PT Bank Mayapada Internasional, Tbk, also known as Bank Mayapada ("we", "our", "Company" or "Bank") as a banking company licensed and supervised by the Financial Services Authority intends to provide quality services to you to meet your expectations, and we recognise the importance of compliance with Law No. 27 of 2022 on Personal Data Protection and related laws and regulations.

We value your privacy and the importance of protecting your personal data. We hereby inform you, as a personal data subject, about the protection of personal data and your rights as a personal data subject which are:

1. Individuals who are in contact with the Bank, either as prospective customers, customers, or former customers of the Bank;
2. Natural persons, who are permanent and/or non-permanent employees, outsourced employees, officers, representatives, shareholders, directors, beneficial owners, administrators (in the context of postponement of debt payment obligations), curators (in the context of bankruptcy), liquidators (in the context of dissolution of a business entity), contact person, agent, or any person associated with, a legal entity or natural person as mentioned in (1) above, a guardianship (of children or those under guardianship) or a group of people who interact with the Bank, whether as prospective customers, customers or former customers of the Bank;
3. Natural persons, who are shareholders, former shareholders or prospective shareholders of the Bank, or persons related to them;
4. Individuals, who are prospective employees, permanent and/or non-permanent employees, outsourced employees, former employees, officers, directors or commissioners of the Bank, former officers, directors or commissioners of the Bank or prospective directors or commissioners of the Bank or persons related thereto;
5. Individuals related to the Bank, who are permanent and/or non-permanent employees, outsourced employees, officers, representatives, shareholders, directors, beneficial owners, administrators (in the context of postponement of debt payment obligations), curators (in the context of bankruptcy), liquidators (in the context of dissolution of a business entity), contact persons, agents, or any person related either as a provider of goods and/or services, former provider of goods and/or services, or prospective provider of goods and/or services to the Bank;

about the protection of your personal data received or to be received by the Bank in the course of its business activities and provision of services through the Bank's branches, websites, telephones, electronic channels, applications, social media or other sources of information, in order to ensure you that the Bank will safeguard your personal information, and will obtain, collect, use or disclose your personal information only if the Bank considers it necessary, correct and appropriate, the legal basis for the Bank in processing your personal data and personal data protection measures and to inform you of your rights as a personal data subject as set out in this Personal Data Protection Notice.

Scope
This policy applies to the websites, domains, applications, services and/or products of PT Bank Mayapada Internasional, Tbk.

This policy does not apply to third party applications, websites, products, services or platforms accessible through links (non-PT Bank Mayapada Internasional, Tbk.) that we provide. These sites are independently owned and operated from us, and have their own privacy and data collection practices. Any Personal Data you provide to these sites will be governed by those third parties' privacy policies. We cannot accept responsibility for the actions or policies of these independent sites, and we are not responsible for their content or privacy practices.

Processing Activities
This policy applies when you interact with us, such as:

• Use our apps and services as an authorised user
• Visit our websites linked to this Privacy Statement

Personal Data We Collect
When you make a purchase, or attempt to make a purchase, we collect the following types of Personal Data:

• Account information, such as name, email address, and password
• Payment Information, such as billing address, phone number, credit card, debit card, or other payment methods

When you use our products and/or features, we collect the following types of Personal Data:

1. Account information, such as name, email address, and password
2. Payment Information, such as billing address, phone number, credit card, debit card, or other payment methods

How We Collect Your Personal Data
We collect Personal Data from the following sources:

1. From You. You may provide Account Information, Payment Information, Demographic Data, Purchase Information, Content, Feedback and Product Information to us by:
   • Fill out the form
   • Using our products or services
   • Fill out information online or contact us by phone, email or other means. This includes personal data information that you submit when:
     • Create an account or make a product purchase on our site;
     • Using our products or services;
     • Producing content through our products or services;
     • Express interest in our products or services;
     • Download our software or mobile app;
     • Sign up for the newsletter;
     • Complete a market survey or research form;
     • Contact us or file a report (via phone, email, social media, etc.);
     • Using our website or social media;
2. Automatic or Interaction Technologies. When you interact with our website, we may collect data automatically using it. Device data about your equipment, usage data of your browsing actions and patterns, and contact data when tasks performed through our website remain unfinished, such as incomplete orders or abandoned baskets. We collect this data by using cookies, server logs, and other similar technologies. Please see our Cookies section (below) for further details.
3. Third Parties. . We may receive your Personal Data from various third parties, including:
   • Technical service provider accounts, payments from other individuals who purchase gifts for you from our website;
   • Third-party data usage service providers, including analytics such as Google;
   • Technical service provider accounts, payments from other social media platforms;
   • Communication content, including email and social media service providers who have been authorised to access your personal data against other third-party service providers;
   • Technical service providers, other third party payments, including but not limited to law enforcement agencies, associations and other groups, that share data for the purposes of fraud prevention and detection and credit risk reduction; and
   • Technical service provider accounts, payment, financial information from various service providers.

If you provide third party Personal Data to us, it is your responsibility to ensure that you have permission to do so and understand its use in accordance with this policy. If you believe that your Personal Data has been improperly provided to us, or to exercise your rights in relation to your Personal Data, please contact us using the information set out in the "Contact us" section.

