PRIVACY POLICY - PT GAJAH TUNGGAL Tbk
Prepared for alignment with Indonesia Law No. 27 of 2022 on Personal Data Protection and, where applicable, Regulation (EU) 2016/679 (GDPR).
1. Privacy Statement
PT Gajah Tunggal Tbk ("GT" or the "Company") is committed to protecting the Personal Data of individuals who interact with the Company, including employees, job applicants, outsourced personnel, contract workers, customers, distributors, suppliers, contractors, consultants, business partners, visitors, shareholders, website users, and other relevant individuals ("Data Subjects").
This Policy explains how GT obtains, collects, uses, analyses, stores, corrects, updates, displays, discloses, transfers, deletes and/or destroys Personal Data in connection with its business and operational activities, including manufacturing, employment, safety and security, procurement, sales and distribution, supplier and customer relations, information systems, facility visits, and other corporate activities.
This Policy is prepared with reference to Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (the "PDP Law"), its implementing regulations and other applicable laws, and the General Data Protection Regulation ("GDPR") to the extent the GDPR applies to GT's processing activities.
2. Scope
This Policy applies to Personal Data processing carried out by GT through electronic and non-electronic systems. Depending on the processing context, GT may act as a Personal Data Controller and/or Personal Data Processor. In third-party arrangements, the respective roles and responsibilities shall be determined according to the nature of the processing and applicable law.
3. Personal Data Protection Principles
1. Processing is carried out in a limited, specific, lawful, fair and transparent manner and for defined purposes.
2. Personal Data collected is adequate, relevant and limited to what is necessary for the processing purposes.
3. Personal Data is maintained so that it is accurate, complete, not misleading, up to date and accountable.
4. GT respects and facilitates Data Subject rights in accordance with applicable law.
5. GT implements appropriate technical and organisational measures to preserve the confidentiality, integrity, availability and security of Personal Data.
6. Personal Data is retained only for as long as necessary for the processing purpose or as required/permitted by law.
7. GT maintains accountability and the ability to demonstrate compliance in its Personal Data processing activities.
4. Categories of Data Subjects
Data Subjects may include employees and former employees, job applicants, interns, outsourced personnel, vendor and contractor personnel, customers, distributors, dealers, suppliers, consultants, business partners, facility visitors, event participants, shareholders, corporate contacts, website users, and other individuals connected with GT's activities.
5. Types of Personal Data Processed
1. Identity and contact data, such as name, address, telephone number, email address, place/date of birth, nationality, gender, marital status, photograph, signature, and official identification data such as national ID, passport and residence permits.
2. Employment and professional data, including employment history, education, competencies, certifications, evaluations, position, employee identification number, attendance, facility access and employment administration information.
3. Financial and tax data, including bank account details, payments, compensation, tax identification numbers, transactions, claims, reimbursements and other information required for financial administration.
4. Specific/sensitive data where relevant and legally permitted, including health data, biometric data such as fingerprints or facial recognition, criminal record/background verification data, children's data and personal financial data.
5. Physical and electronic security data, including CCTV, access control, visitor logs, badge/ID access, security records, IP addresses, device identifiers, network/security logs and use of Company systems.
6. Other Personal Data reasonably necessary and relevant to the processing purposes communicated to the Data Subject.
6. Sources of Personal Data
GT may obtain Personal Data directly from Data Subjects or from other lawful sources, such as affiliated companies, employers/vendors, distributors, customers, business partners, service providers, government authorities, public sources, professional references, security systems, or other parties lawfully providing Personal Data to GT.
7. Purposes of Personal Data Processing
1. Managing employment relationships, recruitment, remuneration, benefits, competencies, training, occupational health and safety, and HR administration.
2. Managing facility access and security, including visitor management, CCTV, access control, security investigations, safety and asset protection.
3. Conducting procurement, vendor management, contracting, supplier evaluation, payments and commercial relationships.
4. Conducting sales, distribution, customer service, business communications and relationships with customers, distributors, dealers and partners.
5. Operating and securing information systems, networks, devices, applications, IT services, backups, logging, monitoring and incident handling.
6. Complying with legal, tax, employment, safety, audit, investigation, regulatory, authority and other legal requirements.
7. Conducting corporate governance, internal/external audits, risk management, compliance, reporting, whistleblowing, fraud prevention and enforcement of internal policies.
8. Conducting corporate communications, events, CSR and marketing where an appropriate legal basis exists.
8. Lawful Bases for Processing
GT processes Personal Data only where a lawful basis applies. Such basis may include valid explicit consent; performance of or steps prior to a contract; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest or exercise of authority under applicable law where relevant; and/or other legitimate interests, taking into account the purposes, necessity and balance between GT's interests and Data Subject rights.
