Privacy Policy

This Privacy Policy ("Privacy Policy") describes how we, PT Transcosmos Indonesia ("Company" or "TCID"), collect, use, store, protect and process personal data about you during and after your employment relationship with us if you are our employee, worker, candidate, vendor and contractor (collectively, "Personal Data Subject") in accordance with the Indonesian law on personal data protection No. 27 of 2022, as amended from time to time.

It is important that you read and retain this Privacy Policy, along with any other privacy notices we may provide on certain occasions when we collect and process personal data about you so that you are aware of how and why we collect and process such data and what your rights are under personal data protection regulations.

This Privacy Policy does not constitute the point of an employment contract or any other contract to provide services and this Privacy Policy may be updated at any time, the Company will notify you of such updates as soon as possible.

The company collects the following personal data directly from you or indirectly from other sources:

Basic Personal data

• Full name
• The employee's ID card/passport number, and the date of issuance and the place of issuance of the document
• Gender
• Place of birth
• University, and relevant information, including years of graduation and majors at the university
• Employee code
• Certain dependents' personal data, including ID card/passport number (and the date of issuance and place of issuance of such documents), date of birth, relationship with the Employee
• Position
• Phone number
• Email address
• Postal address
• Residential address
• Job categories
• Division
• Department/Project
• Date of work
• Types of employment contracts
• Date of resignation
• Tenure (number of days)
• Tenure bucket
• Employee status
• Supervisor name
• Source type
• Batch number
• Evaluation of recruitment assessment / Interview / Other review results
• Probationary period
• Training results
• Performance
• Qualifications held
• Transfer details
• Promotion details
• Resignation details
• Citizenship and/or residence status
• Marital status
• Age
• Date of birth
• Hospitals registered for health insurance
• Social security number
• Weekly work [schedule/hours]
• Payroll
• Contract gross salary
• Absence
• Answers to our questions
• If applicable: social insurance number, contributions to health insurance and long-term care, tax identification number (including other information required for tax returns), tax class, highest school diploma, and highest professional education
• Other personal data necessary for the purposes specified in point 2. "How We Use Your Personal Data"

Sensitive Personal Data

• Health Data: Medical history, health conditions, doctor's records and Health insurance information
• Biometric data: Fingerprints, face scans and voice recordings for security identification
• Travel data / Individual location data specified through location services
• Financial data: Information about bank accounts, including bank account numbers, bank names, transaction history, bank branches and tax records
• Family data includes child, spouse and family data information
• Background check data including crime records

The Company may use personal data for the following purposes:

• Ensure the efficient execution of business operations
• Create, maintain or terminate employment relationships
• Administration, payroll management, benefits, employee benefits, personnel management and personnel support, as well as the execution of management and planning tasks directly connected to any internal business processes
• Fulfillment of obligations agreed upon with our clients
• Fulfillment of obligations arising from applicable laws and regulations
• Conduct employee surveys
• Provide internal services, such as employee benefits programs
• Respond to questions from employees
• Analyze human resources policies and recruitment strategies
• Monitor and regulate illegal or inappropriate use of systems
• Ensuring system security
• Objectives of the internal audit of the group company
• Ensure proper governance within the group company through whistleblowers or similar systems
• Performance evaluation and career development
• Health insurance and medical claims
• The Company's legitimate interests, such as employee training and productivity improvement
• The process of selecting, execution of contract and evaluating vendors/client who work with the Company

The Company processes your personal data based on your consent given by signing a consent form (in advance). In addition, apart from the previous points, the Company may also process your personal data as necessary for the fulfilment of our legal obligations (e.g., reporting requirements relevant to criminal, civil or employment law) or on the basis of other processing as permitted by other laws. The Company processes your personal data in accordance with the following legal bases for the purposes stated in the second point

Personal data will be processed in accordance with the applicable legal provisions can be by written, electronic and/or telematic means, using methods closely linked to the purposes stated in the second point and in all cases guaranteeing security and confidentiality in accordance with applicable law.

The company appoints a Data Protection Officer (DPO) as the data controller in relation to the processing of your personal data and may share your personal data as follows:

• Disclosure to the transcosmos group globally (i.e. transcosmos inc. and its group companies) as necessary to achieve one or more of the objectives set out in point 2.
• Disclosures to agents, service providers, sub-contractors, and suppliers such as payroll vendors, expense auditors, IT service providers, insurance companies, bankers, medical practitioners who provide medical services to employees, and relevant staff unions as necessary to achieve one or more objectives.
• Disclosure to our professional advisors (such as lawyers, accountants, and financial advisors) where necessary and only if they are bound to maintain the confidentiality of your personal data.
• Disclosure to the Associate for any proposed sale, merger, acquisition, joint venture or transfer of assets, provided that the recipient is subject to appropriate confidentiality obligations in respect of your personal data.
• Disclosures required by law, or required by government entities, or to prevent crime, or required by contracts entered into with our clients, or to ensure the rights, property security or personal safety of our officers, employees, contractors or agents, other members of the Transcosmos group, affiliates, our clients (including potential clients), and other users/visitors of our website, or someone else.
• Disclosure as permitted by applicable law.
• In the event of access or disclosure to third parties ("Recipients") for their benefit (Provision).

