Privacy Policy

Your trust is the foundation of Our relationship with every customer, partner, and stakeholder. This Privacy Policy describes what Personal Data We Process, for what purposes and on what basis such Personal Data is Processed, and how You may exercise Your rights as a Personal Data Subject.

1. About This Privacy Policy

Summary. This Privacy Policy applies generally to the companies within Kawan Lama Group across all six business pillars and has been prepared in accordance with the PDP Law and GR 33/2026. Certain products or services may have specific privacy notices that supplement this Privacy Policy.

1.1 Who We Are

Kawan Lama Group is the identity of a multi-sector group of companies, each engaged in one of six business pillars, namely Industrial & Commercial, Consumer Retail, Food & Beverage, Property & Hospitality, Commercial Technology, and Manufacturing & Engineering, but united by a shared set of values and purpose: to provide a better life for families.

In this Privacy Policy, the terms “We,” “Us,” and “Our” refer to the legal entity within Kawan Lama Group that Processes Personal Data in connection with the relevant product, service, or activity. The Personal Data Controller of Your Personal Data is the company within Kawan Lama Group that determines the purposes and means of such Processing, which is generally the company that provides the product or service You use or that interacts directly with You. Membership of Kawan Lama Group alone does not make all companies within the group a single Personal Data Controller.

For the website www.kawanlamagroup.com (the “Website”), the Personal Data Controller is PT Kawan Lama Sejahtera. For other products, services, programs, locations, or activities, the name of the legal entity acting as Personal Data Controller, its address and contact details, and the channels for exercising rights are set out in the relevant privacy notice, form, application, or transaction document. A list mapping Personal Data Controllers to activities or services may be requested through the channels in Section 16.

Where two or more companies within Kawan Lama Group jointly determine the purposes and means of Processing Personal Data, those companies act as Joint Personal Data Controllers and shall set out in writing the allocation of responsibilities, the fulfilment of Personal Data Subjects’ rights, security, incident handling, and the contact person who may be approached. Where a company Processes Personal Data solely on behalf of, and on the instructions of, another Controller, that company acts as a Personal Data Processor.

1.2 Scope

This Privacy Policy applies to the Processing of Personal Data that We carry out when You:

(a) access the Website and other websites, applications, official social media accounts, and digital channels owned by Kawan Lama Group that state or refer to this Privacy Policy;

(b) purchase or use Our products and services, whether online or at Our stores, outlets, restaurants, shopping centers, properties, or other business premises;

(c) register for or participate in Our membership, loyalty, promotional, prize draw, event, or survey programs;

(d) contact Our customer service through any channel;

(e) interact with Us as a representative of a corporate customer, business partner, tenant, supplier, or vendor; or

(f) interact with Us in any other capacity, such as an investor, job applicant, or visitor.

This Privacy Policy does not apply to the Processing of the Personal Data of Kawan Lama Group employees, which is governed by separate internal policies, nor to third-party websites, applications, or services as described in Section 14.

1.3 Specific Privacy Notices

Certain products, services, or platforms of Kawan Lama Group—for example, electronic commerce platforms, financing services, or membership applications—have specific privacy policies or notices that contain additional details appropriate to the characteristics of the service and the applicable sectoral regulations. Such specific privacy notices supplement this Privacy Policy. In the event of any inconsistency, the provisions of the specific privacy notice shall prevail for the relevant product or service, provided that they afford protection no lower than that afforded by this Privacy Policy and applicable laws and regulations.

Where a company within Kawan Lama Group Processes Personal Data on behalf of, and on the instructions of, its corporate customer (for example, in providing solutions or services to business customers), that company acts as a Personal Data Processor, and such Processing is subject to the privacy policy of the relevant corporate customer in its capacity as Personal Data Controller.

1.4 Legal Basis and Terms

This Privacy Policy has been prepared on the basis of Law Number 27 of 2022 on Personal Data Protection (the “PDP Law”), Government Regulation Number 33 of 2026 on the Implementing Regulation of Law Number 27 of 2022 on Personal Data Protection (“GR 33/2026”), and other applicable laws and regulations. The terms “Personal Data,” “Specific Personal Data,” “Personal Data Controller,” “Personal Data Processor,” “Personal Data Subject,” “Personal Data Protection Failure,” “Child,” and “Agency” have the meanings given in the PDP Law and GR 33/2026. In this Privacy Policy, “You” means the Personal Data Subject whose Personal Data We Process.

