---

A. Legality of Personal Data Processing

• 1. SKBF highly appreciates your confidence in giving SKBF approval to process your personal data for the purpose of submitting credit applications, as well as other interests related to financing agreements. SKBF will only process your personal data in accordance with the regulations and laws applicable in Indonesia, specifically for consumer and community protection and information security of SKBF.
• 2. In personal data processing, the SKBF has implemented information security procedures that have been ISO/IEC 27001:2013 certified and implemented information technology risk management in accordance with the applicable Financial Services Authority (POJK).

B. Purpose of Personal Data Processing

• 1. SKBF highly appreciates your confidence in giving SKBF approval to process your personal data for the purpose of submitting credit applications, as well as other interests related to financing agreements. SKBF will only process your personal data in accordance with the regulations and laws applicable in Indonesia, specifically for consumer and community protection and information security of SKBF.
• 2. The processing of personal data that you have given SKBF approval on the first occasion includes:
  • a. Personal Data Collection Process;
  • b. Examination and verification of information/data provided;
  • c. Credit Analysis;
  • d. Assessing/processing the applicant/Debitur profile in relation to financing and/or billing;
  • e. Market research and analysis;
  • f. Requirements for Cooperation with third parties in relation to the improvement of the products required by the Applicant/Debitur;
  • g. Survey requirements;
  • h. The Company's billing requirements to check the veracity of the information; and
  • i. Examination of Credit History based on the above information from any source in a manner deemed appropriate by the Company;
  • j. Cooperation and cooperation agreements with individual partners.

C. Data Type, Relevance, and Details of Information

• 1. The types of your personal data to be processed for the purpose of filing and providing financing facilities, as described in point B, include:
• a. Name;
• b. Gender;
• c. Citizenship;
• d. Religion;
• e. Marital Status;
• f. Mother's maiden name;
• g. Mobile Phone Number;
• h. Personal financial data and history;
• i. Criminal Record;
• j. Other data in accordance with the provisions of the applicable laws and regulations;
• k. Identity card data and other information
• 2. When you visit the SKBF website, the SKBF server will also automatically collect information from the browser you are using, including but not limited to; computer IP address, browser used, Webpage visit history, duration of time used to access the website, item and information search history on the SKBF website, access time and date, and other statistics. This information is collected by SKBF in the context of analysis and evaluation needs to help SKBF improve or improve SKBF's website.

D. Retention Period for Documents Containing Personal Data

• The SKBF ensures that the Personal Data you provide will be maintained in accordance with the applicable information security standards in the SKBF. Personal information/data in the form of physical documents shall be kept in accordance with the provisions of the applicable laws and regulations. After passing the document retention period, your personal data will be destroyed in accordance with the applicable regulatory requirements.

E. Personal Data Processing Time Period

• Your Personal Data Processing Period starts from the process of submitting personal data at the time of filing a financing facility credit application to the expiration of the financing facility period under the financing agreement depending on the type of financing and the financing period (tenor) you choose.

F. Subject Rights of Personal Data

• As a Subject of the Personal Data and approval processing of the Personal Data, you have the following rights:
• 1. Obtaining Information on the clarity of identity, the basis of legal interest, the purpose of requesting and using Personal Data, and the accountability of the person requesting Personal Data.
• 2. Complete, update, and/or correct errors and/or inaccuracies of Personal Data about itself in accordance with the purpose of processing Personal Data.
• 3. Obtain access to and obtain a copy of Personal Data about him in accordance with the provisions of the legislation.
• 4. Terminate processing, deleting, and/or destroying Personal Data about themselves in accordance with the provisions of the legislation.
• 5. Withdraw the Personal Data processing agreement about him/her that has been granted to the Personal Data Controller.
• 6. Objecting decision-making actions that are based solely on automated processing, including profiling, that cause legal consequences or have a significant impact on the Subject of Personal Data.
• 7. Pending or limiting the processing of Personal Data proportionally according to the purpose of processing Personal Data.
• 8. Claims and receives compensation for violations of the processing of Personal Data about him in accordance with the provisions of the legislation.
• 9. Obtain and/or use Personal Data about itself from a Personal Data Controller in a form that corresponds to a structure and/or format commonly used or readable by electronic systems.
• 10. Using and transmitting Personal Data about itself to other Personal Data Controllers, as long as the system is used may communicate with each other securely in accordance with the principles of Personal Data Protection under this Act.
• 11. The exercise of your rights in numbers 1-10 must be submitted through a written application submitted electronically or non-electrically to the SKBF.