may vary depending on the products, facilities, and/or services you use.

A. Definition of Personal Data

Personal Data is any data concerning an individual that is identified or can be identified independently or by combining it with other information directly or indirectly through electronic or non-electronic systems. The Personal Data processed includes Personal Data that you have and will provide to Bank and/or MTI.

B. Types of Personal Data

Bank realizes that it is important for you to know what categories and types of your Personal Data may be processed. The types of data include:

• Personal profile identification data, i.e. full name, National Identity Number (NIK) for Indonesian Citizen (WNI) and Foreign Citizen (WNA) ID Cards, Tax Identification number (NPWP)/Taxpayer Identification Number (TIN), immigration documents, gender, nationality, place and date of birth, mother's maiden name, alias name/nickname, religion, voice recording, image recording, photograph, signature form (wet and/or electronic), and/or biometric data;
• Correspondence data, i.e. address according to ID Card, address and domicile status, electronic mail address (e-mail), telephone/mobile phone number, and emergency contact consisting of name, type of relationship with you, address, telephone/mobile phone number, and e-mail;
• Education and employment data, i.e. education level, type of employment, field of business, position, division, year of commencement of work/business, name of company/agency of workplace, address of workplace, employment status, and name, position, and telephone number of co-workers;
• Family data, i.e. marital status, name of spouse, number of children, and number of dependents;
• Financial data, i.e. account number, source of income, total income per month/year, total expenditure per month/year, transactional data, credit/financing data, data related to assets, data related to collateral, and taxation data) and service data from other financial services that you receive (i.e. insurance and custodians);
• Digital activity data, i.e. geolocation, IP address, your activity in the Bank application, and the interaction of the Bank application with other applications on your electronic device; and/or
• Data related to personal preferences, i.e. communication preferences, hobbies, and interests. Personal Data processed may be received by Bank and/or MTI directly from you or through third parties.

C. Legality of Personal Data Processing

Basis for Processing
Personal Data processing is carried out as long as Bank and/or MTI has fulfilled one or more of
the following bases for processing:

• Bank and/or MTI has explicitly and legally obtained your consent;
• Bank and/or MTI exercises its rights and obligations based on an agreement with you;
• Bank and/or MTI needs to exercise its authority or fulfill its obligations pursuant to the laws and regulations/orders from authorized agencies;
• Bank and/or MTI needs to fulfill your vital interests;
• Bank and/or MTI needs to perform its duties for public interest and/or public services;
• Bank and/or MTI needs to fulfill other legitimate interests, by observing the balance between Bank and/or MTI's interests and your rights.

Purpose of Processing Your Personal Data
Your Personal Data is processed by the Bank for the following purposes:

• Management of Bank and/or MTI products, facilities, and/or services, including profiling and scoring, to improve services for you and manage Bank and/or MTI risk.
• Provision of promotions or programs from the Bank and/or MTI that can be combined with other parties for products and/or services that you already have.
• Marketing and/or offering of products, services, and/or services of the Bank and/or other companies within the Mandiri Group and/or third parties cooperating with the Bank, for products and/or services that you do not yet have.
• Compliance with laws and regulations and orders from regulators, law enforcement agencies, and other authorized agencies.

D. Control and Transfer of Personal Data

In processing your Personal Data, Bank and/or MTI may involve third parties as joint controllers and/or processors of your Personal Data both within and/or outside Indonesia. In such cases, Bank and/or MTI will protect your Personal Data in accordance with the laws and regulations.

If Bank and/or MTI transfers your Personal Data outside Indonesia, Bank and/or MTI will reasonably ensure that the destination country of the transfer has an equal (or higher) level of Personal Data protection than the Personal Data protection in Indonesia. In the event that the destination country of the Personal Data transfer does not have an equal (or higher) protection level, Bank and/or MTI may continue to transfer your Personal Data as long as it complies with the laws and regulations

E. Your Rights as a Personal Data Subject

Bank and/or MTI certainly realizes that Personal Data is the most important asset for you. Therefore, here we inform you of the rights you have as a Personal Data Subject:

• Right to Information and Access
  You have the right to obtain information regarding the identity of the party requesting your Personal Data, the purpose of the request, and access to a copy of your Personal Data. Bank and/or MTI will provide access to this information through official Bank and/or MTI means, such as Bank and/or MTI branches or other channels, in accordance with the provisions of laws and regulations and Bank and/or MTI policies. You understand that in the event that you request a copy of your Personal Data information and/or details of the processing of your Personal Data, you may be charged by Bank and/or MTI.
• Right to Data Rectification
  You have the right to complete, update and/or rectify any incorrect or inaccurate Personal Data.
• Right to Obtain, Use and/or Send Personal Data to Other Parties
  You have the right to obtain, utilize, or provide your Personal Data held by Bank and/or MTI to third parties, as long as the communication system used by Bank and/or MTI and the concerned Third Party is secure.
• Right to Terminate the Processing, Delete and/or Destroy Personal Data
  You have the right to terminate the processing, delete and/or destroy your Personal Data. You agree to give Bank and/or MTI time to process the termination of processing, deletion and/or destruction of your Personal Data to the extent that Bank and/or MTI requires. To exercise the right to terminate the processing, deletion and/or destruction of Personal Data, you can contact Bank and/or MTI through the communication means set out in point H of this Privacy Policy.
  
