MEGABIZ TOKEN PRIVACY POLICY

PT Bank Mega, Tbk, domiciled at Menara Bank Mega, Jl. Kapten P. Tendean 12–14A, Jakarta 12790, Indonesia, hereinafter referred to as “Bank Mega,” is the entity responsible for the Processing of Personal Data for Bank Mega Services.

MegaBiz Token is a mobile token application provided by Bank Mega as a means of authenticating and/or authorizing transactions on the MegaBIZ service.

This MegaBiz Token Privacy Policy (the “Privacy Policy”) explains the types of information processed through MegaBiz Token, the purposes of processing, the use of device access, security measures, and your rights as a Personal Data Subject.

This Privacy Policy forms an integral part of Bank Mega’s Privacy Policy and the MegaBIZ service terms. Further details are available at: https://bankmega.com/id/privacy-policy/.

By downloading, installing, activating, accessing, and/or using MegaBiz Token, you are deemed to have read, understood, and agreed to this Privacy Policy.

Definitions

The terms used in this Privacy Policy are defined as follows:

You means any Personal Data Subject who uses the MegaBIZ Service and/or MegaBiz Token, including Bank Mega customers (individuals or corporations), individuals appointed and/or authorized to represent customers, and users of Bank Mega websites/applications and Third Parties associated with Bank Mega.
Bank Mega means PT Bank Mega Tbk.
Personal Data means data about an identifiable natural person, either individually or in combination with other information, directly or indirectly, through electronic or non-electronic systems.
Device Information means certain technical information about the device used to run MegaBiz Token, including the operating system version, relevant information about installed applications, and other technical data required for security functions.
MegaBiz means the electronic banking service/facility provided by the Bank to Customers through an online-connected network to conduct Financial and Non-Financial Transactions using a computer device.
MegaBiz Token means a mobile token application provided by Bank Mega as one means of authenticating and/or authorizing transactions on the MegaBIZ service.
Personal Data Processing means activities involving obtaining, collecting, processing, analyzing, storing, correcting, updating, disseminating, displaying, announcing, transferring, disclosing, deleting, and destroying Personal Data.
Third Party means any party having a cooperative relationship with Bank Mega, including business partners, vendors, outsourcing companies, and/or other parties.

This Privacy Policy covers the following matters:

Acquisition and Collection of Personal Data and Device Information
To provide authentication functionality and maintain the security of MegaBiz Token, Bank Mega collects Personal Data from device information when MegaBiz Token is used or accessed.

The Personal Data and Device Information collected by Bank Mega include, but are not limited to:
1. Customer Identification Data
  Bank Mega uses identification data such as name, gender, email address, and telephone number to create a MegaBiz Token account.
2. Operating System Version
  This information is used to support application operation, ensure application compatibility, and support application security functions. Bank Mega does not use this information to track the Customer’s location.
3. Information About Installed Applications
  Bank Mega may process metadata about applications installed on the device, including information required to conduct device security checks. This information is used only for the following limited purposes:
  1. Checking the security status of the device used for MegaBiz Token;
  2. Detecting indications of rooting on Android devices and jailbreaking on iOS devices;
  3. Identifying device conditions that may increase security risks; and
  4. Helping prevent the use of MegaBiz Token on devices that do not meet the security requirements established by Bank Mega.
4. Other Device Information
  Except for the information specifically described in this Privacy Policy, Bank Mega does not process other device information beyond what is necessary for the functionality and security of MegaBiz Token.
Use of the Camera and Quick Response Code (QR Code) Scanning
Bank Mega may request permission to use the camera on the device used by the Customer for MegaBiz Token when QR Code scanning is required for registration, activation, or certain authentication processes.

QR Codes are used to transfer information securely without manual input. Data obtained from a QR Code is used only once (one-time use) and solely for purposes related to MegaBiz Token.

