CCB INDONESIA PRIVACY POLICY

Introduction

PT Bank China Construction Bank Indonesia Tbk (“CCB INDONESIA”) is committed to protecting and safeguarding personal information/data (“Personal Data”) in accordance with the provisions of Law No. 27 of 2022 concerning the Protection of Personal Data (“Personal Data Provisions”) and any future amendments to this law.

This Privacy Policy is applied by CCB INDONESIA in processing Personal Data while adhering to the principles of Personal Data processing as outlined in the Personal Data Provisions.

Scope of Personal Data

Personal Data collected by CCB INDONESIA in connection with the provision of products and services includes specific Personal Data and general Personal Data in accordance with the Personal Data Provisions.

Acquisition and Collection of Personal Data

CCB INDONESIA acquires and collects Personal Data through:

1. Website, Applications, and Forms
   CCB INDONESIA may obtain and collect Personal Data from the devices you use when accessing the website or application provided by CCB INDONESIA, and from banking service requests you make by filling out forms, completing data requests through the website, CCB INDONESIA applications, and other media provided by CCB INDONESIA or parties cooperating with CCB INDONESIA.
2. Communication with CCB INDONESIA
   CCB INDONESIA may obtain and collect Personal Data when you communicate and interact with CCB INDONESIA, including when you contact CCB INDONESIA’s banking services, answer questions, provide information, or participate in programs organized by CCB INDONESIA.
3. Transaction Activities
   CCB INDONESIA collects information about your transaction activities when you and/or your authorized representative conduct transactions with or through the facilities provided by CCB INDONESIA.
4. Physical Locations
   CCB INDONESIA may obtain and collect Personal Data either directly or indirectly when you and/or your authorized representative visit CCB INDONESIA’s branches, offices, and other physical locations.
5. Affiliates and Third Parties
   CCB INDONESIA may obtain and collect Personal Data from CCB INDONESIA affiliates or other parties cooperating with CCB INDONESIA.

Purpose of Processing Personal Data

CCB INDONESIA will process the Personal Data obtained and collected for the following purposes:

1. Providing services and information about CCB INDONESIA's banking products and/or services to customers;
2. Implementing the Customer Due Diligence (CDD) and Know Your Customer (KYC) principles in accordance with applicable legal provisions;
3. Compliance with legal provisions, including but not limited to Anti-Money Laundering, Counter-Terrorism Financing, and Proliferation Financing of Weapons of Mass Destruction (AML/CTF, and WMD Proliferation Prevention);
4. Resolving any issues related to access to CCB INDONESIA’s banking products and/or services;
5. Addressing complaints about banking products and/or services provided by CCB INDONESIA or its partners;
6. Evaluating, enhancing, and/or updating banking services and features from time to time;
7. Offering advertising/promotions or marketing for banking products and/or services from CCB INDONESIA or its partners and organizing loyalty programs, such as gifts, sweepstakes, and others;
8. Other purposes as permitted or required by applicable law.

Disclosure of Personal Data

CCB INDONESIA may disclose your Personal Data to its affiliates or third parties cooperating with CCB INDONESIA, whether located in Indonesia or abroad, to carry out the purposes of Personal Data processing as outlined in this Privacy Policy. When disclosing Personal Data to affiliates or third parties cooperating with CCB INDONESIA, CCB INDONESIA will ensure they maintain confidentiality and security of your Personal Data in accordance with the Personal Data Provisions, including but not limited to other applicable data-related regulations.

Rights of Personal Data Subjects

CCB INDONESIA is committed to fulfilling your rights as a Personal Data Subject to access information about the Personal Data collected and processed by CCB INDONESIA. You may request CCB INDONESIA to correct, complete, update, or delete your Personal Data under CCB INDONESIA's control, while adhering to applicable legal provisions. However, CCB INDONESIA may refuse your request in cases where permitted under applicable law or if your request contradicts the prevailing legal interests.

Storage of Personal Data

CCB INDONESIA stores data in accordance with internal regulations regarding data retention at CCB INDONESIA. CCB INDONESIA may store your data beyond the prescribed period if required for legal purposes, to assist in detecting financial crimes, responding to regulator or law enforcement requests, or for other purposes as permitted by applicable law. Your Personal Data will be stored as long as its collection purposes are necessary for legal or other business interests. If CCB INDONESIA no longer requires your personal data, it may delete your data in accordance with the regulations in effect at CCB INDONESIA.

Security of Personal Data

CCB INDONESIA employs various measures to safeguard your Personal Data, such as encryption technology and other security forms. Additionally, CCB INDONESIA requires its employees and other third parties cooperating with CCB INDONESIA to comply with all applicable provisions related to the protection of Personal Data and implement security measures in processing Personal Data.

Changes to the Privacy Policy

CCB INDONESIA may change or update this Privacy Policy at any time to ensure the protection of Personal Data and to remain compliant with the evolving legal and regulatory landscape. Any changes to this Privacy Policy will be communicated through channels deemed appropriate by CCB INDONESIA, and you agree to review this Privacy Policy whenever necessary. The updated Privacy Policy will be available on CCB INDONESIA’s website at idn.ccb.com.