Privacy Policy Online Government Securities (SBN) Service PT Bank Mega Tbk

PT Bank Mega Tbk (“Bank Mega”) is committed to protecting Investors’ Personal Data in connection with orders to purchase Government Securities (“SBN”) through the Bank Mega M-Smile application or https://sbnonline.bankmega.com (the “Service”). In providing the Service, Bank Mega, as a Distribution Partner, acts as the Personal Data Controller for the processing of Personal Data, determining the purposes and means of processing, including user account management, collection and verification of investor data and documents for purchase orders, reporting sales results to the Government, managing electronic system security, and fulfilling Bank Mega’s obligations as a Distribution Partner under applicable laws and regulations.

In conducting marketing and/or offering activities for SBN in the Domestic Primary Market, Bank Mega, as a Distribution Partner appointed by the Government, may cooperate with Sub-Distribution Partners. In such cooperation, Personal Data of prospective Investors and/or Investors is processed to the extent necessary for marketing, offering, product information delivery, registration facilitation, and/or other supporting activities, in accordance with the scope of cooperation and a lawful processing basis.

This Service supports purchase orders for retail SBN issued by the Government, including Government Bonds (“SUN”) and/or Government Sharia Securities (“SBSN”), according to the available SBN types and Bank Mega’s role as a Distribution Partner. Investor requirements, offering periods, orders, payments, settlement, and product terms are governed by the regulations applicable to each SBN series.

This Policy shall be read and understood together with the Service terms and conditions, transaction documents, and Bank Mega User information and privacy policies.

The terms used in this Privacy Policy are defined as follows:

Personal Data means data about an individual who can be identified individually or in combination with other information, directly or indirectly, through electronic or non-electronic systems;
Corporate Data means data relating to an identifiable legal entity or business entity, processed by Bank Mega insofar as relevant to the provision of the Service.
Investor means an Indonesian citizen (WNI) whose name is recorded in the Central Registry and Sub-Registry as the owner of SBN.
Domestic Investor means an Indonesian individual, company, joint venture, association, or organized group, whether Indonesian or foreign, established or domiciled in the territory of the Republic of Indonesia and meeting the domestic criteria in the third digit of the Single Investor Identification (SID) code.
Distribution Partner means a bank, securities company, financial technology company, and/or electronic-system-based trading operator appointed by the Government to assist in marketing, offering, and/or selling Retail SBN to prospective investors.
Mega Smart Mobile or M-Smile means Bank Mega’s mobile application/digital banking service that customers can download and install on smartphones to access their banking products and services.
Sub-Distribution Partner means another party cooperating with Bank Mega as a Distribution Partner in marketing, offering, and/or selling Retail SBN to prospective investors, within the scope of cooperation and applicable authority.
Domestic Primary Market means the first-time offering and sale of Retail SBN conducted within the territory of the Republic of Indonesia.
The Central Government, hereinafter referred to as the Government, means the President of the Republic of Indonesia, who holds the governmental authority of the Republic of Indonesia assisted by the Vice President and ministers as referred to in the 1945 Constitution of the Republic of Indonesia.
Purchase Order means an Investor’s submission of an order to purchase SBN in the Domestic Primary Market during a specified offering period, in accordance with the applicable SBN terms and requirements.
Personal Data Processing means any action performed on Personal Data, including collection, use, storage, disclosure, updating, deletion, and destruction.
User means an investor or prospective investor who accesses the Service and/or submits an SBN order.
Single Investor Identification or SID means a unique and specific code issued by PT Kustodian Sentral Efek Indonesia (KSEI), as the central securities depository and settlement institution, which investors use under applicable regulations to conduct securities-related transactions and/or use other services provided by KSEI or other parties with KSEI’s approval or under applicable regulations.
Government Securities or SBN means securities issued by the Government of the Republic of Indonesia, including Government Bonds and Government Sharia Securities.
Personal Data Subject means an individual whose Personal Data is processed.

This Privacy Policy forms an integral part of the Bank Mega Online SBN Registration Terms and Conditions.

This Privacy Policy covers the following:

I. COLLECTION OF PERSONAL DATA

Bank Mega may obtain Users’ Personal Data directly from Users or their authorized representatives, as well as from other lawful sources in accordance with applicable laws and regulations.

Sources of Personal Data may include:

Data provided by Users when accessing the Service, undergoing verification, submitting SBN orders or transactions, or communicating with Bank Mega.
Relevant Bank Mega internal systems, where necessary and supported by a lawful processing basis.
Parties involved in ordering, administration, settlement, payment, and reporting of SBN transactions, within their respective authorities.
Government agencies, regulators, or competent authorities; or
Logs and technical records generated when the Service is used.
Sub-Distribution Partners or other parties cooperating with Bank Mega in marketing and/or offering Retail SBN, provided that Personal Data is lawfully obtained and shared in accordance with the stated processing purposes and applicable laws and regulations.

