AFI PRIVACY POLICY

PT AEON Fantasy Indonesia (“AFI”, “we”, “our” or “us”) collects, acquires, filters, analyzes, stores, fixes, updates, displays, announces, transfers, disseminates, discloses, deletes, destroys and/or implement any other relevant activities as intended by the prevailing Personal Data Protection Law and its implementing regulations (collectively referred to as “process”) on the Personal Data related to customers, business partners, employees, and applicants of AFI (collectively referred to as “Data Subject”). AFI recognizes the importance of Personal Data Protection and the importance of compliances with the laws. In this AFI Privacy Policy (this “Privacy Policy”), AFI describes why and how we process your Personal Data.

AFI processes Personal Data in compliance with the Law No. 27 Year 2022 dated 17 October 2022 on the protection of the Personal Data and any relevant regulations, as well as any amendments thereto (“Personal Data Protection Law” or “PDP Law”). Unless otherwise defined herein, the capitalized terms used in this Privacy Policy, including but not limited to, “Personal Data”, “Specific Personal Data”, “Process/Processing”, “Controller”, “Processor”, “Data Subject” and “Personal Data Breach” shall have the same meanings as set forth in the Personal Data Protection Law and the applicable laws and regulations.

As Data Controller, AFI determines the purposes and methods of processing Personal Data and has the responsibility on the protection of your Personal Data as well as to assist you in making an informed decision before providing us your Personal Data or of other individuals, including child Personal Data.

Based on this Privacy Policy, you have the right to express your intention on our process of processing your Personal Data. Except for the cases permitted by the Personal Data Protection Law and any applicable laws and regulations, AFI will not process your Personal Data without your consent.

In the case a Data Subject is a child under the age of eighteen (18) (“child”), the consent shall be obtained from his or her parent(s) or legal guardian. If AFI detects that a child has provided AFI with his or her Personal Data without the consent of his or her parent(s) or guardian, AFI will immediately delete the Personal Data from our servers. If you are a parent or guardian and aware that your child has provided AFI with his or her Personal Data, please immediately contact AFI so that AFI can take necessary actions (please refer to the contact address in section 8 of this Privacy Policy).

1. Purposes of Personal Data processing
1.1. AFI processes Personal Data of the customers for the following purposes (“Purposes”):

• To contact, communicate or provide the products or services under any AFI businesses.
• To provide customers with ongoing information about events and programs, AFI’s products, services, special offers, vouchers, updates and promotions.
• To respond to customers’ request (for example, response to special offers, vouchers, payment, maintenance services,… etc).
• To monitor the use of services or transaction according to customers’ orders.
• To develop and improve our products and services to enhance our standard of services.
• To protect customers’ safety and security.
• To verify identity and prevent unauthorized or illegal activities.
• To resolve concerns and complaints.
• To promote service of AFI on its social media platforms, including but not limited to, Facebook, Instagram, YouTube, WhatsApp and Tiktok channel.

1.2. AFI processesthe Personal Data of business partners for the following purposes:

• For business collaborations, business negotiations and business communication.
• For conclusion of contracts and other documents.
• For security management.

1.3. AFI processes the Personal Data of the employees and applicants for the following purposes:

• For recruitment and personnel labor management purposes.
• For administrative procedures such as salary and incentives payment, providing benefits and welfares, and other required administrative procedures as intended by the prevailing laws and regulations.

1.4. AFI shall process your Personal Data within the scope of the Purposes. Please note that AFI may not fulfill contractual obligations or provide our services effectively if you do not provide us with your Personal Data.

2. Legal basis for Personal Data processing
AFI will only process your Personal Data where we have a legal basis to do so. Such legal basis are as follows:

• In principle, AFI does not process Personal Data without your explicit consent for one or several specific purposes that has been notified to you;
• AFI processes Personal Data to fulfil the agreement obligations in the event that Data Subject is a party or to fulfil the request from Data Subject at the time of entering into the agreement;
• AFI processes Personal Data to fulfil the legal obligations of our company in accordance with the prevailing laws and regulations;
• AFI processes Personal Data to fulfil the protection of vital interests of the Data Subject;
• AFI processes Personal Data to carry out duties in the context of public interest, public services, or exercising our authority based on the prevailing laws and regulations;
• AFI processes Personal Data to fulfil of other legitimate interests by taking into account the purposes, needs, and balance of our interests and the rights of the Data Subject.

3. The Personal Data AFI processes
3.1. AFI collects the following general and specific Personal Data of the customers.

• Personal details relevant to our services including full name, nickname, age, day-month-year of birth, phone number, email address, address;
• Public social media information including name or account for application through digital channel e.g, Facebook, TikTok, YouTube, WhatsApp or Instagram;
• Voice recording of conversations, and photo and video recording by means of CCTV;
• Personal Pictures taken when playing on the playground of AFI; and
• any other specific personal data as permitted by the Personal Data Protection Law and the prevailing laws and regulations, including child personal data.

