1. DEFINITIONS
1.1 “BANI” is the Indonesian National Arbitration Board (Badan Arbitrase Nasional Indonesia) that was established by the Indonesian Chamber of Commerce and Industry (Kamar Dagang dan Industri Indonesia) in accordance with Decree of the Indonesian Chamber of Commerce and Industry No. SKEP/152/DPH/1977 dated 30 November 1977, which on the Signing Date has an address at Wahana Graha 1st & 2nd floors, Jl. Mampang Prapatan No. 2, Jakarta 12760, Indonesia.
1.2 “Child” is any individual who is under 18 years old and unmarried.
1.3 “Company” is PT Central Sudirman Development.
1.4 “data subject” means an individual with whom the personal data is associated.
1.5 “Dispute” is any and all difference, controversy, or dispute arising out of or in connection with this PDP Notice, including any question regarding its existence, validity, interpretation, and/or implementation.
1.6 “PDP Regulations” are laws and regulations regarding personal data protection applicable in the Republic of Indonesia, including but not limited to Law No. 27 of 2022 on Personal Data Protection, and other relevant laws and regulations governing personal data protection, each of which as may be amended, supplemented, modified, suspended, replaced, or restated from time to time.
1.7 “People with Disabilities” is every individual who has physical, sensory, intellectual, and/or mental health impairments for a long period of time who in interacting with the environment may experience obstacles and difficulties to participate fully and effectively with other citizens based on equal rights. This includes but is not limited to individuals with mobility impairments, visual impairments, hearing impairments, cognitive disabilities, and mental health conditions.
1.8 “personal data” is data about an identified or identifiable individual, either on its own or in combination with other information, whether directly or indirectly, through electronic or non-electronic systems. Data where the identity has been removed (anonymised data) is not included in the classification of personal data.
1.9 “processing” or “process” or “processed” is an event where the Company obtains, collects, records, uses, analyses, displays, announces, discloses, processes, opens access to, stores, corrects and updates, disseminates, transfers, provides, shares, manages, organises, deletes, destroys, and/or protects your personal data.
1.10 “you” are data subjects who are:
-
(a) individual customers of the Company, whether active customers, prospective customers, or existing customers who no longer use the Company’s services;
-
(b) employees, officers, representatives, shareholders, directors, contractors, agents, beneficiaries, heirs, or other related individuals of the Company’s legal entity customers or individual customers as mentioned in point (a) above, or a group of people, whether directly or indirectly interacting with the Company, whether as active customers, prospective customers, or existing customers who no longer use the Company’s services;
-
(c) other individuals who interact with the Company other than those mentioned in points (a) and (b) above, such as individuals who visit us through our website, our marketing offices, and individuals who make inquires, reports, or complaints; or
-
(d) the individuals mentioned in points (a), (b), and (c) above, who could be a Child, People with Disabilities, or both.
2. PERSONAL DATA WE COLLECT FROM YOU
2.1 The personal data we collect directly from you (for example, when you communicate with our employees, marketing agents, visit our website, participate in our promotions, and/or contact us):
-
(a) identification information (e.g., name, age, gender, username, date of birth, and/or any other data required by us with respect to the provision of our services);
-
(b) contact details (e.g., address, phone number, and/or email address);
-
(c) records of communications between you and us and the personal data you provide to us through those communications (such as communications in the course of making requests, enquiries, reports, and/or complaints);
-
(d) device information and automatic information from our website and app servers (e.g., browser type, IP address, browsing patterns, the duration of time spent accessing our website); and/or
-
(e) images and videos from cameras (CCTV, Personal Camera, Hand Phone etc.) in our offices.
2.2 Some of your personal data that we collect may include specific personal data. Specific personal data under the PDP Regulations include data related to health, biometric data, genetic data, criminal record, financial data, and/or Child data.
2.3 We will only collect Child’s personal data if you, as our customer, provide your Child’s personal data. In any processing we conduct in relation to a Child’s personal data, we assume that the parent or guardian of the Child has taken the appropriate measures, including reading and understanding this PDP Notice.
2.4 If you do not provide the personal data we require, we may not be able to provide the services you want or fulfil all our obligations to you.
2.5 Other than as set out above and if not requested, please do not provide or disclose any of your personal data to us.
3. YOUR PERSONAL DATA THAT WE COLLECT FROM OTHER SOURCES
3.1 We may also collect your personal data from other sources, including:
-
(a) information on your interactions with us (e.g., through sales and marketing agents that cooperate with us and/or analytics program to monitor your activity on our website, your participation in our events, competitions, contents, and/or promotions); and/or
-
(b) your communications with us through certain methods (e.g., through social media).
