Personal Data Protection Notice for Astra Property Group

PT Menara Astra, including its authorized affiliates referred to Appendix 1 of this Privacy Notice (“Astra Property Group”) respects and is committed to the protection of your personal data and privacy. In this Privacy Notice, “we”, “us” and “our” refer to Astra Property Group, and “you” and “your” include third parties whose personal data you have provided to Astra Property Group.

This Privacy Notice explains how we collect and handle your personal data, including your sensitive information or data in accordance with Law No. 27 of 2022 on Personal Data Protection, including its implementing regulations, and its amendments from time to time. Please note that we may amend this Privacy Notice at any time without prior notice and will publish the amended, supplemented or revised Privacy Notice on our official website or via email.

We may collect and process personal data of children under the age of 18. If you are under 18, please obtain the consent of your parent or legal guardian, before you provide your personal data to Astra Property Group. If we learn that we have collected such data from a child under the age of 18 without verification of his/her parent's or legal guardian's consent, we will delete such data. If you believe we may have any data about a child under 18 years of age without valid parental consent, please contact us via the information available within our official website.
Note that your sensitive personal data (e.g. your physical or mental health or condition) and your medical data (e.g. patient medical history, diagnosis, allergies, congenital diseases) will not be shared or disclosed to any entity unless you have given your express written consent.
 

1.1. Types of Personal Data

Personal data is any data you have in relation to you or any other third party to whom you are related that is collected or provided to us for the purposes mentioned in Section 2 below. We process your data identifying information which may include your name, National Identification Number, contact details (address, telephone number, email address etc.), occupation, financial or payment information, insurance information, membership or subscription details, image, voice recording, fingerprint, date of birth or age, educational background, medical health and physical history, criminal history, ethnic and racial origin, nationality, religion, income level information about your family or third parties you provide to us, your preferences in relation to the products and services you are interested in from us, and all other information you provide to us in any form or through interaction with us/through the following channels:

i. Astra Property Group's official website and third party websites officially affiliated with Astra Property Group;
ii. Astra Property Group's mobile application;
iii. Electronic or non electronic forms from Astra Property Group;
iv. Physical document form from Astra Property Group;
v. Email; and/or
vi. Any form of social media and/or other official messages from Astra Property Group.

1.2. Personal Data Sources

i. Customers or potential customer:  We collect your personal data directly or indirectly (e.g. sales agents) both online and offline/physical in public places or any place where we conduct marketing activities. Your personal data may also be collected from cookies through the use of our official website.
ii. Vendors, suppliers, lessees or service providers:  We collect your personal data either directly or indirectly from your referring company or agent during tender process or when you submit to us a completed vendor master data form through various means, including online and physical copies. Your personal data may also be collected from cookies through the use of our official website.
iii. Visitors: We collect your personal data either directly or indirectly, including when you visits to our properties, as well as on websites, social media and other online platforms.
iv. Employees: We collect your personal data either directly or indirectly, including during the recruitment process and while you are bound by an employment contract with our company.

1.3. Mandatory Personal Data
All data requested in the forms we send you are required to be provided by you unless otherwise stated (“Mandatory Data”). If you fail to provide Mandatory Data, then we will not be able to process your request and/or provide you with appropriate services.
Mandatory Data in this Privacy Notice is all data that you are required to provide to us in order for us to process your request and/or provide you with appropriate services, as well as other data that is mandatory in accordance with the prevailing laws and regulations in Indonesia.
 

2.1. Customer or potential customer:  Your personal data is collected and further processed by us as required or permitted by applicable laws in Indonesia and to effectuate your requested commercial transactions, including:
 