  Recipient Name	Purpose of use by the Recipient	Personal data items accessed by or disclosed to the Recipient	Retention period by the Recipient
  Transcosmos Group globally (i.e. Transcosmos Inc. and its group companies). You can see the transcosmos group entity in https://www.trans-cosmos.co.jp/company/information/group.html.	To achieve one or more of the objectives set out in point 2. "How We Use Your Personal Data"	One or more personal data listed in point 1	As long as it is necessary to meet the purpose on the left.
  Investigative authorities	Investigations and audits based on applicable laws	One or more personal data listed in point 1	As long as it is necessary to meet the purpose on the left.

• In the event of access by or disclosure to an outsourcing service provider ("Processor") for data processing for the Company's benefit (Outsourcing)

  Processor Name	Tasks outsourced to Processors for data processing
  Agents, service providers, sub-contractors, and suppliers such as payroll vendors, expense auditors, IT service providers, insurance companies, bankers, medical practitioners who provide medical services to employees, and relevant staff unions as necessary to achieve one or more of the objectives set out in point 2. "How We Use Your Personal Data"	Provide the services listed in the column on the left.
  Our professional advisors (such as lawyers, accountants and financial advisors) where necessary and only if they are bound to keep your personal data confidential	Providing professional services including but not limited to legal and financial advice
  Counterparty for any proposed sale, merger, acquisition, joint venture or transfer of assets, provided that the recipient is under the appropriate confidentiality obligations in respect of your personal data and uses them only for the purposes set out in point 2. "How We Use Your Personal Data"	Complete any proposed sale, merger, acquisition, joint venture, or asset transfer.
  Whistleblowing hotline service providers	Receive a whistleblowing hotline from employees

The Company may transfer your personal data to third parties that may be located overseas, including Japan, Thailand, Malaysia, the Philippines, Singapore, and Vietnam. The Company may share or disclose one or more types of personal data as listed in Point 1 to Processors, with the exception of sensitive personal data, which will not be disclosed, and will implement safeguards to protect your personal data as required under applicable local data protection laws and regulations.

• In the case of cross-border transfers to third parties

  Recipient	Personal Data Items to Be Transferred to the Recipient	Country to Which the Personal Data Will Be Transferred and the Date, Time, Method of Transfer	Purpose of Use of Personal Data by the Recipient Period of Storage/Use by the Recipient
  Deloitte Tohmatsu Risk Advisory LLC ("DTRA")	Name, email address, job title, division, division category, and other personal data disclosed by the whistleblower to DTRA	Japan, only if the whistleblower contacts and discloses personal data to DTRA.	Disclosed by the whistleblower As long as it is necessary to fulfill the purpose on the left.
  Transcosmos Group globally (i.e. Transcosmos Inc. and its group companies)	Any personal data listed in point 1	Japan and all countries where Transcosmos Group operates Via email or cloud services	To achieve one or more of the objectives set out in point 2, "How We Use Your Personal Data" As long as it is necessary to fulfill the purpose on the left.

If you do not wish for your personal data to be transferred overseas, you may opt out by contacting us using the details in point 12, “Contact Us.” In this case, you will no longer be able to participate in legal training or various surveys from TCI, and you will also not be able to use any intranet services provided by TCI to TCID.

The Company will use reasonable technical, physical, electronic, and procedural safeguards to protect personal data within our organization from loss, theft, and unauthorized use, disclosure, or modification. Any personal data held by or on behalf of us is stored on secure servers with modern security measures to protect against loss, unauthorized access, alteration, or misuse of the information. If such personal data is stored by unrelated third parties on our behalf, we have also imposed contractual obligations on those parties to ensure the confidentiality and security of the information.

The Company takes appropriate security measures in a manner consistent with and respects applicable laws on data protection to protect the personal data we process and prevent personal data from being accidentally lost, used, or accessed in an unauthorized, altered or disclosed manner.

However, despite our safeguards and efforts to secure personal data, please be aware that no data security measures can guarantee 100% security. There may be incidents that affect the functioning and security of the Company's systems and interfere with our ability to maintain the performance of contracts/employment related to employment to the highest standards. Nonetheless, we strive to protect your personal data and will make the necessary responses in such circumstances in accordance with applicable laws.