Device and Usage Data
When you visit the Bank Mayapada Internasional website, we automatically collect information about your visit using cookies or similar technologies. You can instruct your browser to refuse all cookies or to indicate when cookies are being sent. The help feature on most browsers will provide information on how to accept cookies, disable cookies, or notify you when you receive a new cookie. If you do not accept cookies, you may not be able to use some features of our services and we recommend that you leave them enabled.

Data we collect from third parties
We may receive your Personal Data from third parties such as companies that subscribe to Mayapada International Bank Services, partners and other sources. This Personal Data is not collected by us but by third parties and is subject to those third parties' separate privacy and data collection policies. We do not have any control or input into how your Personal Data is handled by third parties. As always, you have the right to review and correct this information. If you have any questions, you should first contact the relevant third party to obtain more information about your Personal Data. If the third party is not responsive to your rights, you may contact the Data Protection Officer at Bank Mayapada International (contact details below). Our websites and services may contain links to other websites, applications and services maintained by third parties. The information practices of such other services, or the social media networks that host our branded social media pages, are governed by third-party privacy statements, which you should review to better understand the privacy practices of such third parties

Purpose and Legal Basis for Processing Personal Data
We collect and use your Personal Data with your consent to provide, maintain and develop our products and services and understand how to improve them. Where we process your Personal Data to provide products or services, we do so because it is necessary to fulfil contractual obligations. All of the above processing is necessary for our legitimate interests in providing products and services, maintaining a relationship with you, and protecting our business, for example, from fraud. Consent will be required to initiate services with you, and new consent is required if there are changes to the type of data collected. As stated in the contract, if you do not confirm your consent, it is possible that some services may no longer be available to you.

International Data Transfer and Storage
Wherever possible, we store and process data on servers located within the geographical area in which you reside (which may not be in your country of residence). Your Personal Data may also be transferred to and stored on servers outside the territory of your country, which has different data protection laws. We will take appropriate steps to ensure that your Personal Data is treated securely and in accordance with this Policy and applicable data protection laws.

Data Sharing and Disclosure
We will only share your Personal Data with third parties in the manner set out in this Policy or at the time it is collected.

Legal Obligations
We may use or disclose your Personal Data to comply with legal obligations, requests from government authorities, or other legal process, to prevent loss of life or injury, or to protect our rights or property. Where possible and practical to do so, we will notify you in advance of such disclosure.

Service Providers and Other Third Parties
We may use third-party service providers, independent contractors, or agents of backup and disaster recovery service providers, email service providers to help improve our products and services. Your data may be shared with them for such purposes.

For more information about the recipients of your Personal Data, please contact us using the information in the "Contact Us" section below.

Cookies are small files with information stored by the browser on your device. We use cookies to improve your experience while using our website. Our website does not use cookies to collect personal information from your computer. We do not store passwords or similar sensitive data in cookies. You can set your browser to refuse all cookies or to provide a warning when cookies are sent.

Cookies help us figure out which pages of the site are popular and which are not and how we can improve the site for you.

We will only retain your Personal Data for as long as necessary for the purposes for which it was collected or as long as required by law. Once the data is no longer needed, we will delete it or take steps to anonymise the data.

If we are involved in a merger, acquisition or asset sale, your personal information may be transferred. We will provide notice before your personal information is transferred and is subject to a different Privacy Policy. In certain circumstances, we may be required to disclose your personal information if required to do so by law or in response to lawful requests from public authorities (e.g. courts or government agencies).

We have appropriate organisational safeguards and security measures in place to protect your Personal Data from being accidentally lost, used or accessed, altered or disclosed in an unauthorised manner. The communication between your browser and our website uses a secure encrypted connection wherever your Personal Data is involved. We require any third party contracted to process your Personal Data on our behalf to implement security measures to protect your data and treat such data in accordance with the law. In the event of a Personal Data breach, we will notify you and any applicable regulator when we are legally required to do so.

We do not knowingly collect Personal Data from children under the age of 16.

Depending on your geographic location, you may have the following rights regarding your Personal Data:

• Right of Access: Request a copy of your personal data that we process.
• Right of Correction: Correct incomplete or inaccurate personal data.
• Right to be Forgotten: Request deletion of your personal data.
• Right to Restrict Processing: Request the restriction of processing of your personal data under certain conditions.
• Right to Follow-Up: Have the right to opt out of having your data and information followed up for activities related to third parties
• Right to Object: Object to the processing of your data for a specific purpose.
• Nondiscrimination and non-retaliation: The right not to be denied services or experience changes in the experience of exercising rights.
• Right to file a lawsuit: If you disagree with the way the problem is resolved, you have the right to file a lawsuit with the competent judicial authority.
• Right to File a Complaint: The right to file a claim with the competent authority.
• Right to Data Portability: Obtaining your data in a structured electronic format.

Withdrawal of Consent
If you have consented to our processing of your Personal Data, you have the right to withdraw your consent at any time, free of charge, for example if you wish to opt-out of receiving marketing messages you receive from us. If you wish to withdraw your consent, please contact us using the information at the bottom of this page.

How to Exercise Your Rights
You may make a request to exercise these rights in relation to your Personal Data by submitting the request to our privacy team. For your own privacy and security, at our discretion, we may require you to prove your identity before providing the requested information.

We may change this Privacy Policy Notice from time to time. If there are any changes, we will post the latest version on our website. We recommend that you read and check the details of the Privacy Policy Notice whenever changes are made.