2. Personal Data We Collect

Summary. We collect Personal Data in a limited and specific manner in accordance with the purposes of Processing. Personal Data originates from You directly, is recorded automatically when You use Our services, or is lawfully obtained by Us from third parties.

We collect Your Personal Data when You interact with Us, for example when You access this Website or Our other digital channels, complete forms in the Contact Us section or surveys, or otherwise provide data as required, make transactions, register for membership programs, or visit Our business premises. When doing so, You will be asked to enter information such as Your name, telephone number, email address, and other data as required for the service You request. We collect Personal Data from the following three sources:

(a) Data You provide directly, for example when You complete forms, create an account, place orders, participate in programs or events, or contact Us.

(b) Data recorded automatically when You use Our Website, applications, or services, for example device and usage data collected through cookies and similar technologies, and CCTV recordings at Our business premises.

(c) Data from third parties, for example other companies within Kawan Lama Group, payment and logistics partners, third-party login providers You choose, marketing partners, or publicly available sources, provided there is a lawful basis for Processing.

2.1 Categories of Personal Data

The Personal Data We Process depends on the product, service, and the way You interact with Us, and may include:

(a) Identity and contact data. Name, email address, telephone number, address, date of birth, gender, and official identity data such as national identity number or taxpayer identification number where required for certain transactions.

(b) Account and membership data. Username, password stored with cryptographic protection, membership number, points and redemption history, and account preferences.

(c) Transaction and payment data. Products or services purchased, transaction value and time, payment method, billing information, delivery, installation, warranty, and returns. Personal financial data constitutes Specific Personal Data and is therefore Processed by Us with stricter safeguards. Payment card data is Processed by licensed payment service providers, and We do not store card security codes (CVV/CVC).

(d) Location data. Delivery address, selected store or outlet, approximate location inferred from IP address, and precise device location only where You grant permission through Your device settings.

(e) Device and usage data. IP address, device identifiers, browser type and operating system, pages visited, access times, and Your interactions with Our Website, applications, and communications (see Section 11).

(f) Communications and customer service data. The content of Your inquiries, requests, complaints, and correspondence with Us, including recordings of telephone or chat conversations of which You have been notified in advance.

(g) Preference, review, and participation data. Interests, product preferences, reviews, ratings, survey responses, and data regarding Your participation in promotions, prize draws, competitions, or events.

(h) Images and visual recordings. CCTV recordings at Our business premises and photographs or videos taken at events We organize (see Section 12).

(i) Business partner data. Name, position, business contact details, and related information of representatives of corporate customers, partners, tenants, suppliers, and vendors, including data required in procurement and due diligence processes.

(j) Job applicant data. Curriculum vitae, education, work experience, and other information You provide in the recruitment process, which is Processed in accordance with the privacy notice on Our recruitment channels.

(k) Specific Personal Data. We Process Specific Personal Data—such as personal financial data, Children’s data, health data, or biometric data—only where genuinely necessary for a particular product, service, or activity, a lawful basis for Processing is available, and additional safeguards are applied. Before any Processing required by laws and regulations, We conduct a Personal Data Protection impact assessment.

Not every category is Processed by every company or service within Kawan Lama Group.

2.2 Mandatory and Optional Personal Data

Some Personal Data is mandatory because it is necessary to provide the services You request or to comply with legal obligations. If You do not provide it, We will be unable to provide the relevant services or features. Other Personal Data is optional; if not provided, certain features such as personalization may not function optimally, but You will still be able to use Our core services. We will indicate mandatory Personal Data on the data collection form or screen.

Where You provide Us with the Personal Data of another person (for example, the name and address of an order recipient or an emergency contact), You represent that You have informed that person accordingly and have a lawful basis for providing their Personal Data to Us.

3. Purposes and Methods of Use of Personal Data

Summary. We use Personal Data only for clear and lawful purposes that We have communicated to You—primarily to provide products and services, respond to Your requests, maintain security, and comply with legal obligations.

Personal Data that We obtain from You will be used for the following purposes:

(a) Providing products and services. Processing orders, payments, delivery, installation, warranties, after-sales services, reservations, leases, and other services You request, including contacting You regarding such transactions.