1. Processing of personal data will commence from the moment we obtain your personal data in the manner described in this Privacy Policy in accordance with applicable law.
2. The Company will retain your personal data for the purposes listed in point 2 purpose of use of personal data and the number of years after the end of the employment as required for the purposes as stated in point 2 use of personal data.
3. The Company will cease the processing of personal data at the end of the retention period as described in this Section or in any other case under law.
4. When the aforementioned retention period expires, or the personal data is no longer required for legal purposes or in other cases as required by law, we will take steps to destroy or anonymize the personal data and if such action is impractical (for example, if such personal data has been stored in a backup archive), we will retain the personal data in accordance with the company’s policy on retention periods, until deletion can be carried out and ensure that no new processing occurs thereafter in accordance with our document retention and disposal policies, as well as applicable laws and regulations.
5. The processes and methods for destroying personal data are set out below:
   • Crushing process
     The Company selects the relevant personal data to be destroyed and destroys it with the consent of the data protection officer (DPO) according to information handling procedure.
   • Crushing method
     We destroy personal data recorded and stored in the form of electronic files by using technical methods (e.g., low-level formats) to ensure that records are not reproducible, while personal data recorded and stored in paper document form must be shredded or burned.

You may exercise, among other rights as stipulated by law, the following rights in relation to your personal data in accordance with the manuals, policies, and internal rules we may implement from time to time in accordance with applicable regulations:

1. Right to know data processing
   • You have the right to know about the processing of your personal data by us unless otherwise specified by law.
2. Right to consent to data processing
   • You have the right to give or withhold consent to the processing of your personal data, except in certain circumstances as specified by law.
3. Right to access data
   • You have the right to access your personal data to view, correct, or request correction of your personal data unless otherwise specified by law.
4. Right to withdraw consent
   • You have the right to withdraw your consent to the processing of your personal data unless otherwise specified by law.
   • If you withdraw your consent, we may not be able to fully perform contracts, work, or tasks related to your employment relationship with us.
   • Withdrawal does not affect the legality of prior processing.
   • The withdrawal statement must be in writing/printed, including electronic or verified formats. We will inform you of the potential consequences of such withdrawal.
5. Right to erasure
   • Unless otherwise specified by law, you have the right to erase your personal data.
   • If the erasure affects contract performance, we may not be able to fulfill it completely.
6. Right to restrict data processing
   • You have the right to request restrictions on the processing of your personal data unless otherwise specified by law.
   • The request must be implemented within 72 hours of lawful receipt.
   • The restriction may affect contract/work performance.
7. Right to request data provision
   • You have the right to request personal data that you have provided during our services/employment, unless otherwise specified by law.
8. Right to object to data processing
   • You have the right to object to the processing of your personal data:
     1. to prevent/limit data disclosure, or
     2. for advertising and marketing purposes, unless otherwise specified by law. We will fulfill your request within 72 hours of receiving a lawful request unless otherwise specified by law.
9. Right to complain, denounce, and sue
   • You have the right to file complaints, denunciations, and legal claims if we violate personal data protection regulations.
10. Right to claim compensation
    • You have the right to claim compensation in accordance with applicable legal procedures.
11. Right to self-protection
    • You have the right to self-protection in accordance with the Civil Code and other laws.

To assert your rights as a data subject, please contact us and we will process your request in accordance with applicable law. We may, if permitted by law, charge a reasonable fee to cover the cost of responding to such request. Each request must include sufficient details to identify you. Once received, we may request additional information from you (including proof of identity) to process your request. Please note that it may take some time to process your request, but we aim to process all requests as soon as possible. We may also charge a reasonable fee to cover our administrative costs in handling any request, which we will inform you of in advance.

You have the following obligations regarding your personal data, among other obligations as regulated by applicable rules:

1. to protect your own personal data; to request relevant organizations and individuals to protect your personal data;
2. to respect and protect the personal data of others;
3. to provide your personal data completely and accurately when you consent to the processing of personal data;
4. to participate in the dissemination of personal data protection; and
5. to comply with regulations on personal data protection and prevent violations of such regulations.

You may report any incident or action that may be considered a personal data breach to the DPO using the contact details listed in Point 13 of this notice. To ensure the security of your personal data and reduce potential harm caused by such a breach, the Company expects your cooperation in reporting incidents promptly.

If you have any questions about this policy or how we process your personal data, please contact us using the details below:

• PDP Team PT Transcosmos Indonesia, Mandiri Inhealth Tower 7th Floor
• Email: dpo_tcid@trans-cosmos.co.id

This privacy policy applies to all scopes within the Company (candidates, employees, or other third parties), and may be updated and communicated if changes occur.

This is the personal data protection policy of PT. Transcosmos Indonesia, to be properly observed by all relevant parties within the Company by prioritizing the principles of protection, legal certainty, and confidentiality.