3.2 We may collect your personal data from third parties, including our business partners and marketing agents (e.g., marketing agents who are not our employees and/or online advertising partners).
3.3 If you provide personal data of another individual (such as your family) to us, or you ask us to share their personal data with a third party, you hereby confirm that they have been informed and understand the information in this PDP Notice about how we will use their personal data.
4. PURPOSES AND LAWFUL BASES WE USE FOR PROCESSING
4.1 We process your personal data with the following lawful bases:
-
(a) to fulfil contractual obligations between us and you or to fulfil necessary matters to conclude an agreement with you;
-
(b) to fulfil the Company’s legal obligations in accordance with the provisions of laws and regulations;
-
(c) to fulfil legitimate interest of the Company; and/or
-
(d) when you have given explicit consent.
4.2 We process your personal data for the following purposes:
Purpose of using your personal data:
-
Communication and Customer Relations
-
To communicate with you;
-
To maintain and improve customer relationship;
-
To appropriately handle requests from you;
-
To send you seasonal greetings messages from time to time;
-
To send you invitation to join our events and promotions and product launch events; and/or
-
To respond to your enquiries or complaints and resolve any issues and/or disputes.
-
Product, Service, and Payment Administration
-
To assess, process and provide products, services and/or facilities to you;
-
To administer and process any payments related to products, services, and/or facilities requested by you; and/or
-
To send payment reminders, including notifications for instalment payments and any associated interest.
-
Marketing and Promotional Activities
-
To provide you with information and/or updates on our products, services, upcoming promotions, and events;
-
To conduct direct marketing via various communication channels;
-
To facilitate your participation in, and our administration of, any events including contests, competitions, and/or campaigns;
-
To monitor, review, and improve our events, promotions, products, and/or services; and/or
-
To receive periodic mails from us containing information on new collections, new products, new locations, or promotional offers or upcoming activities.
-
Data Analysis and Market Research
-
To analyse aggregated user information alongside other interactions users have with us, to continually improve our offerings;
-
To process and analyse your personal data either individually or collectively with other individuals; and/or
-
To conduct market research or surveys, internal marketing analysis, customer profiling activities, analysis of customer patterns and choices, planning and statistical and trend analysis.
-
Legal, Compliance, and Security
-
To use for various legal and compliance purposes, such as audit, risk management, enforcing rights, complying with legal obligations, and making disclosure under applicable laws and regulations.
-
Personalisation and User Experience
-
To tailor our website to your interests and ensure that the content is presented in the most effective way for you; and/or
-
To provide location-based services (e.g., search results and personalised content).
-
Identity Verification and Security
-
Internal Administrative Purposes
-
Advertising
-
To allow third parties to serve relevant ads to you; and/or
-
To analyse aggregated user information alongside other interactions users have with us, to assist us in making decisions about the types of advertising we purchase.
4.3 If we ask for your consent to process your personal data, you may at any time object or withdraw such consent. In relation to your right to object or withdraw consent, please refer to Section 9 of this PDP Notice.
4.4 We may process your personal data for purposes other than those we have listed above. We will inform you of these purposes beforehand, such as through an update of this PDP Notice.
5. SHARING AND/OR DISCLOSURE OF YOUR PERSONAL DATA AND THE RECEIVING PARTIES
5.1 We will maintain the confidentiality of your personal data, but we may share your personal data with third parties (who must also keep your personal data secure and confidential) in certain circumstances, as follows:
Third Parties Receiving Your Personal Data and the Reasons:
-
Our Affiliated Companies: We may share certain information with these affiliated companies for purposes such as internal reporting or analysis, including compliance obligations (e.g., adhering to data protection laws, financial reporting requirements, other regulatory standards and/or our internal procedures) in accordance with applicable laws and regulations in their respective countries.
-
Our Suppliers and/or Service Providers: These parties may include, for example, know-your-customer service providers and/or electronic signature service providers. We may also request third-party service providers acting on your behalf to share your personal data with our agents or subcontractors to provide the services you have requested. In the past, we have utilised such services to send letters and emails, reduce repetitive information from customer lists, analyse data, provide marketing assistance, and offer customer service.
-
Business Partners: We may share your personal data with our business partners who provide services together with us. We may also share your personal data with other service providers and agents who deliver services on behalf of our business partners.
