PRIVACY POLICY

This Privacy Policy is created electronically to explain how PT Veloka Teknologi Indonesia and/or its affiliated platforms ("VelokaPay") collect, use, disclose, share, transfer, transmit, store, process, control, and protect Personal Data of Merchants, Users, and other related parties in accordance with applicable laws and regulations, including but not limited to:

- Law of the Republic of Indonesia No. 27 Year 2022 on Personal Data Protection ("PDP Law");

- Government Regulation No. 71 Year 2019 on the Implementation of Electronic Systems and Transactions ("PP PSTE");

- Minister of Communication and Informatics Regulation No. 20 Year 2016 on Personal Data Protection in Electronic Systems;

- Bank Indonesia regulations governing Non-Bank Fund Transfer Providers and Merchant Aggregators, including Anti-Money Laundering and Counter-Terrorism Financing (APU-PPT) and Payment System Consumer Protection provisions.

This Privacy Policy applies to all users of VelokaPay services, products, features, applications, systems, and websites (www.veloka.id) ("Services"), unless otherwise provided in a separate privacy policy that expressly governs a specific service or feature.

This Privacy Policy applies to all VelokaPay services, including but not limited to:

- Integration platforms and Merchant Aggregator dashboards;

- Payment APIs cooperating with licensed Payment Service Providers (PJP) regulated by Bank Indonesia;

- Official electronic communication channels of VelokaPay.

By using our Services, you give explicit consent to VelokaPay to process your Personal Data in accordance with this Policy. If you do not agree with part or all of this Privacy Policy, you are advised not to use our Services.

Unless otherwise defined, the following terms have the meanings set out below:

Personal Data means any data about an identified or identifiable individual either on its own or when combined with other information.

Processing of Personal Data means any activity of collecting, storing, modifying, deleting, disclosing, and/or distributing Personal Data.

User means an individual or legal entity that accesses, uses, or is registered on VelokaPay services.

Merchant means a party selling goods and/or services through payment services facilitated by VelokaPay.

Third Party means partners, affiliates, service providers, or other parties that cooperate with VelokaPay in providing services in accordance with legal requirements.

PJP (Payment Service Provider) means a party licensed by Bank Indonesia that cooperates with VelokaPay in providing electronic payment services.

VelokaPay may collect Personal Data directly from you or through authorized third parties. The Personal Data we may collect includes:

a. Identity Data: Full name, ID number (KTP/NIK), NPWP, date of birth, nationality, position, and digital signature.

b. Contact Data: Residential or business address, telephone number, and email address.

c. Merchant Business and Transaction Data: Business name, NIB, SIUP, corporate bank account, transaction data, transaction volumes, and customer data related to payment processing.

d. Technical and Device Data: IP address, operating system, browser type, cookies, activity logs, and geolocation data used by VelokaPay services.

VelokaPay may also collect data from other lawful sources, including business partners, financial institutions, or regulators in accordance with applicable laws.

VelokaPay uses Personal Data for the following purposes:

- Service Provision: To process payment transactions, settlements, and system integration for Merchants.

- Regulatory Compliance: To comply with KYC (Know Your Customer), APU-PPT (Anti-Money Laundering and Counter-Terrorism Financing), and reporting obligations to Bank Indonesia and other authorities.

- Transaction Security: To prevent fraud, abuse, and misuse of the system.

- Service Improvement: To perform data analysis for feature, performance, and user experience improvements.

- Communication: To send notifications, service updates, and administrative information related to platform use.

VelokaPay will not use Personal Data beyond the stated purposes unless with your written consent or as required by law.

VelokaPay stores Personal Data in data centers located within the territory of the Republic of Indonesia, in accordance with Government Regulation No. 71 Year 2019 on the Implementation of Electronic Systems and Transactions.

We implement reasonable technical and administrative security measures to protect Personal Data from loss, misuse, unauthorized access, alteration, and/or unlawful disclosure, including but not limited to:

- Data encryption systems;

- Internal access control;

- Regular security audits;

- Use of firewalls and intrusion detection systems.

VelokaPay may disclose Personal Data to the following parties as necessary to provide the Services:

- Business partners or PJPs that cooperate with VelokaPay in payment processing and settlement;

- Third-party service providers (such as hosting providers, KYC providers, or technical support providers) who are bound by confidentiality agreements;

- Government authorities or regulators, including Bank Indonesia, PPATK, or law enforcement agencies, when required by law;

- VelokaPay affiliates, where necessary for the operation and development of services.

VelokaPay will not sell, rent, or distribute Personal Data to other parties for commercial purposes without your explicit consent.

As a data subject, you have the following rights:

- Right to obtain information about the processing of your Personal Data;

- Right to complete, update, correct, or delete Personal Data;

- Right to withdraw consent for Personal Data processing;

- Right to object to certain processing of Personal Data that is not consistent with the original purpose;

- Right to file a complaint regarding alleged violations of Personal Data processing.

Requests can be submitted via VelokaPay's official email and will be handled in accordance with PDP Law procedures.

VelokaPay will retain Personal Data in accordance with the purpose of collection or for periods required by applicable laws and regulations, including reporting obligations to Bank Indonesia and tax regulations.

If Personal Data is no longer relevant or upon a lawful request, VelokaPay will delete the Personal Data securely in accordance with information security standards.

VelokaPay may update or amend this Privacy Policy from time to time to reflect service developments, technological changes, or legal requirements.

Any changes will be notified through the official website or application and will take effect as of the date announced. Continued use of our Services after such updates constitutes acceptance of the updated Policy.

If you have questions, complaints, or requests regarding your Personal Data, please contact us:

Address: Menara Citicon 6, Jl. Letjen. S. Parman Kav. 72, Desa/Kelurahan Slipi, Kec. Pal Merah, Kota Adm. Jakarta Barat, Provinsi DKI Jakarta

Email: customerservice@veloka.id