Bank Mega processes Personal Data in accordance with the processing purposes, lawful processing basis, Personal Data Protection requirements, and relevant regulations.

II. PURPOSES OF PERSONAL DATA PROCESSING

Bank Mega will process Users’ Personal Data to provide and operate the Service, including but not limited to the following purposes, and other purposes permitted under applicable laws and regulations:

Providing access to the Service and facilitating orders and transactions for available retail SBN.
Verifying and ensuring the accuracy and conformity of Users’ data and/or information in accordance with Bank Mega’s obligations as a Distribution Partner.
Processing Users’ Retail SBN order and transaction instructions;
Providing information on the status of Retail SBN orders or transactions;
Reporting by Bank Mega, as a Distribution Partner, to the Ministry of Finance or other competent authorities as required;
Complying with legal obligations, including requirements relating to the Ministry of Finance, banking, consumer protection, Personal Data protection, and anti-money laundering;
Maintaining the security of accounts, systems, infrastructure, documents, and information in providing the Service;
Detecting, preventing, and addressing misuse of the Service, fraud, unauthorized transactions, and security incidents;
Securing electronic systems and networks, updating systems, detecting misuse, and handling incidents and complaints;
Maintaining, testing, and proportionately improving the quality of the Service;
Conducting marketing and/or offering of Retail SBN through Bank Mega and/or Sub-Distribution Partners cooperating with Bank Mega, including providing product information, communicating with prospective investors, facilitating registration and orders, coordinating marketing activities, and administering and reporting marketing and/or offering activities for Retail SBN, within the scope of cooperation and on a lawful Personal Data processing basis.

III. TYPES OF PERSONAL DATA COLLECTED

For the provision of the Service, Bank Mega may collect and process the following categories of Personal Data:

User identity data, including full name, nationality, place and date of birth, national identity number (NIK), or other required identification;
Contact data, including residential or correspondence address, telephone number, email address, and other contact information provided by Users;
Account, investment, and transaction information, including order details, SBN series/type, amount, order and payment status, allocation results where applicable, settlement, and payment of returns/coupons and principal according to the product; SID, securities account data, or other administration information where necessary and in accordance with applicable product requirements;
Service access, security, and technical data, including account identity, authentication records, access time, IP address, device information, activity logs, and data used to secure and maintain the Service systems;
Communication and complaint data, including correspondence, information requests, supporting documents, service records for Users, and relevant complaint information;
Data relating to the source or marketing activities through Sub-Distribution Partners, such as partner referral information or marketing communication records, where collected and necessary for a lawful processing purpose.

IV. LEGAL BASIS FOR PERSONAL DATA PROCESSING

Bank Mega determines a lawful processing basis for each Personal Data processing activity related to the Service in accordance with the Personal Data Protection Law and other applicable provisions. The processing bases may include:

Performance of an agreement or provision of a Service requested by the User;
Compliance with Bank Mega’s legal obligations as a bank and/or Distribution Partner;
Performance of duties in the public interest or public service in connection with Bank Mega’s role as a Distribution Partner in offering and/or selling Retail Government Securities (SBN), pursuant to the Government’s appointment and applicable provisions;
Protection of the vital interests of the Personal Data Subject, where necessary to protect User safety in certain circumstances and subject to applicable legal requirements;
Other legitimate interests permitted under Personal Data protection provisions, after considering the relevant purposes, necessity, and balance of interests;
Valid consent from the User where consent is required as the processing basis.

V. DISCLOSURE OF PERSONAL DATA

Personal Data may be disclosed or access may be granted to other parties as necessary for the purposes described in this Privacy Policy, including:

The Ministry of Finance of the Republic of Indonesia, including units authorized to handle the issuance and sale of SUN/SBSN, for sales processes and reporting.
Bank Indonesia, the Financial Services Authority (OJK), PPATK, law enforcement agencies, or competent authorities in accordance with their authority and applicable laws.
Parties involved in the creation of Bond SID, securities accounts, custody, administration, settlement, payment, or secondary-market trading, where relevant.
Technology, data center, information security, application maintenance, communication, and support service providers under appropriate arrangements.
Sub-Distribution Partners or other parties cooperating with Bank Mega in marketing, offering, and/or selling Retail SBN, where disclosure or access to Personal Data is necessary for lawful cooperation. Disclosure or access is limited to the processing purpose, scope of authority, and needs of the cooperation. Processing and disclosure arrangements with such parties are set out in cooperation agreements and/or appropriate Personal Data processing or sharing arrangements, consistent with each party’s roles and responsibilities and applicable provisions.
Other parties required or permitted to receive data under laws and regulations.

Bank Mega makes disclosures on a lawful processing basis and limits disclosures to Personal Data relevant to the recipient’s purpose and authority.

VI. PERSONAL DATA TRANSFERS

Where the Service involves recipients of Personal Data located outside the territory of the Republic of Indonesia, Bank Mega may transfer Personal Data outside Indonesia insofar as necessary to provide the Service and in accordance with applicable laws and regulations.