(b) Managing accounts and membership programs. Creating and managing accounts, verifying identity, and administering the membership or loyalty programs in which You participate, including the recording and redemption of points.

(c) Responding to Your requests. Better addressing Your individual needs, such as answering Your questions, requests for information, or complaints.

(d) Improving services. Improving the quality and features of the Website, products, and services, based on the feedback You provide and usage analysis that, to the extent possible, uses aggregated or pseudonymised data.

(e) Personalization. Presenting relevant content, product recommendations, and offers based on Your preferences and interaction history. Personalization may involve automated Processing, including profiling, but is not used to make decisions that produce legal consequences or significantly affect You without the mechanisms described in Section 9.

(f) Marketing and promotional communications. With Your consent, sending product information, promotions, and event information from companies within Kawan Lama Group (see Section 10).

(g) Security and fraud prevention. Protecting You, other customers, employees, and Our assets, including detecting and preventing fraud, promotional abuse, unauthorized transactions, and cybersecurity threats, as well as maintaining security and safety at Our business premises.

(h) Legal compliance. Fulfilling obligations under laws and regulations, such as transaction record-keeping, taxation, consumer protection, and responding to requests from competent authorities in accordance with legal procedures.

(i) Business operations. Conducting analysis, reporting, audits, and risk management, and developing new products and services, to the extent possible using aggregated or pseudonymised data.

(j) Partnerships and procurement. Managing relationships with corporate customers, partners, tenants, suppliers, and vendors, including procurement, due diligence, and contract performance.

(k) Recruitment and investor relations. Processing job applications, responding to inquiries, and fulfilling disclosure obligations to investors and stakeholders.

If We intend to Process Personal Data for a new purpose that is incompatible with the original purpose of collection, We will notify You in advance and, where necessary, seek Your consent.

In carrying out the above purposes, We may use new technologies, including artificial intelligence, for example for automated chat-based customer service or product recommendation analysis. The use of such technologies is preceded by a Personal Data Protection impact assessment where it is likely to give rise to a high risk, and is carried out with adequate human oversight.

4. Basis for Processing Personal Data

Summary. Every Processing of Personal Data by Us has a lawful basis. We do not consider Your consent to have been given merely because You browse or continue to use the Website.

In accordance with the PDP Law and GR 33/2026, before Processing Your Personal Data We ensure that one or more of the following bases for Processing exist:

(a) Your explicit and valid consent for one or more specific purposes that We have communicated to You;

(b) fulfilment of contractual obligations where You are a party, or to fulfil Your request at the time of entering into a contract;

(c) fulfilment of Our legal obligations in accordance with laws and regulations;

(d) protection of Your vital interests;

(e) performance of a task in the public interest, public service, or the exercise of authority under laws and regulations; and/or

(f) fulfilment of other legitimate interests, having regard to the purposes, needs, and balance between Our interests and Your rights.

4.1 Summary of Purposes, Types of Data, and Bases for Processing

4.2 Consent

Where Processing is based on consent, We will: (a) first provide concise and clear information regarding the purposes, types of Personal Data, recipients, and Your rights; (b) request explicit and specific consent for each purpose, separate from other terms—for example through a checkbox that is not pre-ticked, a settings toggle, or a signature on a form; (c) retain evidence of consent; and (d) enable You to withdraw consent at any time through an easily accessible channel. We do not infer Your consent from silence, pre-ticked boxes, or the act of browsing the Website. Withdrawal of consent does not affect the lawfulness of Processing carried out prior to withdrawal.

4.3 Legitimate Interests and the Principle of Non-Discrimination

Where We rely on legitimate interests, We conduct and document a balancing assessment to ensure that such interests do not override Your rights and interests. You may object to such Processing through the channels in Section 16, and We will follow up in accordance with Your rights under applicable laws and regulations. We also ensure that the Processing of Personal Data is not discriminatory towards You.

5. Disclosure of Personal Data

Summary. We do not sell Your Personal Data. We disclose Personal Data only to companies within Kawan Lama Group, service providers acting on Our behalf, partners involved in the services You request, or competent authorities, to the extent necessary and with adequate safeguards.

We are committed to safeguarding Your Personal Data to the best of Our ability and do not sell, rent, or trade Your Personal Data to any party.