-
Our Vendors (including their subcontractors): These parties may include, for example, insurance companies and financial auditor companies.
-
Assignees of Our Rights or Obligations: We may share your personal data with anyone who accepts any of our rights or obligations under the terms and conditions of the agreement you have with us.
-
Government Bodies: This may include bodies such as the Financial Transaction Reports and Analysis Center (Pusat Pelaporan dan Analisis Transaksi Keuangan/PPATK).
-
Law Enforcement Officials and Relevant Authorities: We may share your personal data with law enforcement officials and relevant authorities in Indonesia and overseas in relation to their duties, such as preventing crime (either directly or through third parties) or conducting social or economic statistical research.
6. TRANSFER OF YOUR PERSONAL DATA OUTSIDE OF INDONESIA
6.1 We may be required by the laws and regulations to send your personal data to certain parties to fulfil certain purposes.
6.2 Additionally, we may need to transfer your personal data outside of Indonesia, such as for business purposes to our affiliated companies or to service providers domiciled outside of Indonesia in order for those service providers to provide their services to us.
6.3 In sending your personal data overseas, please understand that the destination country may have different data protection regulations than Indonesia. In certain circumstances, the court, law enforcement officials, or regulatory bodies in such countries may have the right to access your personal data.
6.4 We will comply with the PDP Regulations and exercise all reasonable and sufficient measures, such as entering into a binding data transfer agreement with data recipients, or obtaining your explicit consent, to ensure that our overseas affiliates, business partners, joint ventures, and all such third parties provide a level of protection comparable to our commitments under this PDP Notice.
6.5 When transferring personal data to organisations in other countries, we will ensure that they agree to apply an equivalent level of personal data protection that we apply. Where it is not possible to ensure that the receiving party will uphold such level of personal data protection, we will ensure that the personal data is transferred in accordance with the applicable laws and regulations. Where a data protection authority does not consider certain countries to have an adequate level of personal data protection, we will establish appropriate safeguards (such as contractual safeguards), in accordance with the PDP Regulations, to ensure that your personal data is adequately protected.
7. AUTOMATED PROCESSING OF YOUR PERSONAL DATA
7.1 Our use of your personal data, including in the analysis we carry out in relation to our services, may involve profiling. This means that we may process your personal data (including specific/sensitive personal data) using software that can process your personal data and other factors to predict risks or outcomes. We may also use profiling or other automated methods to make decisions about you related to the e-newsletter on our system to send you personalised greeting, content, information, and communication through our various media channels (e.g., email, chatbot, or any other channel we might develop in the future), or location-based services.
7.2 The above activity is known as ‘automated decision-making’, and we do this as part of the purposes for which we use your personal data and the lawful bases we have set out in Section 4 of this PDP Notice.
7.3 You may contact us to object to automated decision-making on you, as we have set out in Section 9 of this PDP Notice.
8. PERSONAL DATA STORAGE
8.1 We will retain your personal data for as long as you are our customer. After our relationship with you has ended, we will only retain your personal data for a period of time appropriate for the type of personal data and the purpose for which it is retained, or for as long as such retention is required or authorised by applicable laws and regulations.
8.2 We will only retain your personal data that enables us to, among others:
-
(a) Keep a record of our business activities for analytical or audit purposes;
-
(b) Comply with the relevant laws and regulations, including regarding data and/or document retention (for example, laws and regulations concerning the prevention, detection, and investigation of money laundering and financing of terrorism);
-
(c) Defend or take legal actions (such as in a legal dispute);
-
(d) Maintain a record of anyone who does not wish to receive marketing offers from us;
-
(e) Deal with future complaints about the services we provide;
-
(f) Assist in monitoring fraud; and/or
-
(g) Assess the effectiveness of any marketing activities we may have sent you.
8.3 The retention period for personal data is oftentimes linked to the time period to file a lawsuit. We will retain personal data beyond that period if: (i) we must do so under an applicable legal obligation or (ii) there is a risk of a lawsuit requiring us to retain your personal data. If we need to retain your personal data for a longer period of time, we will continue to protect such personal data.
8.4 We will delete, destroy, or remove the means by which the personal data can be associated with you as an individual if the personal data is no longer needed for the purposes we have outlined, if the retention period has elapsed, and retention is no longer necessary for legal or business purposes.
8.5 Please note that there is still the possibility that some of your personal data might be retained by the other party, including by the government institutions in some manner. In the event we share your personal data to the authorised government institutions and/or other institutions that may be appointed by the government authorities or have a cooperation with us, you agree and acknowledge that the retention of your personal data by the relevant institutions will follow their respective policy on data retention.
