PERSONAL DATA PRIVACY NOTICE
PT MITRA BISNIS

This personal data privacy notice (“Privacy Notice“) intends to clarify how we handle the information we receive from you, the purposes for the collection, use, and disclosure, the retention period of such Personal Data, as well as your rights as the data subject with regard to your access, use, and correction of your Personal Data.

This Privacy Notice only applies to the use of your Personal Data obtained by us, whether from you directly or from a third party. It does not apply to Personal Data collected by third parties during your communications with those third parties or your use of their products or services.

Definitions

“Personal Data”	means any data related to an individual (natural person), whether identified or capable of being identified independently or in combination with other information, whether directly or indirectly, through the use of an electronic system and/or non-electronic means, according to the Personal Data Protection Laws.
“Personal Data Protection Laws”	means Law No. 27 of 2022 on Personal Data Protection and its related and implementing regulations on personal data protection, including any amendments which may be made thereto in the future.
“Process” or “Processes” or “Processing”	means any acquisition and collection, processing and analysis, storage, rectification and update, display, publication, transfer, dissemination, disclosure, and/or erasure or destruction of Personal Data.
“RMA”“we” or “us“ or “our“	means PT Mitra Bisnis, together with other members and businesses of RMA Group.[1]
“Website”	means the website and/or applications serviced by us as the case may be.

About RMA

PT Mitra Bisnis is a legal entity established under the law of Republic of Indonesia with the principal office address at Pondok Indah Office Tower 3, Lantai 6, Ruang 603, Jl. Sultan Iskandar Muda, Kelurahan Pondok Pinang, Kecamatan Kebayoran Lama, Kota Adm. Jakarta Selatan, Provinsi DKI Jakarta, which is a part of RMA Group.

RMA Group has an operational presence in 14 countries globally. RMA is the partner of choice for leading automotive, equipment, services and food brands in Southeast Asia and beyond. Our core operations are automotive retail, manufacturing and parts distribution, fleet management, sales and distribution of heavy equipment, power generation as well as food franchises and engineering services. RMA Automotive manufacturing and modification plants are situated in Turkey, South Africa, Myanmar, and Australia. Ford Global Fleet Sales has offices in the US and Dubai.

For more information on RMA and each member of RMA Group, please visit: www.rmagroup.net

Categories of persons from whom we collect Personal Data

Under this Privacy Notice, we collect and Process Personal Data from the following categories of persons:

Customers: persons who purchase our products and/or use our services, and/or prospective customers who are expected to purchase our products and/or use our services, or any other persons with similar characteristics, such as persons who participate in activities, seminars, bids, Website users, persons who contact us to receive information or services from us, persons who respond to surveys on our products and/or services, as well as juristic persons and persons whose Personal Data appear in the relevant documents and processes.
Persons related to customers: persons who are related to or are representatives of customers, such as executives, directors, employees, representatives or personnel of customers who are juristic persons, including persons whose Personal Data appear in relevant documents and processes, such as managers, purchasers, consignees and cheque payers.
Trading Partners: persons who may become our trading partner or vendor, such as middlemen, service providers, consultants, experts, those who will engage in franchise or dealership businesses, contracting parties, those interested in participating in a business project, or any other persons with similar characteristics, from a declaration of intent to enter into a contract with us and/or register as our trading partner or vendor.
Persons related to Trading partners: persons who provide quotations for products and/or services to be sold to us, have registered as trading partners or vendors with us, or have relationships of a similar nature with us, such as middlemen, service providers, consultants, experts, those who will engage in franchise businesses, contracting parties, those interested in participating in a business project, or any other persons with similar characteristics.
Persons related to prospective or existing trading partners/vendors: natural persons who are related to or are representatives of trading partners or vendors, such as executives, directors, employees, representatives or personnel of trading partners or vendors who are juristic persons, including persons whose Personal Data appear in relevant documents and processes, such as managers, purchasers, consignees and cheque payers.

How do we collect and receive your Personal Data?

We collect and receive your Personal Data via the following methods:

Personal Data you directly provide to us
You may directly provide your Personal Data to us. This usually occurs when you:
- communicate (for instance, making enquiries or providing comments or feedback) with us, whether orally or in writing, through the Website, by telephone, email, fax, mail, face-to-face interaction or any other means;
- express an intention to purchase our products or use our services (such as by registering to be a member of our databases), enter into a contract with us or deliver documents containing your Personal Data to us; and
- participate in surveys, lucky draws, attend marketing events or engage in other marketing activities organized by us or on our behalf.
Personal Data we automatically collect from you: we may automatically collect some technical information related to your devices, activities, usage patterns and browsing history, by using log files or other similar technologies.
Personal Data we receive from third parties: we may, from time to time and where permitted by law, receive your Personal Data from third parties. This may include:
- information shared between our affiliates;
- publicly available information from sources such as newspapers, blogs, social media websites and commercial websites; and
- marketing lists from third-party agencies or data aggregators.