3.2. AFI collects the following general and specific Personal Data of business partners.

• Personal details relevant to our services including full name, age, day-month-year of birth, phone number, email address, address, information printed on ID card, passport number, Tax ID Number (NPWP); and
• Financial and transaction information such as bank account, bank account number.

3.3. AFI collects the following general and specific Personal Data of employees and applicants.

• Personal details relevant to our administrative procedures and human resource management including full name, nickname, age, day-month-year of birth, gender, phone number, email address, address, citizenship, religion, marital status, information printed on ID card, passport number, Tax ID Number (NPWP), family’s information (parents, children), personal image and combined personal data for identification;
• Work information such as working history, educational background, working position, occupation status;
• Financial and transaction information such as bank account, bank account number; and
• The specific personal data including finger scan, children’s data, criminal record, personal financial data, medical and health data/records/diagnosis, disability.

4. Disclosure of Personal Data
4.1. AFI may disclose the Personal Data to persons or juristic persons as stated below.

• The parent company, subsidiaries, affiliated companies, business partners, and service providers of AFI. AFI has the responsibility to supervise them to keep the respective Personal Data confidential, take enough measures to protect the Personal Data, and use the Personal Data within our scope of Purposes.
• Public offices such as the Government and courts and other authorities in case where permitted by law.

4.2. In principle, AFI will not disclose the Personal Data to other persons outside Indonesia. However, we may disclose your Personal Data to AEON Fantasy Co., LTD, as the parent company of AFI, in Japan. Please note that such data disclosed to Japan is protected under the laws of Japan. In case of transferring the Personal Data to a foreign country, we ensure to transfer the Personal Data to the countries where one of the following conditions apply:

1. The country of domicile of the Personal Data Controller and/or the Personal Data Processor that receives the transfer of Personal Data has a personal data protection level that is equal to or higher than those that are regulated under the PDP Law;
2. There is adequate and binding personal data protection in accordance with the applicable laws and regulations; or
3. The Data Subject has provided his/her consent to the proposed transfer after being informed of a reasonable summary.

5. Retention Period of the Personal Data
AFI establishes the retention period as needed according to the Personal Data Protection Law and other applicable laws, accounting requirements, business needs, the nature of Personal Data, and the purpose of retention. We shall retain the Personal Data for the period necessary to fulfill the Purpose listed in section 1 and destroy the personal data that has passed the retention period. Notwithstanding the foregoing, please note that AFI may retain the Personal Data after the retention period in the case required by applicable laws.

6. The Rights of Data Subject
Data Subjects have the rights as below. As a Data Subject, you may exercise them by contacting the contacts in section 8 below as needed. Please note that you may exercise the rights only if the personal data is related to yourself.

6.1. Right to obtain information regarding identity clarity, basis of legal interest, purpose of requesting and using your Personal Data, and accountability of parties that request your Personal Data.

6.2. Right to complete, update and/or correct errors and/or inaccuracies in your Personal Data regarding yourselves in accordance with the purpose of the Personal Data processing.

6.3. Right to access and obtain a copy of the Personal Data regarding yourselves in accordance with provisions of laws and regulations.

6.4. Right to end processing, delete, and/or destroy your Personal Data regarding yourselves in accordance with provisions of laws and regulations.

6.5. Right to withdraw consent to the processing of your Personal Data regarding yourselves that has been given to AFI.

6.6. Right to object a decision-making action that is based solely on automated processing, including profiling, which has legal consequences or have a significant impact on yourselves.

6.7. Right to delay or limit your Personal Data processing proportionally with the purpose of Personal Data processing.

6.8. Right to sue and claim compensation for violations of the processing of your Personal Data regarding yourselves in accordance with provisions of laws and regulations.

6.9. Right to obtain and/or use the Personal Data regarding yourselves from AFI in a form that is in accordance with the structure and/or format commonly used or readable by an electronic system.

The obligations of AFI to carry out your request for exercising your rightsin 6.4, 6.5, 6.6, 6.7 and 6.9 shall be exempted for:

(a) The interests of law enforcement process;

(b) The interests of the national defense and security;

(c) Public interest in the context of state administration;

(d) The interests of supervision of the sectors of financial services, monetary, payment system, and financial system stability carried out in the context of state administration; or

(e) the interest of statistics and scientific research.

7. Revision of the Privacy Policy
AFI may revise this Privacy Policy from time to time to comply with the prevailing laws and regulations and shall announce about such revision on this website as soon as possible.

8. Contacts
If you have any concerns about this Privacy Policy, or would like to exercise your rights prescribed in section 6 above, please send your request to:

Data Controller：PT AEON Fantasy Indonesia International Financial Centre 2, 39th Floor Jl. Jend. Sudirman Kav. 22-23, Kel. Karet, Kec. Setiabudi, Jakarta Selatan 12920 Tel： (+62)21-722-9490 Email：afi-hr-ga-it@aeonfantasy.co.id

Please read this Privacy Policy carefully and make sure you understand the contents therein.