We disclose Your Personal Data to other parties only to the extent necessary for the relevant purposes and on a lawful basis for Processing, in the following circumstances:

(a) Companies within Kawan Lama Group. Personal Data may be shared to fulfil Your requests or support shared functions, to the extent necessary and on a lawful basis for Processing. Each recipient company acts in accordance with its role: as a Processor if it Processes solely on the Controller’s instructions; as an independent Controller if it determines its own purposes and means of Processing; or as a Joint Controller if the purposes and means are determined jointly. Such roles and responsibilities are documented in appropriate arrangements; affiliate status does not in itself constitute a basis for Processing.

(b) Personal Data Processors. Service providers that Process Personal Data on Our behalf and on Our instructions, such as providers of cloud computing and technology infrastructure, messaging, customer service, analytics, marketing, and security. Processing is governed by a written agreement covering instructions and scope, purpose and duration, categories of Personal Data, confidentiality, security, assistance with fulfilling rights and handling incidents, deletion or return of data, and audit/oversight. Processors engage other Processors only in accordance with the applicable consent and written arrangements.

(c) Partners involved in Your services. Parties acting as independent controllers in providing the services You request, such as banks and payment service providers, logistics and courier companies, financing or insurance providers, and brand owners or principals for warranty purposes. Such parties are subject to Personal Data Protection obligations under laws and regulations and their respective privacy policies.

(d) Law enforcement, regulators, and competent authorities. Where required by laws and regulations, a court decision or order, or an official request from a competent authority in accordance with the procedures prescribed by laws and regulations, and to enforce Our legal rights or protect Your safety and that of others.

(e) Corporate actions. In connection with a merger, consolidation, acquisition, spin-off, dissolution, or transfer of business. Before Personal Data is transferred, We will conduct an assessment in accordance with GR 33/2026.

(f) With Your consent or at Your request. For example, where You ask Us to send Personal Data to another party or to link Your account with a third-party service.

(g) Vital interests. To protect Your vital interests or those of another person, for example in an emergency that threatens life.

For analytics, research, or reporting to partners, We will, to the extent possible, disclose only aggregated or anonymised data that cannot be used to identify You.

6. Storage Location and Transfer of Personal Data

Summary. Your Personal Data is stored and Processed in Indonesia and, in certain cases, abroad through Our service providers. Any transfer outside the jurisdiction of Indonesia is carried out with a risk assessment and protection mechanisms in accordance with GR 33/2026.

Your Personal Data is stored on systems managed by Us or by Our service providers. We may transfer Personal Data to recipients within the jurisdiction of Indonesia as described in Section 5, ensuring that the recipients implement Personal Data Protection in accordance with laws and regulations.

In certain cases, Personal Data may be transferred, stored, or Processed outside the jurisdiction of Indonesia, for example for the use of cloud computing services, software as a service, analytics, messaging, technical support, or cooperation with brand principals abroad.

Before making a transfer outside the jurisdiction of Indonesia, We map the destination country, the recipient, the categories of Personal Data, the purpose and basis of Processing, and the protection instruments used; ensure that the Personal Data transferred is limited to what is necessary; and document the legal and risk assessment and its impact on Your rights. A transfer is made only where:

(a) the country in which the recipient is domiciled has a level of Personal Data Protection that is equivalent to or higher than that provided under the PDP Law;

(b) if paragraph (a) is not satisfied, adequate and binding Personal Data protection exists, such as standard contractual clauses or binding corporate rules for corporate groups; or

(c) if neither paragraph (a) nor paragraph (b) is satisfied, We obtain Your consent in compliance with the requirements prescribed in GR 33/2026.

Transfers of Personal Data abroad may carry risks, including differences in legal protection standards in the recipient country and the possibility of access by local authorities. To mitigate these risks, We implement appropriate technical and contractual measures, such as encryption and access restrictions, and periodically evaluate the protections. Information regarding the destination countries, categories of recipients, purposes of transfer, and applicable protection mechanisms may be requested through the channels in Section 16, subject to the security and confidentiality of the information of other parties.

7. Processing Period and Deletion

Summary. We Process and retain Personal Data only for as long as necessary to achieve the purposes of Processing or to comply with legal obligations.

The period of Processing and retention of Personal Data is determined based on the purpose and category of data, for example for as long as an account or membership is active, a transaction and after-sales service is ongoing, or for the period required by laws and regulations.

