M-SMILE APP SERVICE PRIVACY POLICY

PT Bank Mega, Tbk, located at Menara Bank Mega, Jl. Kapten P. Tendean 12-14A, Jakarta 12790, Indonesia, hereinafter referred to as “Bank Mega,” is the entity responsible for processing Personal Data for Bank Mega Services.

In connection with the provision of Bank Mega’s Mobile Banking Application Service (“M-Smile”), Bank Mega acts as the Data Controller for the Personal Data you submit through M-Smile. All processing of Personal Data within the M-Smile Service is conducted in accordance with the provisions of laws and regulations regarding Personal Data Protection as well as other applicable banking regulations.

This M-Smile Privacy Policy explains how Bank Mega collects, stores, uses, and shares your Personal Data when you use the M-Smile Service, including information about the device on which M-Smile is installed on your mobile device. For further details on how Bank Mega processes customers’ Personal Data, you can access Bank Mega’s Privacy Policy via the following links:https://bankmega.com/id/privacy-policy/ .

Use of Terms

The terms used in this Privacy Policy are defined as follows:

Bank Mega refers to PT Bank Mega Tbk;
Personal Data refers to data about an individual who can be identified either individually or in combination with other information, either directly or indirectly, through electronic or non-electronic systems;
Services are:
1. Banking services provided by Bank Mega encompass all services and products, including but not limited to deposits, loans, investment products, bancassurance, credit cards, treasury services, internet banking, mobile banking, custodial services, and other banking services;
2. Websites, features, applications, social media, or other forms of communication media provided or used by Bank Mega; and
3. All activities carried out by Bank Mega in connection with the provision of banking services and/or the conduct of Bank Mega’s operations;
Personal Data Processing refers to the activities of obtaining, collecting, processing, analyzing, storing, correcting, updating, disseminating, displaying, announcing, transferring, disclosing, deleting, and destroying Personal Data;
Third Party means any party that has a cooperative relationship with Bank Mega, including business partners, vendors, outsourcing companies, and/or other parties;
“You” refers to all owners of Personal Data (Data Subjects) who use the Services, including but not limited to Bank Mega customers and individuals designated and/or authorized to represent customers, users of Bank Mega’s website or application, employees or job candidates, and Third Parties associated with Bank Mega;
The Personal Data Protection Act, or PDP Act, refers to Law No. 27 of 2022 on Personal Data Protection, along with its implementing regulations and any amendments enacted from time to time.

This Privacy Policy covers the following matters:

A. ACQUISITION AND COLLECTION OF PERSONAL DATA

In collecting Personal Data for the provision of the M-Smile Service, Bank Mega always complies with the provisions of laws and regulations regarding Personal Data Protection, including but not limited to the provisions of the PDP Law, Bank Indonesia Regulations (PBI), and Financial Services Authority Regulations (POJK).

Bank Mega collects Personal Data from your device when you use or access the M-Smile Service. The Personal Data collected by Bank Mega includes, but is not limited to:

App Analysis and Usage: Bank Mega collects information about your use of M-Smile, including login details, preferences, activity logs, IP addresses, and online activity data.
Device Information: Bank Mega collects information about the applications installed on your device to check whether you may have any high-risk applications. This helps Bank Mega protect you from cybercrime and detect unusual or suspicious activity.
Biometric Information: You can use biometric authentication to log in to M-Smile and authenticate your requests. If you do so, Bank Mega will rely on device technology and third-party facial recognition technology to verify and authenticate your identity. Bank Mega collects information about your physical interactions with the device, including the screen. This allows Bank Mega to check for unusual or suspicious activity on your device to detect suspicious activity.
Location Data: Bank Mega may collect information related to your device’s estimated location to help you customize the M-Smile interface based on your location within the app. If you choose not to enable location services, you may not be able to use certain features.
Mobile/Wi-Fi Data: Bank Mega collects information related to your access to M-Smile, such as information regarding the Wi-Fi or mobile networks used by your device. This allows Bank Mega to use your internet connection to access Bank Mega’s digital banking system.
Notification Settings: This allows you to receive instant notifications from M-Smile regarding activity on your account or offers and promotions.

