1. Introduction

PT Tokaicom Mitra Indonesia (“TMI”, “we”, “us”, or “our”) is committed to protecting your personal data and respecting your privacy. We are committed to protecting and respecting your privacy in accordance with Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi (UU PDP) and other applicable Indonesian regulations.

This Privacy Policy applies to personal data we collect from you when you interact with us through our website, services, or other communication channels, including the Contact Us form , and technical information obtained through our website, including the Contact Us form, cookies, analytics tools, and similar technologies.

By accessing or using our website or services, you acknowledge that you have read and understood this
Privacy Policy. If you do not agree with this Privacy Policy, please do not use our website or services.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

• Identity Data: Full name, job title, company name.
• Contact Data: Email address, phone number, mailing address.
• Inquiry Data: The content of your message or inquiry submitted through the Contact Us form.
• Communication Data: Records of correspondence between you and TMI.

When you visit our website, we may also automatically collect certain technical and usage data, such as:

• IP address and approximate geographic location;
• Browser type and version, device type and operating system;
• Pages visited, links clicked, and navigation paths;
• Date and time of access, time spent on pages;
• Cookie identifiers and analytics data (e.g., collected via independent analytics tools).

We do not intentionally collect sensitive personal data (such as data concerning race, religion, health, or financial information) unless explicitly required and consented to.

3. How We Collect Personal Data

We collect personal data through the following means:

• Directly from you: When you fill in and submit the Contact Us form on our website.
• Indirectly: From third-party service providers (e.g., email delivery services) when delivering
  communications to you.
• Publicly available sources: From publicly accessible business directories or professional networks,
  where applicable.

4. Purpose of Processing

We process your personal data for the following purposes:

• To respond to and manage your inquiries submitted via the Contact Us form;
• To communicate with you regarding our products and services;
• To maintain records of communications for business purposes;
• To comply with applicable legal obligations;
• To protect our rights and interests as permitted by law;
• To operate, maintain, and secure our website;
• To analyze website traffic and usage trends;
• To improve our website, services, and overall user experience.

5. Legal Basis for Processing

In accordance with Article 20 of UU PDP, the legal basis for processing personal data submitted through the Contact Us form is your explicit consent, which is provided when you submit the Contact Us form.

We may also process your personal data where necessary to comply with our legal obligations or to protect our rights and interests, in accordance with applicable Indonesian laws and regulations.

With respect to technical and usage data collected automatically through our website (such as cookies and analytics data), we rely on your consent as indicated through your browser settings or cookie consent preferences.

6. Disclosure to Third Parties

We do not sell, rent, or trade your personal data to any third-party vendors, and we do not share your personal data with any external service providers for their own commercial purposes.

However, your personal data and technical data may be shared among affiliated companies within the TMI corporate group, including:

• TOKAI Communications Corporation — our parent company, based in Japan;
• Sister and affiliated companies — other entities within the TOKAI Communications group and PT. Sisnet Mitra Sejahtera, as necessary for legitimate business purposes.

Such sharing among affiliated companies is conducted solely for legitimate business purposes, including coordination of services, internal reporting, compliance, and operational support. All affiliated companies are required to handle your personal data in accordance with applicable data
protection laws and with equivalent levels of care and security.

In addition, we may disclose personal data in the following circumstances:

• Legal Requirements: Where required by law, regulation, court order, or governmental authority.
• Business Transfers: In connection with any merger, acquisition, reorganization, or sale of all or
  part of our assets, your personal data may be transferred as part of that transaction.
• Protection of Rights: When we believe disclosure is necessary to protect the rights, property, or
  safety of TMI, our clients, or the public.

7. Cross-Border Data Transfers

As TMI operates as a global company, your personal data and technical data may be transferred to and processed in countries other than Indonesia, including Japan and other countries where our affiliated companies, cloud service providers, or independent analytics and service providers operate.

Any such cross-border transfer of personal data will be conducted in accordance with the requirements of UU PDP, including ensuring that:

• The receiving country provides an equivalent or higher level of personal data protection as required
  under Indonesian law; or
• Adequate safeguards are in place, such as standard contractual clauses or binding corporate rules
  approved by the relevant supervisory authority; or
• If the above requirements cannot be satisfied, we will obtain your explicit consent before transferring your personal data outside Indonesia, where required by applicable law.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by applicable law.

Personal data submitted through the Contact Us form is retained for a period of five (5) years from the date of submission, after which it will be securely deleted or anonymized.

Technical logs, cookie data, and analytics data are retained only for as long as necessary for website operation, security, analytics, and service improvement purposes, or as required by applicable law or
the relevant service provider’s retention settings.

Where you have exercised your right to erasure and we have no overriding legal basis to continue
processing, we will delete or anonymize your data within a reasonable period.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit and at rest where applicable;
• Access controls and authentication mechanisms;
• Regular security assessments and audits;
• Staff training on data protection and security practices.

While we take reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach that is likely to harm your rights and interests, we will notify you and the relevant authorities as required by UU PDP.

10. Your Rights as a Data Subject

Under UU PDP, you have the following rights with respect to your personal data held by us:

• Right to Access: The right to request a copy of the personal data we hold about you.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: The right to request deletion of your personal data, subject to applicable legal
  requirements.
• Right to Restriction: The right to request that we restrict processing of your personal data in
  certain circumstances.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used
  format.
• Right to Object: The right to object to processing of your personal data based on certain grounds.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw consent
  at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us using the details provided in Section 12 of this Privacy Policy. We will acknowledge and respond to your request in accordance with the timelines required under applicable Indonesian laws and regulations.

11. Cookies and Website Technologies

Our website may use cookies and similar tracking technologies to enhance your browsing experience, analyze site usage, and assist in our marketing efforts. Cookies are small data files stored on your device when you visit our website.

Types of cookies we may use:

• Strictly Necessary Cookies: Required for the operation of our website;
• Analytical Cookies: Allow us to recognize and count visitors and see how visitors move around our
  website (e.g., via independent analytics tools);
• Functional Cookies: Used to recognize you when you return to our website.

You can control and/or delete cookies as you wish through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact our Data Protection Officer:

Data Protection Officer
PT Tokaicom Mitra Indonesia (TMI)
5th Floor, Digi Atrium Building, Jl. Ampera Raya 5A, RT.4/RW.4, Cilandak Timur, Jakarta Selatan 12560
Email: info@tokaicom-mitra.co.id

We take all privacy inquiries seriously and will handle your request with care and confidentiality.

13. Changes to This Privacy Policy

We reserve the right to update or amend this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will notify you by posting the updated Privacy Policy on our website with a revised “Last Updated” date.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal data. Your continued use of our website or services after any changes
constitutes your acceptance of the updated Privacy Policy.

14. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Indonesia, including UU PDP and its implementing regulations.

Any disputes arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of the Republic of Indonesia.