Bank Mega Auction Information Privacy Policy

PT Bank Mega Tbk (hereinafter referred to as “Bank Mega”) is committed to protecting the Personal Data of users of the Info Lelang Bank Mega website, accessible at https://infolelang.bankmega.com/ (hereinafter referred to as the “Application”).

This Privacy Policy explains how Bank Mega processes users Personal Data for account registration, email verification, account management, provision of information on auction assets and Foreclosed Collateral (Agunan Yang Diambil Alih/AYDA), as well as communications relating to the Application services.

When you use the Info Lelang Bank Mega website/Application, Bank Mega acts as the Personal Data Controller for the processing of Personal Data whose purposes and means are determined by Bank Mega in accordance with applicable laws and regulations.

Users interested in an asset may contact Bank Mega through the available communication channels. The subsequent asset purchase process will be carried out in accordance with the applicable mechanisms, requirements, and terms.

Definitions and Terms

The terms used in this Privacy Policy are explained as follows:

  1. You means a user who registers as a user on the Info Lelang Bank Mega website/Application;
  2. Info Lelang Bank Mega, hereinafter referred to as the “Application”, is an internal application owned by PT Bank Mega Tbk (hereinafter referred to as “Bank Mega”) that functions to create credit pipelines online, enabling all credit stakeholders to monitor and oversee CRM-created pipeline performance in real time and transparently;
  3. Personal Data means data about an individual or Corporate Data that can be identified individually or in combination with other information, directly or indirectly, through electronic or non-electronic systems;
  4. Personal Data Processing means any action performed on Personal Data, including collection, use, storage, disclosure, updating, deletion, and destruction.

This Privacy Policy covers the following matters:

I. COLLECTION AND TYPES OF PERSONAL DATA COLLECTED

For the use and operation of the Application, Bank Mega may lawfully obtain Personal Data consisting of user identification data directly from you, which may include your full name, telephone number, and email address required for use of the Application and management of access to it.

Bank Mega processes such Personal Data in accordance with the specified processing purposes, while observing Personal Data protection principles and the rights of Personal Data Subjects.

II. PURPOSES OF PERSONAL DATA PROCESSING
  1. Bank Mega processes your Personal Data for the following purposes:
    • a. Application account registration and verification;
    • b. Management of account data and access to Application services; and/or
    • c. Contacting you by email, letter, telephone, or other permitted personal communication channels, including but not limited to assisting with and/or completing the expression of interest in auction assets or AYDA.
  2. Personal Data is also used to maintain Application security, prevent account misuse, improve service quality, and fulfil applicable legal obligations.
  3. Bank Mega ensures that Personal Data processing in the Application is carried out for lawful purposes and in accordance with applicable laws and regulations.
III. LEGAL BASIS FOR PERSONAL DATA PROCESSING
  1. Bank Mega processes Personal Data based on one or more lawful grounds for processing in accordance with applicable laws and regulations, including:
    • a. Your valid consent, where consent is required as a legal basis for Personal Data processing;
    • b. Performance of obligations under an agreement or your request, including the creation and management of an account on the Application;
    • c. Compliance with Bank’s legal obligations; and/or
    • d. Pursuit of legitimate interests in accordance with applicable provisions.
  2. Bank Mega will provide information on the relevant purposes and legal bases for processing, as applicable, through this Privacy Policy.
  3. If a user does not provide the data required for registration or does not complete the required email verification, Bank Mega will be unable to provide access to an account or certain features of this Application.
IV. DISCLOSURE OF PERSONAL DATA
  1. Bank Mega may provide access to or disclose your Personal Data to third parties where necessary for lawful purposes, supported by an appropriate legal basis for processing, and permitted under applicable laws and regulations. Such third parties may include:
    • a. Email service providers used to send verification emails and notifications relating to your account registration on the Application;
    • b. Communication service providers required to support the delivery of auction information from Bank Mega to you;
    • c. Government agencies or competent authorities, where necessary to fulfil legal obligations; and/or
    • d. Other parties that are duly authorized and have a lawful basis to receive Personal Data.
  2. If you contact Bank Mega regarding information on auction assets, Bank Mega may engage an auction organizer or another authorized party to process your information request. Bank Mega will only provide Personal Data to such parties where necessary, supported by a lawful basis, and in accordance with applicable provisions.
V. PERSONAL DATA TRANSFER

If the operation of the Application involves recipients of Personal Data located outside the territory of the Republic of Indonesia, Bank Mega may transfer Personal Data outside the territory of the Republic of Indonesia to the extent necessary for the operation of the Application and in accordance with applicable laws and regulations.

Bank Mega ensures that such Personal Data transfers comply with cross-border Personal Data transfer requirements, including requirements for an equivalent or higher level of Personal Data protection, adequate and binding Personal Data protection, or your consent or that of a Third Party where required under applicable laws and regulations.

Information regarding transfers of Personal Data outside the territory of the Republic of Indonesia relevant to your use of the Application may be provided to you through Bank Mega’s official communication channels designated for Personal Data protection inquiries, to the extent such information may be disclosed in accordance with applicable laws and regulations.

VI. PERSONAL DATA RETENTION
  1. Bank Mega is committed to retaining your Personal Data with the best available protection for as long as necessary to manage your account, provide Application services, fulfil processing purposes, and comply with obligations under laws and regulations. The retention period for Personal Data associated with your account is determined by taking into consideration:
    • a. Your account status as an Application user;
    • b. The needs for managing and securing your account;
    • c. The operational needs of the Application; and/or
    • d. Retention obligations under applicable provisions.
  2. If Personal Data is no longer required and there is no legal basis for retaining it, Bank Mega will delete or destroy it in accordance with applicable procedures and provisions.
VII. PERSONAL DATA SECURITY
  1. To protect and secure your Personal Data from access by unauthorized parties, Bank Mega continually seeks to implement appropriate procedures and best-practice electronic systems equipped with adequate security measures as required by regulators and applicable laws and regulations. Bank Mega will update such security measures from time to time.
  2. In the event of unauthorized or unlawful access to your account beyond Bank Mega’s control, Bank Mega will notify you as soon as practicable so that you can mitigate the risks arising from such access.
  3. Application account security also depends on how you maintain the confidentiality of your account password and other access information. Providing information over the internet entails security risks, which are also part of your responsibility as an Application user.
VIII. RIGHTS OF PERSONAL DATA SUBJECTS
  1. You have certain rights under applicable laws and regulations to request Bank Mega to access, correct, and/or delete Personal Data associated with your account that is under Bank Mega’s possession and control, to the extent such rights are available to you under applicable laws and regulations.
  2. Please be aware that Bank Mega may refuse your request for access to, correction of, and/or deletion of some or all of your Personal Data held or controlled by Bank Mega where such refusal is permitted or required under applicable laws and regulations.
IX. UPDATES TO THE PRIVACY POLICY

Bank Mega may update this Privacy Policy from time to time to reflect changes in services, business processes, technology, or applicable laws and regulations.

Updates to this Privacy Policy will be communicated through Bank Mega’s official channels designated for this purpose. Where required by applicable provisions, Bank Mega will notify you of relevant changes.

X. REFERENCES

The Personal Data Protection Law, Bank Indonesia Regulations (PBI), Financial Services Authority Regulations (POJK), and other applicable laws and regulations.

Mila