9. YOUR RIGHTS AS A DATA SUBJECT
9.1 You have certain rights as a data subject, as set out below:
Your rights:
-
Right to be informed: You have the right to be informed about the Company’s identity and accountability, the purposes of data processing, and the lawful basis for such processing.
-
Right to access: You have the right to request and obtain access to your personal data that we hold at any time, including obtaining a copy of this data.
-
Right to rectification: You have the right to complete, update, and correct any errors or inaccuracies in your personal data.
-
Right to deletion and destruction: You have the right to request the cessation of processing, deletion, or destruction of your personal data.
-
Right to withdraw consent: You have the right to withdraw your consent for the processing of your personal data at any time.
-
Right to object to an automated decision-making: You have the right to object to decisions made solely based on automated processing, which has legal consequences or significant impacts on you.
-
Right to restriction: You have the right to request a delay or limitation in the processing of your personal data proportionally.
-
Right to data portability: You have the right to request that your personal data be moved or transferred from our system to another system, where it is technically and securely feasible.
9.2 Your ability to request or apply for the fulfilment of these rights depends on a number of factors, and in some circumstances, we may not be able to comply with your request (e.g., if we have a legitimate reason not to fulfil it, if such a right does not apply to certain personal data we hold about you, or if your request falls under the categories exempted by the PDP Regulations).
9.3 Please note that the exercise of certain rights (such as withdrawal of consent) may affect access to and/or limit the Company’s services that you can use.
9.4 In certain circumstances and where reasonable and enforceable under the PDP Regulations, we may charge you a reasonable fee for our administrative costs in the fulfilment of your rights.
9.5 If you want further information about your rights or you want to make a request to exercise your rights, you may contact us in a written form through our contact details as set out in Section 18 of this PDP Notice.
10. HOW WE PROTECT YOUR PERSONAL DATA
10.1 We take the security of your personal data very seriously and make reasonable efforts to protect any of your personal data. We store your personal data by conducting the following:
-
(a) Limiting the access to your personal data;
-
(b) Operating and managing our systems to prevent unauthorised access;
-
(c) Securely destroy your personal data when we no longer need it for the purposes outlined in Section 4 of this PDP Notice; and
-
(d) Implementing a basic policy for the safe and appropriate management and storage of personal data.
10.2 We constantly endeavour to improve our standards of protection; however, you acknowledge that we are not liable for any losses arising from the destruction or loss of your personal data that occurs beyond our control. Therefore, we recommend you to keep your software up to date and not disclose your account password to any parties.
10.3 Unfortunately, the transmission of information via the internet is not completely secure. You also acknowledge that we cannot guarantee the integrity and accuracy of any personal data you transmit over the internet, nor can we guarantee that such personal data will not be intercepted, accessed, disclosed, altered, or destroyed by unauthorised third parties due to factors beyond our control.
10.4 In the unlikely event that we believe the security of your personal data in our possession or control may have been compromised, we may notify you at our sole discretion. If notification is appropriate or required by the PDP Regulations, we will endeavour to do so as promptly as possible under the circumstances, but no later than the statutory deadline for notification under the PDP Regulations after becoming aware of the issue. We may notify you by email or other means of communication based on the contact information provided to us. By using this website, you consent to our use of email as a means of such notification.
11. CORPORATE ACTIONS
11.1 We may sell or transfer some or all of our assets, including your personal data that we control. We may take such steps in the case of a merger, spin-off, acquisition, consolidation, or dissolution of our legal entity, sale of assets, or other matters in accordance with the relevant laws and regulations. We will ensure that any such sale or transfer is conducted in accordance with the PDP Regulations and that adequate security measures are in place to protect your personal data.
11.2 We may also disclose your personal data to third parties involved in the transaction, such as legal consultants, auditors, and/or regulatory authorities when necessary for the purpose of completing corporate actions.
11.3 You reserve the right to be informed of any changes in the ownership or control of your personal data and the purposes for which it is processed following the above corporate actions. If you have any concerns or questions about how your personal data will be handled in the event of a corporate action involving us, please contact us through our contact details as set out in Section 18 of this PDP Notice.
11.4 In the event of a corporate action involving us, we may update this PDP Notice to reflect any changes in how we process your personal data. Any updates will be communicated to you through our website or other form of communication media.