In collecting your Personal Data, you will be informed of details set out in this Privacy Notice, including but not limited to the lawful basis for the collection, use, disclosure and/or Processing of Personal Data in accordance with the lawful purposes, or in the event that the Personal Data Protection Laws require your consent, we will request your explicit consent in order to Process your Personal Data.

Personal Data of Children

We do not aim to collect and Process Personal Data of individuals under the age of 18 years old, and we request that these individuals do not provide their Personal Data to us. If you believe that we are processing data on children under your care and you would like to request that such Personal Data be removed, please contact us via the communication channel under ‘Contact Us’ section below.

What information about you do we collect?

We may collect and Process your Personal Data that was directly provided by you, automatically collected form you from your use of our services, or was provided to us by third parties.

Such collected Personal Data include the following:

Personal Data such as first name, last name, date/month/year of birth, age, sex, national identification number, photograph, signature, and nationality.
Contact details such as address stated on national identification card, address stated in house registration book, delivery address, billing address, telephone number, fax number, e-mail, LINE ID, and emergency contact information.
Customer business information such as details concerning the customer’s factory or business, including name, registration number, location, and contact details.
Information concerning sale and purchase transaction such as customer code, vendor code, order details, details of product complaints, delivery details, tracking number.
Payment information such as monetary amount, credit limit, payment terms, account number, Personal Data appearing in tax invoice, cheque, payment voucher, and receipt.
Information used as supporting evidence in customer registration forms or execution of transactions with us such as Personal Data which appears in a copy of national identification card, copy of passport/visa/work permit, copy of house registration book, copy of change of name certificate, copy of customer account opening form, documents certifying non-related parties, power of attorney, copy of company affidavit, security documents (title deeds, bank guarantees, or personal guarantees), sale and purchase agreement or any other agreements
relating to the transaction or delivery order.
Technical information such as information that we collect through the use of log files (IP addresses, browser type, ISP, date/time stamp, referring/exit pages, number of clicks) or similar technologies, computer traffic data, system access statistics, access time, search history, use of functions in systems.
Other information such as customer’s experience, behavior or trends in purchasing products and/or using services, voice recordings, photo and video recordings from CCTV footages, among others.
Personal Data collected or used before 1 January 2025
- If we have collected your Personal Data before 1 January 2025, we will continue to collect and/or use such Personal Data in accordance with the purposes for which the Personal Data was originally collected and/or used in accordance with the Personal Data Protection Laws.
- If you do not wish for us to continue collecting and/or using your Personal Data, we will prepare and announce a consent withdrawal method to facilitate you. However, we reserve the right to consider your consent withdrawal request and to proceed in accordance with the Personal Data Protection Laws.

Purposes of Collection, Use, Disclosure and Processing

We may Process your Personal Data for the following purposes (collectively, the “Purposes”):