  To be understood, termination of processing, deletion and/or destruction of Personal Data may affect Bank and/or MTI's ability to provide products, facilities, and services to you as well as the contractual relationship that has been made between Bank and/or MTI and you or between Bank and/or MTI and other third parties, including possibly resulting in the cessation of services you receive and/or termination of one or more of your agreements with Bank and/or MTI and/or violation of one or more of your obligations under the agreement with Bank and/or MTI.
  
  In this regard, termination of processing, deletion and/or destruction of Personal Data results in you giving Bank and/or MTI the right to block your savings account, and/or declare that your debt and/or obligation to Bank and/or MTI is due and collectible. Any losses arising from the implementation of your right to terminate processing, deletion and/or destruction of Personal Data are your responsibility.
  
  Bank and/or MTI's obligation to delete and destroy your Personal Data is excluded for:
  • National defense and security interests;
  • Law enforcement interests;
  • Public interests in the context of state administration; or
  • Interests in supervising the financial services sector, monetary, payment systems, and financial system stability carried out in the context of state administration.
• Right to Withdraw Consent
  You have the right to withdraw your consent for the processing of Personal Data that you have given to Bank and/or MTI, and you agree to give Bank and/or MTI additional time to process the termination of the processing of your Personal Data to the extent that Bank and/or MTI requires. To exercise the right to withdraw consent, you can contact Bank and/or MTI through the communication means set out in point H of this Privacy Policy. You need to understand that the withdrawal of consent may affect Bank and/or MTI's ability to provide products, facilities, and services to you and manage the contractual relationship that has been made between Bank and/or MTI and you or between Bank and/or MTI and other third parties, including possibly resulting in the cessation of services you receive and/or the termination of one or more of your agreements with Bank and/or MTI and/or a violation of one or more of your obligations under the agreement with Bank and/or MTI. In this regard, the withdrawal of consent for the processing of Personal Data results in you giving Bank and/or MTI the right to block your savings account, and/or state that your debt and/or obligations to Bank and/or MTI are due and collectible. Any losses arising from the implementation of your right to withdraw consent for the processing of Personal Data are your responsibility.
• Right to Object to the Results of Automatic Processing
  You have the right to file an objection against the results of automated processing of your Personal Data that has legal consequences or has a significant impact on you, including profiling and/or credit scoring.
• Right to Suspend or Restrict Processing
  You have the right to suspend or restrict the processing of your Personal Data in proportion to the purposes for which your Personal Data is processed. For the exercise of this right, you may contact Bank and/or MTI through the communication means set out in point H of this Privacy Policy. You should understand that such request for delay or restriction of processing may affect Bank and/or MTI's ability to provide products, services and services to you, as well as the contractual relationship that has been made between Bank and/or MTI and you or between Bank and/or MTI and other third parties including possibly resulting in the cessation of services you receive and/or the termination of one or more of your agreements with Bank and/or MTI and/or the breach of one or more of your obligations under the agreement with Bank and/or MTI.
  
  In this regard, the delay or restriction of the processing of Personal Data results in you giving Bank and/or MTI the right to block your savings account, and/or state that your debt and/or obligations to Bank and/or MTI are due and collectible. Any losses arising from the implementation of your right to delay or restrict the processing of Personal Data are your responsibility.
• Other rights in accordance with laws and regulations.
  You have the right to submit other rights related to the processing of Personal Data as long as it is regulated in the applicable laws and regulations.

F. Period of Personal Data Processing

Bank and/or MTI will process Personal Data since Bank and/or MTI obtains the basis for processing. Bank and/or MTI will continue to process it as long as you still use Bank and/or MTI's products, facilities, and/or services or in accordance with the provisions of applicable laws and regulations. Bank and/or MTI may store your Personal Data after you end the use of Bank and/or MTI's products, facilities, and/or services for the period required by referring to laws and regulations.

G. Privacy Policy Changes

We are always committed to maintaining the security and privacy of your information. Therefore, we can update this Privacy Policy in accordance with the development of our practices in processing Personal Data and in accordance with applicable laws and regulations. You can access the latest version of this Privacy Policy through our website at www.bankmandiri.co.id/livinmerchant.

If there is amendment to this Privacy Policy, we will provide information through Bank's official communication means. Bank and/or MTI is committed to ensuring that you feel safe and always informed about the protection of your privacy. In addition, if any part of this Privacy Policy becomes unusable, it shall not affect the validity and enforceability of the remaining provisions. Thank you for your trust in Bank and/or MTI.

H. Contact Bank Mandiri

Bank Mandiri is ready to assist and answer all questions you may have regarding this Privacy Policy. Please contact our customer service team via call center Bank Mandiri 14000 or Call center HiYokke 14021, send the questions via email to mandiricare@bankmandiri.co.id, or You can also visit the nearest Bank branch office.