Bank Mega ensures that such transfers meet cross-border Personal Data transfer requirements, including requirements for an equivalent or higher level of Personal Data protection, adequate and binding Personal Data protection, or User consent where required under applicable laws and regulations.

Users may request information regarding relevant transfers of Personal Data outside Indonesia through Bank Mega’s official communication channels designated for Personal Data protection inquiries, insofar as such information may be provided in accordance with applicable laws and regulations.

VII. RETENTION OF PERSONAL DATA

Bank Mega will retain Personal Data for as long as necessary to fulfill the processing purposes in providing the Retail SBN ordering service through the Service system, maintaining the contractual relationship with Users in connection with the Service, complying with legal and regulatory obligations, processing orders and payments, administering Retail SBN ownership, handling complaints, and fulfilling Bank Mega’s legal obligations.

For documents and records relating to the provision of Retail SBN ordering services through the Service, Bank Mega may administer, store, and maintain them in accordance with applicable laws and regulations, including those relating to banking, Personal Data protection, archives, taxation, and other provisions relevant to the Service. Retention periods are determined based on the type of document and Personal Data, processing purposes, legal and regulatory obligations, transaction evidentiary needs, and complaint-handling requirements.

Where Personal Data is processed or stored by a Sub-Distribution Partner, retention periods, access, return, and/or deletion of Personal Data are governed by the processing purposes, scope of cooperation, applicable legal obligations, and agreements with the relevant party. Personal Data is not retained longer than necessary, unless required or permitted by laws and regulations.

VIII. PERSONAL DATA SECURITY

To protect and secure Users’ Personal Data from processing by unauthorized parties, Bank Mega continuously endeavors to implement procedures and use best-practice electronic systems equipped with an adequate level of security as required by regulators and applicable laws and regulations. Bank Mega will update such security measures from time to time.

In the event of illegal access to or activity involving Users’ Personal Data beyond Bank Mega’s control, Bank Mega will promptly notify Users at the earliest opportunity so that Users may mitigate the resulting risks.

The security of Service accounts also depends on Users maintaining the confidentiality of their account passwords and other access information. Furthermore, although Bank Mega uses its best efforts to secure and protect Personal Data, providing information over the internet entails security risks that are also part of the User’s responsibility.

Where Personal Data processing involves Sub-Distribution Partners or other parties cooperating with Bank Mega, risk-appropriate arrangements and controls are applied, including access restrictions, confidentiality obligations, secure Personal Data exchange, Personal Data retention and deletion arrangements, and Personal Data incident-handling mechanisms in accordance with each party’s roles and responsibilities.

IX. RIGHTS OF PERSONAL DATA SUBJECTS

Under applicable laws and regulations, Users as Personal Data Subjects may have the right to:

obtain information regarding the identity of the party requesting Personal Data, the legal basis of its interest, the purpose of use, and the accountability of the party requesting Personal Data;
complete, update, and correct errors or inaccuracies in Personal Data;
obtain access to and copies of Personal Data in accordance with applicable provisions;
terminate processing, delete, and/or destroy Personal Data in accordance with applicable legal requirements;
withdraw consent to Personal Data processing where processing is based on consent;
object to decisions based solely on automated processing, including profiling, where legal requirements are met;
suspend or restrict Personal Data processing in accordance with applicable provisions;
obtain and/or use Personal Data and request transfer of Personal Data to another Personal Data Controller, subject to legal requirements; and
submit complaints or claims and obtain remedies for violations of Personal Data processing in accordance with applicable provisions.

Bank Mega will follow up on requests to exercise Personal Data Subject rights in accordance with procedures, identity verification requirements, time limits, and restrictions stipulated by laws and regulations.

The exercise of such rights may be restricted where there is a lawful basis, including document retention obligations, reporting obligations, crime prevention, law enforcement interests, or other grounds permitted under applicable provisions.

To submit a request to exercise Personal Data Subject rights, Users may contact MegaCall at 08041500010 or visit the nearest Bank Mega branch. Bank Mega will consider each User request in accordance with all applicable laws and regulations and Bank Mega’s legitimate interests.

X. UPDATES TO THE PRIVACY POLICY

Bank Mega may update this Privacy Policy from time to time to reflect changes in services, business processes, technology, or laws and regulations.

Updates to this Privacy Policy will be communicated through Bank Mega’s official channels designated for this purpose. Where required by applicable provisions, Bank Mega will notify Users of relevant changes.

XI. REFERENCES

Law No. 27 of 2022 on Personal Data Protection; Minister of Finance of the Republic of Indonesia Regulation No. 94 of 2025 on the Sale of Government Bonds through Bookbuilding in the Domestic Primary Market, Minister of Finance Regulation Number 195/PMK.08/2020 of 2020 concerning the Auction of Sharia Securities in the Domestic Primary Market, Bank Indonesia Regulations (PBI), Financial Services Authority Regulations (POJK) and other applicable laws and regulations.