For processing subject to the GDPR, GT will determine a lawful basis under Article 6 GDPR and, where special categories of personal data are processed, satisfy the relevant additional conditions under Article 9 GDPR.
9. Data Subject Rights
1. Obtain information concerning the identity of the processing party, legal interests/basis, processing purposes and accountability.
2. Request access to and obtain a copy of Personal Data in accordance with applicable law.
3. Request completion, updating and/or correction of inaccurate Personal Data.
4. Withdraw consent where processing is based on consent.
5. Request cessation of processing, deletion or destruction of Personal Data where legally applicable.
6. Request suspension or restriction of processing proportionately in accordance with applicable law.
7. Object to decisions based solely on automated processing, including profiling, in accordance with applicable law.
8. Receive and/or transmit Personal Data (data portability) where the right applies and legal requirements are met.
9. Lodge a complaint, pursue legal remedies and/or claim compensation in accordance with applicable procedures and law.
The exercise of a right may be limited or exempted where permitted by law. GT may verify identity and request information reasonably necessary before processing a rights request.
10. Retention, Deletion and Disposal
GT retains Personal Data only for as long as necessary to achieve the processing purpose and to satisfy contractual, legal, regulatory, audit, evidentiary, dispute-resolution or legitimate business requirements. Retention periods are determined based on the type of data, processing purpose, risks and relevant legal requirements.
After the retention period expires and no lawful basis exists for further retention, Personal Data will be deleted, disposal, anonymised or otherwise handled in accordance with GT's retention and disposal procedures.
11. Disclosure and Third-Party Processing
GT may disclose Personal Data to affiliated companies, IT/cloud service providers, banks, insurers, benefit providers, consultants, auditors, certification bodies, vendors, contractors, distributors, customers, business partners, government authorities, law enforcement, regulators or other parties where necessary for the processing purposes and supported by an appropriate legal basis.
Where a third party acts as a Personal Data Processor on behalf of GT, GT will establish relevant data protection, confidentiality, security, sub-processor, return/deletion and other obligations through appropriate contractual arrangements and oversight mechanisms.
12. Cross-Border Personal Data Transfers
GT may transfer Personal Data outside the Republic of Indonesia where necessary for business activities, systems, group services, service providers, customers, suppliers or other lawful purposes. Such transfers will be carried out in accordance with the PDP Law requirements concerning equivalent or higher levels of protection, adequate and binding safeguards, and/or Data Subject consent where required.
Where a transfer is subject to the GDPR, GT will use a lawful transfer mechanism under Chapter V GDPR, including an adequacy decision or appropriate safeguards such as Standard Contractual Clauses where relevant.
13. Personal Data Security
GT implements risk-appropriate technical and organisational measures, including access controls, least privilege, identity and authentication management, network and endpoint security, logging and monitoring, backup and recovery, physical protection, vulnerability management, secure system development, vendor management, training and awareness, and incident response procedures.
14. Personal Data Breach
In the event of a Personal Data breach, GT will identify, contain, mitigate and document the incident and notify affected Data Subjects and/or competent authorities in accordance with the requirements and timelines prescribed by applicable law.
For processing subject to the GDPR, breach assessment and notification will be handled in accordance with Articles 33 and 34 GDPR, including notification to the supervisory authority without undue delay and, where required, to affected Data Subjects.
15. Automated Processing and Profiling
Where GT uses automated processing or profiling that produces decisions having legal or similarly significant effects on individuals, GT will apply safeguards and Data Subject rights mechanisms in accordance with applicable law. GT does not treat every use of automated technology as automatically falling within this category.
16. Cookies and Similar Technologies
GT websites or electronic services may use cookies or similar technologies for technical functionality, security, analytics, user preferences and, where relevant, marketing. Further information regarding cookie categories, purposes, duration and user choices may be provided in a separate Cookie Notice.
17. Marketing and Communications
Where GT processes Personal Data for direct marketing, GT will rely on an appropriate lawful basis and provide a mechanism to withdraw consent or opt out of marketing communications where required by law.
18. Data Protection Impact Assessment and Privacy by Design
GT performs privacy risk assessments and, where required or appropriate based on processing risk, a Data Protection Impact Assessment (DPIA) before processing likely to result in high risk to Data Subjects. Privacy by design and privacy by default principles are considered in the development or modification of processes, systems, technologies, products and services involving Personal Data.
19. Data Protection Officer
GT designates an officer or function responsible for Personal Data protection where required by applicable law and/or based on the Company's governance needs. Questions, rights requests, complaints or privacy correspondence may be submitted through the following contact: [DPO's email]
20. Policy Updates
GT may update this Privacy Policy from time to time to reflect changes in processing activities, organisation, technology, risks or legal requirements. The latest version will be made available through GT's official communication channels and will state its effective or last-updated date.