Bank Mega CRIA Application Privacy Policy

PT Bank Mega Tbk - Credit Reporting Integrated Apps (CRIA) Privacy Policy

PT Bank Mega Tbk is committed to protecting the Personal Data of users of the Credit Reporting Integrated Apps (CRIA), which can be accessed through https://cria.bankmega.com.

This Privacy Policy governs the collection, processing, disclosure, storage, security, and protection of Personal Data. Bank Mega asks all Users to read and understand this Privacy Policy before using the Application.

When using the Credit Reporting Integrated Apps (CRIA), Bank Mega acts as the Personal Data Controller, determining the purposes of and exercising control over the processing of Personal Data in accordance with applicable laws and regulations, particularly Law No. 27 of 2022 on Personal Data Protection.

A. Definitions and Terms

1. Bank Mega refers to PT Bank Mega Tbk, acting as the Personal Data Controller.
2. CRIA Application (Application) means Bank Mega’s Credit Reporting Integrated Apps system, used by authorized stakeholders to prepare, monitor, and manage credit facility pipelines online and in real time.
3. User (You) means an internal Bank Mega employee who is registered and granted official access rights to use the Application in the performance of their official duties.
4. Personal Data means data about an identified or identifiable natural person, either independently or in combination with other information, directly or indirectly, through electronic or non-electronic systems.
5. Corporate Data means data relating to an identifiable legal entity or business entity that is processed by Bank Mega insofar as it is relevant to the operation of the Application.
6. Prospective Borrower/Borrower means a third party (natural person) whose Personal Data is collected and processed in the Application for the purposes of applying for, assessing, and granting Bank Mega credit facilities.
7. Personal Data Processing includes the collection, gathering, use, analysis, storage, correction, updating, display, announcement, transfer, dissemination, deletion, and/or destruction of Personal Data.

B. Collection and Types of Personal Data Collected

Bank Mega collects and processes Personal Data within a limited and relevant scope in accordance with the data minimization principle:

1. User (Employee) Personal Data

Obtained directly from You or through Bank Mega’s Human Capital System, including:

1. Full name;
2. Employee Identification Number (NIP);
3. Position and work unit, pangkat;
4. Official corporate email address; and
5. Activity log data (access logs, IP address, and system transaction audit trails).

2. Third-Party Personal Data (Prospective Borrower)

Obtained by You and entered into the Application from prospective borrowers directly through a referral program or other lawful sources, including:

1. Civil identity data (full name, Population Identification Number/NIK);
2. Contact information (residential address, telephone number, and email address);
3. Financial and tax information (Taxpayer Identification Number/NPWP, bank account, income slips, and credit facility history); and
4. Other relevant information required to assess eligibility for credit facilities and comply with banking regulations.

Bank Mega processes such Personal Data in accordance with the specified processing purposes, while observing Personal Data protection principles and the rights of Personal Data Subjects.

C. Purposes of Personal Data Processing

Bank Mega will process Users’ Personal Data for the use and operation of the Application, including but not limited to the following purposes:

1. To support the integrated management, review, monitoring, and evaluation of the credit pipeline—from receiving referrals and credit risk analysis through application, approval, and determination of credit facilities.
2. To facilitate coordination across Bank Mega’s operational and business units, and to monitor the achievement of credit disbursement (booking) targets transparently and accountably.
3. To support administrative management, troubleshooting, and operational audits of the credit-granting process.
4. To fulfil banking reporting and compliance obligations, including implementation of Know Your Customer (KYC) principles, fraud prevention, and Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) programs.

D. Legal Bases for Personal Data Processing

Bank Mega uses Your Personal Data as an Application User to fulfil its contractual obligations to You as an employee, particularly to support the performance of day-to-day duties in granting credit facilities to prospective borrowers/borrowers in accordance with applicable laws and regulations, including:

1. Employment Contract Necessity: To support the performance of Your official duties and professional obligations as a Bank Mega employee.
2. Legal Obligation: To comply with laws and regulations in the banking sector, regulations of the Financial Services Authority (OJK), and Bank Indonesia.
3. Valid Consent (Explicit Consent): Consent obtained from prospective borrowers in connection with the collection and verification of their Personal Data for the processing of credit facilities.
4. Legitimate Interests: To maintain the operational efficiency of the internal credit system, manage banking risks, and prevent fraudulent activities.