No	Purpose	Lawful Basis of the Processing
1	To comply with the duties under relevant laws and regulations applicable to us, our business and/or our services, and legitimate orders of government agencies and relevant officers.	The Processing of your Personal Data is necessary for the compliance of our duties in accordance with relevant laws and regulations that are enforceable on us, such as taxation law, Personal Data Protection Laws, and legitimate orders of government agencies and relevant officers, such as the Indonesian Data Protection Authority, as well as court orders and/or decisions.
2	For the purpose of establishment, compliance, exercise or defense of our legal claims.	The Processing of your Personal Data is necessary for our legitimate interests in the establishment, compliance, exercise or defense of our legal claims, such as investigation and/or inquiry by government officials, case preparation, prosecution and/or pursuit of the case in court.
3	For purposes relating to selling our products and/or services to customers and other relevant transactions, such as: Membership registration or customer account opening; Entering into agreements for sale and purchase of products and/or services; Management and fulfilment of customer orders, preparation of products and/or services; Processing payments of products and/or services. Management and fulfilment of customer orders, preparation of products and/or services; Processing payments of products and/or services.	The Processing of your Personal Data is necessary for: The entry into and performance of contracts and agreements or other relevant processes, such as checking of evidence for entry into agreements, consideration of credit limit, and to act in accordance with customer’s request in respect of new customer account opening; our legitimate interests in our business operations, such as management of account and verification of the identity of customers, consideration of qualifications of customers, etc.
4	To provide sales-related services, such as: Dealing with your inquiries and requests; Corresponding with you; Providing general administration and troubleshooting services to you; Administering loyalty programs.	The Processing of your Personal Data is necessary for the performance of our contract with you in providing sales-related services to our customers, persons related to the customers, or any other persons with similar characteristics in providing sales-related services.
5	To engage in marketing communications, public relations and other similar activities, such as: Contacting you via telephone call, short messages service (SMS), e-mail, mail or via any contact channels in order to ask, inform, verify or confirm your account information, conducting surveys; Keeping you updated on any news related to our organization and services; Keeping records of photographs, footages and/or audio recordings (if any) during events involving public relations and marketing activities.	Where we proceed with any marketing activities, such as sending marketing messages to customers, or taking photographs and videos of customers to process and publicize marketing communications, we will undertake such activities by relying on the consent received from you. We will send you marketing communication messages only when you subscribe to receive marketing communication or when you have given explicit consent to receive such marketing communications.
6	To perform data analytics and improve the quality of our products and/or services for you, in order to respond to your service requests, inquiries, or suggestions, and to ensure that we are providing you our services efficiently, such as: Analyzing and surveying customer behavior or purchasing Personal Data of the customer from third parties to use such Personal Data for analysis and survey of customer behavior; Managing your relationship with us; Analyzing your use of our services, Websites or other media.	The Processing of your Personal Data from your use of our Website or other media is necessary for: our legitimate interests in our business operations and improvement of the quality of our products and/or services; or in the event that we collect and Process your Personal Data to analyze and advertise products and/or services based on your behavior, or conduct marketing campaigns directly to you, or where Personal Data Protection Laws require your consent, we will rely on the consent received from you in undertaking such actions.
7	For the purposes of any transaction that is necessary and beneficial to you directly or to support the above purposes, such as: Administering your accounts; Managing your appointments with us; Enhancing your experiences; Providing administration and troubleshooting services to you.	The Processing of your Personal Data is necessary for our legitimate interests in carrying out any transactions which are necessary for us and/or beneficial to you or directly related to the purposes set forth above.
8	For procedures and processes relating to or arising from any of the purposes set forth above.	The Processing of your Personal Data is necessary for our legitimate interests in carrying out any procedures necessary for our business operations or directly related to any of the purposes set forth above. Where the PersonalData Protection Laws require your consent for any Processing of your Personal Data, we will ask for your explicit consent.

Insofar as the Personal Data which we will Process for the Purposes relates to and is necessary for the compliance with applicable laws or the entry into or performance of contracts with you, if you do not provide such Personal Data to us, there may be legal implications or we may not be able to enter into or perform our duties under the contract (as the case may be). In such event, it may be necessary for us to decline to enter into the contract with you, or to cancel the sale and purchase, or the provision of any relevant services to you, whether in part or in whole.

Where we rely on your consent to process your Personal Data, you will have the right to withdraw it at any time, unless there is a restriction of the withdrawal of consent by law, or continuous processing of your Personal Data is justifiable under other lawful basis for processing. The withdrawal of your consent will not affect the lawfulness of processing based on consent before such withdrawal.

If we Process your Personal Data in a manner and/or for purposes inconsistent with the aforementioned Purposes, we will put in place additional policies or notifications for protection of the Personal Data and/or send you a notice (and seek your explicit consent, if required under applicable laws) explaining our Processing of the Personal Data. In this regard, we encourage that any additional policies or notifications be reviewed and read together with this Privacy Notice.

Disclosure of Personal Data

We may disclose your Personal Data in accordance with the Purposes and the rules prescribed under applicable laws to the following entities and persons:

Our affiliated companies, including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.
Business partners, service providers, and data processors designated or hired by us to perform duties in connection with the management and/or Processing of Personal Data for us to provide services in areas such as information technology, data analytics, delivery, printing, health, insurance, training, research, marketing, or others which may be beneficial to you or our business operations.
Our advisors, such as consultants, lawyers, auditors, or any other internal and external experts.
Relevant governmental agencies with supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers relevant to the legal process or which were granted permission pursuant to applicable laws.
Any other persons or entities to whom you have given consent for disclosure of Personal Data.

Any disclosure of your Personal Data to third parties shall be in accordance with the Purposes or other purposes permitted by applicable laws, and if the law requires your consent, we will request your prior consent to any such disclosure.

If we disclose your Personal Data to third parties, we will put in place appropriate safeguards to protect the disclosed Personal Data and comply with standards and duties relating to the protection of Personal Data as prescribed by the Personal Data Protection Laws. Where we send or transfer your Personal Data outside Indonesia, we will ensure that:

the recipient country, international organization, entity or any such overseas recipient has an equal or higher level of standard of protection of Personal Data than the Personal Data Protection Laws;
there is an adequate level of binding personal data protection requirements; or
you provide consent to us for the cross-border data transfer.