12. COOKIES AND RELATED TECHNOLOGIES
12.1 We use cookies and other online tracking technologies in our online services, such as our website. The data gathered is anonymous and does not specify individuals. “Cookies” are text files that collect small amounts of information which are stored by your browser or the hard drive of your computer or mobile device if you agree. When you return to the website or the app or visit any websites and apps that use the same cookies, they recognize those cookies and your device. Each cookie has a publisher, indicating its owner. When you visit our website, we place “first-party” cookies on your device. Cookies set by third-party companies, like social media platforms or ad networks, are called “third-party” cookies (e.g., Instagram, YouTube, Google Analytics, Google Tag Manager, Facebook, TikTok, Twitter or X, RTB House, Rakuten Group, Inc., Criteo S.A., and Pulse).
12.2 We use cookies for many different purposes, such as remembering your preferences, enabling you to navigate between pages efficiently, ensuring that the adverts you see are more relevant to you, and generally improving your online experience.
12.3 If you do not want us to use cookies, or wish to be notified when cookies are used, you can set your browser to do so, if your browser supports it.
13. THIRD-PARTY SITES/APPLICATIONS
13.1 Our services or communications with you (for example via social media) may from time to time contain links to third-party websites, applications, plug-ins, or services over which we have no control. Certain activities on our website, such as special promotions, may also be connected to third-party companies that offer you the option to share your personal data with them. We will not share your personal data with these third-party companies; only you can do so if you choose.
13.2 Links to third-party websites provided on our website are offered for your convenience. However, we do not control those websites or their personal data protection practices, which may differ from ours. If you access these third-party links, please note that such third parties have their own personal data protection activities and notices. We recommend you to read such third-party personal data protection notices to understand your rights.
13.3 Some third-party companies may choose to share their personal data with us, but that sharing is governed by such third-party company’s personal data protection notice. We are not responsible for any activities, including data processing activities that occur on systems belonging to third parties.
14. CHANGES TO THIS PDP NOTICE
14.1 We may amend or update this PDP Notice from time to time. Before these changes are effective, we will notify you of the changes by posting the information of the changes on the website or through your email. We recommend you to review the page from time to time to stay informed with the latest updates on how we enforce the provisions of this PDP Notice.
14.2 If the changes to this PDP Notice will have a substantial impact on what we do with your personal data or on you personally, we will provide sufficient notice to enable you to exercise your rights (e.g., to object to the data processing).
15. APPLICABILITY
15.1 There may be other provisions concerning personal data which may be made available to you through other documentation other than this PDP Notice.
15.2 In the event of a conflict between such other provisions and the provisions under this PDP Notice, the provisions under this PDP Notice shall prevail, unless expressly stated otherwise in such other documentation.
16. GOVERNING LAW AND DISPUTE RESOLUTION
16.1 This PDP Notice is regulated and interpreted according to the laws and regulations of the Republic of Indonesia.
16.2 Any Dispute shall be resolved by the relevant parties amicably and by deliberation to reach consensus within 30 (thirty) calendar days of a party receiving a written notice of such dispute from the other party.
16.3 If the Dispute cannot be resolved by the parties within 30 calendar days from the date of the written notice under Section 16.2 above, then such Dispute will be referred to and finally resolved by binding arbitration administered by BANI in accordance with the administrative and procedural Arbitration Rules of BANI in force at the time, which rules are deemed to be incorporated by reference in this section. The seat of the arbitration shall be Jakarta, Indonesia. The tribunal shall consist of an arbitrator appointed by the Head of BANI. The language of the arbitration shall be English.
17. NOTIFICATION AND COMMUNICATION
17.1 We may send you messages by email, post, telephone, text message, and/or other digital methods (messages that appear on your mobile device), as well as through new methods that may become available in future.
17.2 These messages serve the purpose of:
-
(a) fulfilling our legal obligations, such as regarding changes to the agreement with you and notifying when there is an incident of failure to protect your personal data;
-
(b) informing you about the features and benefits of the products and services we provide to you; and
-
(c) informing you about products and services (including from other companies) that may be of interest to you. Messages like these are marketing messages. You can ask us to stop or start sending you marketing messages at any time by contacting us through our contact details as set out in Section 18 of this PDP Notice.
18. CONTACT US
You may contact us, such as to ask any questions regarding this PDP Notice or to request the fulfilment of your rights as a data subject. You can contact us here: corporate-csd@csd-dev.id.
19. LANGUAGE
Any local language translation (e.g., the Indonesian language) of this PDP Notice exists for reference purposes only, and only the English version shall take precedence. If there is any inconsistency between different versions, the English version will prevail.