We will delete, destroy, or anonymise Personal Data when the Personal Data is no longer necessary for the purposes of its Processing, or You withdraw consent for Processing based on consent, or You submit a deletion request—unless retention is still required by laws and regulations or is necessary for dispute resolution, fraud prevention, or the exercise of Our legal rights. We document the deletion and destruction of Personal Data in accordance with the provisions of laws and regulations.

Data that has been anonymised such that it can no longer be used to identify You is no longer Personal Data and may be used by Us for statistical and analytical purposes.

8. Security of Personal Data

Summary. We protect Personal Data with technical and organizational measures appropriate to the level of risk, and maintain procedures for handling and giving notification of Personal Data Protection Failures.

8.1 Security Measures

We have implemented technologies and policies intended to protect Your Personal Data from unauthorized access, disclosure, alteration, misuse, damage, and loss, including through encryption, pseudonymisation, need-based access control, firewalls and security monitoring, confidentiality obligations for employees and partners, Personal Data Protection training, and periodic security audits and evaluations. We will update these measures as technology and risks evolve.

Before carrying out Processing that is likely to give rise to a high risk—for example the Processing of Specific Personal Data, large-scale Processing, profiling or systematic monitoring, combining datasets, or the use of new technologies—We conduct a Personal Data Protection impact assessment. We also appoint a Personal Data Protection Officer who is responsible for monitoring and ensuring Our compliance with laws and regulations in the field of Personal Data Protection.

You also play an important role in keeping Your Personal Data secure, among other things by keeping Your password and One-Time Password (OTP) codes confidential, not disclosing them to anyone, including persons claiming to be Our representatives, and contacting Us promptly if You suspect account misuse.

8.2 Handling of Personal Data Protection Failures

In the event of a Personal Data Protection Failure, We will:

(a) give written notification to You and the Agency no later than 3 x 24 (three times twenty-four) hours from the time the Personal Data Protection Failure becomes known to the Personal Data Controller, in accordance with the PDP Law and its implementing regulations. The notification shall contain, at a minimum, the Personal Data that was disclosed, when and how it was disclosed, the handling and recovery efforts undertaken, and a contact person who may be approached;

(b) undertake handling and recovery efforts as soon as possible to minimize the impact on You;

(c) give notification to the public where the Personal Data Protection Failure disrupts public services and/or seriously affects the interests of the wider community; and

(d) document each Personal Data Protection Failure in accordance with the provisions of laws and regulations.

9. Your Rights and How to Exercise Them

Summary. You have rights as a Personal Data Subject under the PDP Law and GR 33/2026. You may exercise those rights through features in Your account or by submitting a request to Us, and We will follow up within the period prescribed by laws and regulations.

9.1 Your Rights

(a) Right to information. To obtain information about the clarity of identity, the legal interest basis, the purpose of the request for and use of Personal Data, and the accountability of the party requesting Personal Data.

(b) Right to complete, update, and rectify. To complete incomplete Personal Data and to update and/or rectify errors or inaccuracies in Your Personal Data.

(c) Right of access and to obtain a copy. To obtain access to and a copy of Your Personal Data.

(d) Right to terminate Processing and to erasure. To terminate Processing and to erase and/or destroy Your Personal Data, including closing Your account.

(e) Right to withdraw consent. To withdraw the consent You have given to the Processing of Personal Data. We will cease Processing based on that consent and notify You that the cessation has been carried out.

(f) Right to postpone or restrict Processing. To postpone or restrict the Processing of Your Personal Data proportionately to the purpose of Processing.

(g) Right to interoperability. To obtain and/or use Your Personal Data in a form that conforms to a commonly used structure and/or format or that is readable by electronic systems, and to transmit it to another Personal Data Controller, provided that the systems used can communicate securely with each other.

(h) Right to submit a report to the Agency. To submit a report or complaint to the Agency if You consider that We have not fulfilled Our Personal Data Protection obligations.

9.2 How to Submit a Request

You may exercise some of the above rights independently through features in the relevant account, application, or site, such as profile settings, communication preferences, device permissions, or account deletion. For other rights, You may submit a recorded request electronically by email or form through the channels listed in Section 16, or non-electronically by letter to Our address.