B. YOUR RIGHTS AND OBLIGATIONS

Your Rights
As a Data Subject, you have the right to:

Obtain information regarding the identity of the data controller, the legal basis for processing, the purpose of the request and the use of Personal Data, as well as the accountability of the party requesting the Personal Data;
Complete, update, and/or correct errors and/or inaccuracies in your Personal Data in accordance with the purposes of Personal Data processing;
Access and obtain a copy of your Personal Data in accordance with applicable laws and regulations;
To cease the processing, delete, and/or destroy Personal Data about yourself in accordance with the provisions of applicable laws and regulations;
Withdraw the consent for the processing of your Personal Data that you have previously granted to Bank Mega;
To object to decision-making actions based solely on automated processing, including profiling, that result in legal consequences or have a significant impact on the Data Subject;
To suspend or restrict the processing of Personal Data in a manner proportionate to the purpose of such processing;
Obtaining and/or using Personal Data about yourself from Bank Mega in a form that conforms to commonly used structures and/or formats or is readable by electronic systems; and
Using and transmitting Personal Data about yourself to other Personal Data Controllers, provided that the systems used can communicate securely with one another in accordance with the principles of Personal Data Protection as stipulated by applicable laws and regulations.

To exercise your rights, you may contact MegaCall at 0804-1500-010 or visit the nearest Bank Mega branch. Bank Mega will consider each of your requests while taking into account all applicable laws and regulations and Bank Mega’s legitimate legal interests.

Your Obligations

You are responsible for actively ensuring the accuracy of your Personal Data. You are required to notify Bank Mega and request that it correct, complete, and/or update your Personal Data. In the event of inaccuracies in the Personal Data you provide, and after making reasonable efforts, Bank Mega reserves the right to suspend the Services and/or reject transaction requests.
You are also responsible for maintaining the confidentiality of your Personal Data—including information regarding your username, password, email address, and One-Time Password (OTP)—from anyone, as well as for always maintaining and being responsible for the security of the devices you use.

C. PURPOSES OF PERSONAL DATA PROCESSING

Bank Mega will collect, use, and share your Personal Data to provide the M-Smile Service to you. Bank Mega also uses your Personal Data for other purposes, including:

Verifying your identity and managing our relationship with you, including to notify you of M-Smile updates;
Facilitating payment requests and executing your instructions within M-Smile;
Ensuring network and information security, including monitoring user access to our Application to prevent cyberattacks, unauthorized use of Bank Mega’s systems and applications, crime prevention and detection, and the protection of personal information;
Preventing, detecting, and investigating suspicious, fraudulent, criminal, or other activities that may cause harm to you, Bank Mega, our business partners, or other parties, including those related to Bank Mega’s Services;
Determining whether you are eligible for the loan products or facilities you have applied for or inquired about with Bank Mega;
Sending you information about products and services that may interest you, including those offered by Bank Mega’s business partners;
To identify, register, and manage your profile as an M-Smile user, including conducting the Know Your Customer (KYC) process;
Managing, operating, and providing the services you request or processing the transactions you instruct;
To send you information regarding M-Smile services, including promotional offers, product information, app updates, and other information that Bank Mega deems important for you;
Preventing, detecting, investigating, and addressing any illegal, prohibited, unauthorized, or fraudulent activities that may occur, including but not limited to fraud, embezzlement, theft, and money laundering;
Resolving complaints you submit regarding the use of M-Smile;
To communicate with you regarding all matters pertaining to the M-Smile Service; and
To support future business activities and other Services after obtaining your consent.

Under certain conditions, before accessing features or information stored on your device, Bank Mega will first request your consent through the permission mechanism available on the Android or iOS operating systems. Bank Mega only accesses device information and personal data necessary to provide services, ensure transaction security, prevent fraud, fulfill legal obligations, and improve service quality.

The table below explains the information collected by Bank Mega from the device you use to access M-Smile, along with the purposes for which it is used.

App Permissions	Purpose of Permission
Internet Connection	Connects the M-Smile app to Bank Mega’s system for authentication, viewing account information, conducting transactions, and using all M-Smile services.
Internet Connection Check	To ensure the device has an active internet connection so that transactions can be processed properly.
Network Connection	Checks the status of the network used by the device as part of the communication process with the Bank Mega system and helps maintain service stability.
Camera	Taking photos of identification documents, scanning QRIS codes, performing identity verification (e-KYC), facial recognition, or using other features that require camera access.
Photo Gallery	Allows you to use photos or documents stored on your device to upload them to the app, such as supporting documents or transaction receipts.
Device Storage	Save or retrieve documents, transaction reports, payment receipts, or other files you select through the app.
Biometric Authentication	Allows you to use fingerprint or face recognition available on your device for authentication and/or to approve transactions. Biometric data is managed by the device’s operating system and is not stored by Bank Mega.
Notifications	Sends notifications regarding transactions, account activity, security information, OTPs, and other service-related information. To send these notifications, the M-Smile service may deliver notifications issued by the notification service provider being used.
Device Status	Checking specific statuses on your device, which are necessary to support app security, detect unusual activity, and prevent fraud.
Location (if enabled)	Used to enhance transaction security, detect unusual activity, comply with regulatory requirements, or provide location-based services when available.
Near Field Communication (NFC)	Enables the use of Near Field Communication (NFC)-based payment features, such as Tap to Pay or QRIS Tap.