Retention Period

We will retain your Personal Data as long as necessary to fulfil the Purposes for which the Personal Data was collected, or any other period prescribed under applicable laws (including but not limited to Personal Data Protection Laws). To this end, we will consider the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the Personal Data we collect, as well as our business practices in relation to each category of Personal Data in order to provide our services to you.

After the retention period (or longer period as applicable laws permit) expires, we will delete, destroy or anonymize the Personal Data from our system and records, as well as those of any other persons providing services to us.

Should you have any other questions or require any additional details regarding the retention period of your Personal Data, please contact us via the contact details set out in this Privacy Notice.

Your rights with regard to your Personal Data

As the data subject, you have the following legal rights with regard to the Personal Data we collect from you, subject to the rules, methods and conditions under Personal Data Protection Laws:

Right to Obtain Information

You have the right to acquire information on the full identity, legal grounds, the purpose of the request, and the use of Personal Data, and the accountability of the party requesting Personal Data.

Right of Access

You have the right to access your Personal Data and may request that we provide you with a copy of such Personal Data in accordance with the requirements of the Personal Data Protection Laws.

Right to Data Portability

You have the right to obtain your Personal Data, including to request that your Personal Data be transmitted to another data controller or to you, except where it is technically unfeasible, in accordance with the requirements of Personal Data Protection Laws.

Right to Object

You have the right to object to a decision-making that is based solely on automated Processing of your Personal Data, including profiling, in accordance with the requirements of the Personal Data Protection Laws.

Right to Terminate Processing

You have the right to request that we terminate the Processing of your Personal Data, delete, and/or destroy your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Suspension/Restriction

You have the right to request that we suspend or restrict the Processing of your Personal Data in certain circumstances as prescribed under Personal Data Protection Laws.

Right to Rectification

You have the right to request that your Personal Data be rectified if your Personal Data is inaccurate, incomplete, not up-to-date, or may cause misunderstanding.

Right to Withdraw Consent

If we rely on your consent as the lawful basis for our Processing of your Personal Data, you have the right to withdraw such consent at any time.

Right to Lodge a Complaint

If you have reason to believe that we are in breach of Personal Data Protection Laws, you have the right to lodge a complaint to the data protection supervisory authority, in accordance with the rules, methods and conditions prescribed under the Personal Data Protection Laws.

If you wish to make a request to exercise your rights or have any questions or concerns about any aspect of our practices with regard to your Personal Data, you may contact us via our contact details in this Privacy Notice.

We reserve the right to consider your request to exercise your rights and act in accordance with the requirements under Personal Data Protection Laws.

Contact Us

If you have any questions in relation to this Privacy Notice, or would like to exercise your rights as set out in this Privacy Notice, please kindly use the contact form published on www.rmagroup.net.

You may also contact us through our Compliance Department via the following details:

E-mail	:	compliance@rmagroup.net
Telephone number	:	02129328045
Mailing address	:	Pondok Indah Office Tower 3, Lantai 6, Ruang 603, Jl. Sultan Iskandar Muda, Kelurahan Pondok Pinang, Kecamatan Kebayoran Lama, Kota Adm. Jakarta Selatan, Provinsi DKI Jakarta

Applicable Law

This Privacy Notice shall be governed by and construed in accordance with the laws of Republic of Indonesia. Indonesian courts shall have exclusive jurisdiction over any dispute that may arise out of or in connection with this Privacy Notice.

Changes to this Privacy Notice

To the extent permitted by law, we reserve the right to partly or fully amend or change this Privacy Notice, or simply to update its content, at any time and at our discretion. We may also make changes as required for compliance with change in applicable laws or regulatory requirements and may request for your consent (as necessary). Therefore, we encourage you to review the Privacy Notice whenever you access or use our services or otherwise interact with us to stay informed about our privacy practices and the ways you can protect your privacy.

Language

This Privacy Policy is made in English and Bahasa Indonesia versions. In the event of any discrepancy between the English language version and the Bahasa Indonesia versions of this Privacy Policy, the English language version shall prevail.

This Privacy Notice shall be effective from 1 January 2025.

[1] RMA Group includes any one or more of the following juristic entities: (1) PT Jasana Prima; (2) PT AVR Indonesia; (3) PT Global Fleet Sales Indonesia; and/or (4) PT Mitra Bisnis.

PERSONAL DATA PRIVACY NOTICEPT MITRA BISNIS

PERSONAL DATA PRIVACY NOTICE
PT MITRA BISNIS