E. Disclosure and Sharing of Personal Data

1. Role-Based Internal Access (Role-Based Access Control): Access to data within the Application is strictly limited to Bank Mega officers and employees with operational authorization, on a need-to-know basis, to perform evaluation, credit analysis, compliance, and audit functions.
2. External Parties: Bank Mega will not sell or share Personal Data with unauthorized third parties, except where required by law or pursuant to an official order from a competent authority, such as OJK, Bank Indonesia, law enforcement authorities, or a competent court.

F. Transfer of Personal Data

If the operation of the Application involves a recipient of Personal Data located outside the territory of the Republic of Indonesia, Bank Mega may transfer Personal Data outside the territory of the Republic of Indonesia where necessary for the operation of the Application and in accordance with applicable laws and regulations.

Bank Mega ensures that such transfers of Personal Data meet the requirements for cross-border transfers, including requirements for a level of Personal Data protection that is equivalent to or higher than the applicable standard, adequate and binding Personal Data protection safeguards, or consent from You or the Third Party where required by applicable laws and regulations.

Information regarding transfers of Personal Data outside the territory of the Republic of Indonesia that are relevant to use of the Application may be provided to You through Bank Mega’s official communication channels designated for Personal Data protection inquiries, to the extent permitted under applicable laws and regulations.

G. Storage of Personal Data

Bank Mega is committed to storing Personal Data in secure electronic systems for as long as necessary to achieve the processing purposes, while You maintain an active account, and for the retention period stipulated in Bank Mega’s internal policies and the laws and regulations applicable in the Republic of Indonesia.

H. Security of Personal Data

To protect and secure Your Personal Data against access by unauthorized parties, Bank Mega continually endeavours to implement appropriate procedures and use electronic systems with adequate security measures, as required by regulators and applicable laws and regulations. Bank Mega will update these security measures from time to time.

If unauthorized or unlawful access to Your Personal Data occurs outside Bank Mega’s control, Bank Mega will notify You as soon as possible so that You can mitigate the risks arising from such incident.

The security of Your Application account also depends on how You maintain the confidentiality of Your account password and other access information. Providing information over the internet entails security risks for which You also bear responsibility.

I. Rights of Personal Data Subjects

As Personal Data Subjects, Users and Third Parties have rights guaranteed by applicable laws and regulations, including the right to access, correct errors in, update, cease the processing of, or request deletion of Personal Data, and to withdraw consent to Personal Data processing.

Bank Mega may refuse to fulfil these rights in whole or in part where doing so would conflict with banking legal obligations, national defence or security interests, law enforcement processes, or other lawful exceptions under applicable laws and regulations.

J. Contact Us

If You have any questions regarding this Privacy Policy, You may contact Bank Mega by email at: cria@bankmega.com

K. Updates to this Privacy Policy

This Privacy Policy may be amended or updated from time to time to reflect developments in business processes, technology infrastructure, or changes in laws and regulations. Changes will be announced through the Application portal or Bank Mega’s official internal communication channels.

L. User Responsibilities and Acknowledgements

By accessing and operating the Application, You represent and agree that:

1. You have read, understood, and will comply with this Privacy Policy in its entirety.
2. If You enter the Personal Data of prospective borrowers/third parties into the Application, You are responsible for ensuring that such data has been obtained lawfully and is true and accurate, and that a valid legal basis for processing has been established (including consent to obtain the data from the prospective borrower), in accordance with Bank Mega’s credit governance and the Personal Data Protection Law.
3. You must maintain the confidentiality of all customer data accessed through the Application and must not misuse such data for purposes outside Bank Mega’s credit-related official duties.

M. References

Law No. 27 of 2022 on Personal Data Protection, Bank Indonesia Regulations (PBI), Financial Services Authority Regulations (POJK), and other applicable laws and regulations.