If you do not grant permission or do not allow Bank Mega to process your Personal Data or access information on your device, Bank Mega will not be able to grant you access to the M-Smile Service, the app’s functionality may not work fully, or you may not be able to access other products and services offered by Bank Mega from time to time.

D. WITH WHOM BANK MEGA SHARES YOUR PERSONAL DATA

Bank Mega may share your information with third parties that provide services to Bank Mega, such as vendors or service providers (including their employees, directors, officers, and other parties working for them), to the extent necessary to provide the products or services you request, such as account opening, payment services, or other banking services. Bank Mega may also share this information for other purposes as described in Bank Mega’s Privacy Policy at the following links:https://bankmega.com/id/privacy-policy/ .

Any Personal Data that Bank Mega provides to third parties is intended to provide services and will be handled with care while upholding the principles of Personal Data Protection. The parties that may be involved in processing your Personal Data for the provision of M-Smile Services include:

1. Third Parties

To support the operational activities of the M-Smile Service, Bank Mega may appoint third parties to process your Personal Data, including:

Providers of information technology, system security, data storage, and digital infrastructure services;
Support service providers that collaborate with Bank Mega to facilitate the provision of services to you. These third parties include, but are not limited to, those listed in Bank Mega’s Privacy Policy; and
In certain cases, these Third Parties may include switchingnetwork operators (both national and international), partner insurance companies, collection agencies, merchants or other partners, or other relevant financial service institutions, to the extent necessary for the provision of the M-Smile Service.

The disclosure of Personal Data to these third parties is limited, in accordance with the purposes of processing within M-Smile and based on cooperation agreements that require third parties to maintain confidentiality, security, and compliance with Personal Data Protection provisions in accordance with applicable laws and regulations.

2. Authorized Authorities/Law Enforcement Agencies and Regulators

Bank Mega may disclose your Personal Data to government authorities, law enforcement agencies, the Financial Services Authority (OJK), Bank Indonesia (BI), or other authorized institutions if required by applicable laws and regulations, or in order to fulfill Bank Mega’s legal obligations.

E. HOW LONG DOES BANK MEGA RETAIN YOUR PERSONAL DATA

Bank Mega will take all reasonable steps to ensure that your Personal Data is not retained longer than necessary. Bank Mega will use your Personal Data as described in this Privacy Policy to carry out activities related to the management and administration of your account, or to address any issues or problems that may arise.

Bank Mega may retain your Personal Data to comply with applicable laws or regulations, to help detect or prevent fraud and financial crimes, or to respond to and assist law enforcement agencies and regulatory authorities. If Bank Mega no longer requires your Personal Data, Bank Mega will anonymize or delete it.

Your Personal Data may also be stored by parties that officially collaborate with Bank Mega, both within and outside the territory of the Republic of Indonesia, while ensuring the security, confidentiality, and integrity of your Personal Data.

F. PERSONAL DATA SECURITY

In an effort to protect and secure your Personal Data from unauthorized processing, Bank Mega consistently strives to implement best practices and use electronic systems equipped with adequate security measures in accordance with the requirements of regulatory provisions and applicable laws and regulations, and Bank Mega may update these security measures from time to time.

In the event of unauthorized access to or illegal activities involving your Personal Data that are beyond Bank Mega’s control, Bank Mega will notify you as soon as possible so that you can mitigate the risks arising from such incidents.

The security of your account also depends on how you maintain the confidentiality of your account password, Personal Identification Number (PIN), and other access information, including if you share your account information with another party and that party is able to access your account and Personal Data.

G. CHANGES TO THE PRIVACY POLICY

Bank Mega may amend, update, and/or add to some or all of the provisions in this Privacy Policy, in accordance with Bank Mega’s future business strategies and policies and/or changes in laws and regulations. If this Privacy Policy is amended, updated, or supplemented, Bank Mega will notify you through the communication channels designated by Bank Mega.

Bank Mega urges you to review this Privacy Policy periodically to ensure you are aware of any changes made to it.

REFERENCES

The Personal Data Protection Act, Bank Indonesia Regulations (PBI), Financial Services Authority Regulations (POJK), and other applicable laws and regulations.