A request may be submitted by You personally, by a parent or guardian where the Personal Data Subject is a Child, by a guardian where the Personal Data Subject is a person with a disability, or by a party You have authorized. A request shall contain, at a minimum, the identity of the requester, the right sought to be exercised together with an explanation of Your interest, and a description of the request in respect of the Personal Data We Process.

To protect Your Personal Data, We will carry out proportionate identity verification before fulfilling a request. We will respond to and fulfil requests within the period prescribed for the relevant type of right under the PDP Law, GR 33/2026, and related regulations. The 3 x 24 (three times twenty-four) hour period applies only to actions or rights that are expressly subject to that period under applicable regulations, such as the updating or rectification of Personal Data, access to and copies of Personal Data, withdrawal of consent, and the postponement or restriction of Processing. That period is not deemed to apply uniformly to all types of requests. Where a request requires clarification or cannot be fulfilled in full, We will provide the relevant information in accordance with legal requirements.

The exercise of rights is in principle free of charge. We may refuse or postpone the fulfilment of a request in cases exempted by laws and regulations, for example in the interest of law enforcement proceedings or where fulfilling the request would disclose the Personal Data of another person, and We will notify You of the refusal together with the reasons. The fulfilment of certain rights, such as account deletion or withdrawal of consent, may mean that certain features or services can no longer be used by You; We will explain these consequences before processing Your request.

10. Marketing, Advertising, and Communication Preferences

Summary. By agreeing to the Privacy Notice and/or Privacy Policy applicable to the products, services, and/or subsidiaries under Kawan Lama Group, We may send You marketing communications and display personalized advertisements to You.

Summary. Marketing communications and personalized advertising are managed on the basis of Your choices and the applicable basis for Processing; consent for these is separate from Your acknowledgment that You have read the Privacy Policy.

By agreeing to the Privacy Notice and/or Privacy Policy applicable to the products, services, and/or subsidiaries under Kawan Lama Group, We may Process Your Personal Data in order to:

(a) send information, promotions, offers, loyalty programs, surveys, and other marketing communications relating to Our products and/or services through various communication channels, including but not limited to electronic mail (email), short message service (SMS), instant messaging applications, push notifications, telephone, and social media; and

(b) display personalized advertisements based on Your preferences, interests, and interaction history, both on Our own platforms and on third-party platforms, including through the use of cookies and similar technologies.

The Processing of Personal Data referred to above is carried out in accordance with the provisions of laws and regulations in force in the Republic of Indonesia.

You may stop receiving marketing communications at any time through the unsubscribe link in each email, through Your account or application settings, or by contacting the customer service available on the relevant channel or platform. This choice does not affect necessary service communications, such as transaction confirmations, delivery information, or important notices relating to Your account and this Privacy Policy. Withdrawal of consent does not affect the lawfulness of the Processing of Personal Data carried out before such withdrawal.

Personalized advertising. We and Our advertising partners may use cookies, device identifiers, and information about Your interactions to display more relevant advertisements for Kawan Lama Group products on third-party sites, applications, or social media, and to measure campaign effectiveness.

11. Cookies and Similar Technologies

Summary. We use cookies that are strictly necessary for the Website to function. Other cookies, such as analytics and advertising cookies.

When You visit Our Website, We may store small pieces of data from the Website on Your device in the form of cookies, the purposes of which include recognizing You on subsequent visits. Cookies can help Us operate the basic functions of the Website, remember Your preferences, and tailor the Website to better suit Your interests, as well as make Your browsing experience on this Website smoother and more enjoyable.

The cookies and similar technologies We use are grouped as follows:

(a) Strictly necessary cookies, to perform basic functions such as security, server load balancing, and storing Your cookie choices. These cookies cannot be disabled through Our settings because the Website cannot function without them.

(b) Functional cookies, to remember the preferences You have selected, such as language and display settings.

(c) Analytics cookies, to understand how visitors use the Website and to measure its performance.

(d) Advertising and social media cookies, to display relevant advertisements, enable You to share content to social media, and measure campaign effectiveness, including third-party cookies from Our partners.

In addition, You may configure Your internet browser to delete all cookies from Your device, block all cookies, or receive a warning before cookies are stored. Please note that blocking strictly necessary cookies may cause some features of the Website not to function properly.

12. CCTV Recordings and Documentation at Business Premises

Summary. We install CCTV at Our business premises for Your security and safety.