Information obtained through QR Code scanning is used only for purposes related to MegaBiz Token.
Use of Internet Access
MegaBiz Token is designed to perform mobile token functions offline without requiring an internet connection. MegaBiz Token does not use an internet connection to send information about the Customer’s activities or transaction confirmations to Bank Mega.

Information about transactions and/or operations requiring authorization is processed through the mechanisms specified in the MegaBIZ Service.
Security and Fraud Prevention
Bank Mega applies security assessment mechanisms to MegaBiz Token in order to:
1. Protect the integrity of the application;
2. Prevent the application from being used on modified devices;
3. Detect risky device conditions; and
4. Prevent unauthorized access and fraudulent activity.
These checks are performed locally on your device and are not transmitted to Bank Mega’s servers.
Purposes of Using Personal Data and Device Information
Bank Mega processes information through MegaBiz Token for the following purposes:
1. Providing and operating MegaBiz Token functionality;
2. Authenticating and/or authorizing Customers within the MegaBIZ Service;
3. Registering and activating MegaBiz Token;
4. Ensuring application compatibility with the device’s operating system;
5. Conducting device security checks;
6. Preventing the use of MegaBiz Token on insecure devices;
7. Preventing unauthorized access or use;
8. Supporting fraud prevention;
9. Maintaining the security of the MegaBIZ Service and MegaBiz Token;
10. Maintaining and improving the security of MegaBiz Token; and
11. Fulfilling Bank Mega’s obligations under applicable laws and regulations.
Customer Obligations When Using MegaBiz Token
1. Download MegaBiz Token only through Bank Mega’s official channels;
2. Maintain the security of the device used for MegaBiz Token;
3. Use a device that meets the applicable security requirements;
4. Do not root or jailbreak the device used for MegaBiz Token;
5. Do not give unauthorized parties access to the device;
6. Keep credentials confidential, including User ID, Password, Token, challenge code, response code, and other credentials; and
7. Promptly notify Bank Mega if the device is lost, stolen, or suspected of having been misused by an unauthorized party.
Use of MegaBiz Token
The MegaBiz Token application is available for download from:
1. Google Play Store, for Android devices; and
2. Apple App Store, for iOS devices.
Customers must ensure that the application they download is the official MegaBiz Token application published by Bank Mega. Bank Mega is not responsible for applications purporting to be MegaBiz Token that are obtained from unofficial sources.

Customers are not permitted to download or install MegaBiz Token from:
1. Unofficial websites;
2. Links sent by unauthorized parties;
3. APK files obtained from sources other than Google Play Store or Apple App Store; or
4. Any other source not designated by Bank Mega.
Use of Third-Party Services
In providing MegaBiz Token, Bank Mega may use third-party technologies, software components, libraries, or services necessary to support the application’s functionality and security.

If a Third Party Processes Personal Data on behalf of Bank Mega, Bank Mega ensures that such processing is carried out in accordance with applicable Personal Data protection requirements and the agreement established between Bank Mega and the Third Party.
Data Retention
Bank Mega retains Personal Data and information related to MegaBiz Token only for as long as necessary to fulfill the purposes of processing, maintain service security, meet audit requirements, comply with legal and regulatory obligations, and resolve disputes or fulfill other legal obligations.

Personal Data or information that is no longer required will be deleted, destroyed, or anonymized in accordance with Bank Mega’s retention policy and applicable laws and regulations.
Changes to the Privacy Policy
Bank Mega may amend, update, and/or add to some or all provisions of this Privacy Policy in line with its future business strategies and policies and/or changes in laws and regulations. If this Privacy Policy is amended, updated, or supplemented, Bank Mega will notify you through communication channels designated by Bank Mega.

Bank Mega encourages you to review this Privacy Policy periodically to ensure that you are aware of any changes made to it.

REFERENCES

The Personal Data Protection Law, Bank Indonesia Regulations (PBI), Financial Services Authority Regulations (POJK), and other applicable laws and regulations.