We install visual data processing devices (CCTV) at stores, outlets, restaurants, shopping centers, properties, warehouses, and other business premises for purposes of security, safety, and disaster prevention. We require Our stores, outlets, restaurants, shopping centers, properties, warehouses, and other business premises to display notices in the monitored areas. CCTV recordings are not used by Us to identify an individual, except for the prevention of criminal acts and law enforcement proceedings in accordance with the provisions of laws and regulations.

Access to CCTV recordings is restricted to authorized personnel, and recordings are retained in accordance with the security policy of each location, unless a longer period is required for incident investigations or legal proceedings. Recordings are disclosed only to competent authorities in accordance with the provisions of laws and regulations.

At events We organize, We may take photographs or videos for documentation and publication. We will notify You of this in advance and, where necessary, seek Your consent. You may request not to be documented or request that Your image not be published.

13. Children’s Personal Data

Summary. The Processing of a Child’s Personal Data requires the consent of a parent or guardian, and We apply special protections to it.

The Website and most of Our digital services are intended for users who are 18 (eighteen) years of age or older. However, some of Our products and services—for example children’s products, family events, or educational programs—may involve a Child, namely a person who is under 18 (eighteen) years of age.

Before Processing a Child’s Personal Data, We take reasonable steps to identify whether the Personal Data Subject is a Child in accordance with the purpose of Processing, and We Process a Child’s Personal Data only with the consent of a parent and/or guardian that We have verified. A Child’s Personal Data constitutes Specific Personal Data, and We therefore limit its collection to what is genuinely necessary.

A parent or guardian may exercise rights over a Child’s Personal Data, including withdrawing consent and requesting deletion, through the channels in Section 16. If We become aware that We have Processed a Child’s Personal Data without the consent of a parent or guardian, We will cease Processing and delete such Personal Data, unless otherwise required by laws and regulations. When a Child reaches the age of majority, We provide procedures to enable the individual to manage their own Personal Data.

14. Third-Party Links and Services

Summary. Third-party sites and services accessible through Our channels are subject to the privacy policies of those third parties.

Our Website and digital channels may contain links to sites, applications, or services managed by third parties, such as social media, payment providers, or partner sites. The Processing of Personal Data that You provide directly to those third parties is carried out by the relevant third party and is subject to its own privacy policy. We encourage You to exercise caution and to read the privacy policies applied by sites or services outside Our Website before providing Your Personal Data.

If You log in to Our services using a third-party account, We receive certain Personal Data from that provider in accordance with the permissions You have granted to that provider.

15. Changes to the Privacy Policy

Summary. Changes to the Privacy Policy as they relate to You.

We may amend the contents of this Privacy Policy from time to time, for example due to changes in laws and regulations, products and services, or Our Personal Data Processing practices. Any changes will be posted on this page by updating the “Last updated” date at the top of this Privacy Policy. If We make substantial changes—such as changes to the purposes of Processing, the types of Personal Data, or the recipients—We will provide a prominent notice through the Website, email, or application notification, and where such changes require consent, We will seek Your consent again.

Previous versions of this Privacy Policy may be requested through the channels in Section 16.

16. How to Contact Us

Summary. Contact Our Personal Data Protection Officer for questions, requests to exercise rights, or complaints relating to Your Personal Data.

If You have questions about this Privacy Policy, wish to exercise Your rights as referred to in Section 9, or believe that Your Personal Data has been Processed in a manner inconsistent with this Privacy Policy, You may contact the Personal Data Protection Officer (DPO) of Kawan Lama Group through:

Customer service email: group.custcare@kawanlamacorp.com

Telephone: (021) 582 82 82

Postal address: Kawan Lama Group, Attn: Personal Data Protection Officer, Jl. Puri Kencana No. 1, Kembangan Selatan, Kembangan District, West Jakarta City, Special Capital Region of Jakarta 11610

For products or services that have a specific privacy notice, You may also contact the channels listed in that notice. If a request is received through the group channel but is addressed to another Controller within Kawan Lama Group, the request will be forwarded to the relevant Controller and You will be informed of the follow-up channel where necessary. We will respond to requests within the periods and in accordance with the procedures prescribed by laws and regulations.

This Privacy Policy is available in Bahasa Indonesia and English. In the event of any difference in interpretation, the Bahasa Indonesia version shall prevail.