i. to process your requested products or services;
ii. to facilitate your participation in any events that we officially organize;
iii. to manage and communicate with you in relation to our services and/or authorized events;
iv. to store and manage your data in the use of authorized applications used by Astra Property Group;
v. to process any form of authorized payment in relation to the services you have requested;
vi. to conduct and support internal marketing analysis and analysis of customer patterns, choices and engagement with related companies, subsidiaries, Parent Companies and other authorized Companies of Astra Property Group affiliates;
vii. to create and deliver personalized and unique products and services to you to enhance your customer experience;
viii. to provide you with a smoother or seamless customer experience;
ix. to support research and innovation of our products and services;
x. to store and carry out data analysis processes;
xi. to improve our products and services;
xii. to process loyalty points awarded by us or third parties/business partners to advertise and market products and services to you;
xiii. to collaborate with business partners to advertise and market products and services to you;
xiv. to comply with Astra Property Group's legal and regulatory obligations in carrying out its business activities;
xv. to contact you regarding any products, services, upcoming events, advertising, promotions or marketing campaigns that we feel may be of interest or benefit to you;
xvi. to send you an official greeting card, special event message or other similar communication;
xvii. to allow third parties to contact you for advertising, promotions or marketing campaigns conducted by any of our officially designated third party entities;
xviii. to ensure that the content of our official website is presented in the most effective way to you via your electronic device; and
xix. for Astra Property Group's internal records management, customer relations events and activities, and official customer loyalty reward programs.
 

2.2. Vendors, suppliers, tenants or service providers: Your personal data is collected and further processed by us as required or permitted by Indonesian law and to effect commercial transactions requested by you, including:
 

i. to process the services you have requested;
ii. to manage and enforce your commercial transactions (execution of tenders, service contracts, lease agreements);
iii. to process any payments related to your commercial transactions;
iv. for insurance purposes;
v. for internal investigation, audit or security purposes;
vi. to comply with legal obligations in Indonesia and Astra Property Group regulations in the course of its business;
vii. to contact you regarding products, services, upcoming events, advertising, promotions or marketing campaigns that we feel may be of interest/ or benefit to you;
viii. to ensure that the content of our official website is presented in the most effective way to you via your electronic device; and
ix. for Astra Property Group's internal management records, event organizing and vendor relations activities, and other official award programs.

2.3. Visitors: Your personal data is collected and further processed by us as required or permitted by law in Indonesia and to provide the services you have requested, including:

i. to process services requested by you, including but not limited to granting you access to our premises;
ii. for internal investigation or audit purposes;
iii. for security purposes, including in the event of force majeure (natural disasters, demonstrations, uprisings, etc. as circumstances beyond human control in general);
iv. to comply with all applicable legal obligations in Indonesia and Astra Property Group regulations in conducting its business; and
v. to improve the services we provide to every visitor to the project area owned by Astra Property Group.
 

2.4. Employees or Potential Employees: Your personal data is collected and further processed by us as required or permitted by law in Indonesia and for the purposes of the employment relationship between you and us, including:
 

i. to process the services you have requested;
ii. to administer and enforce the Employment Contract between you and us;
iii. to process any form of authorized payment of any kind related to the Employment Contract between you and us;
iv. for insurance purposes;
v. for internal investigation, audit or security purposes;
vi. to comply with legal obligations in Indonesia and Astra Property Group regulations in the conduct of its business;
vii. to contact you regarding products, services, upcoming events, advertising, promotions or marketing campaigns that we feel may be of interest or benefit to you;
viii. to ensure that the content of our official website is presented in the most effective way to you via your electronic device;
ix. for Astra Property Group's internal management records, organizing customer relations events and activities, and other recognition programs.
*If you have expressed your consent to receive marketing updates or promotions from Astra Property Group, you may opt out of receiving such marketing or promotional materials at any time. You may select the “unsubscribe” option provided in the email blast in our official website or you may contact us at the details provided in Section (6) below.
 

Data Analytics Processing
We want to share and consolidate your data into a single platform to be shared across the Astra Property Group. We will use and share your data for analytics and measurement purposes to understand how our products and services are used, to help improve the products and services we offer, to provide you with more personalized products and services, and to provide a smoother customer experience. For example, we analyze data about your choices and preferences with respect to the products and services you purchase from us in order to send you targeted advertisements and promotional materials. We also process data about the ads you interact with to help us and advertisers understand the performance of various ads campaigns.
 

3.1. Entities in Astra Property Group
Your personal data provided to us is processed for the purposes mentioned in Section 2 (Purpose of collection and further processing, including disclosure, of your personal data) above. We will ensure that access to personal data is restricted to staff who are contractually required to process your personal data under the terms of employment of the respective Astra Property Group employee/employees. For the avoidance of doubt, in the event that the contract with the employee/employees of Astra Property Group has expired or terminated, then any form of granting access to any personal data stored and managed by Astra Property Group will be terminated as of the date of expiration/termination of the contract of the employee/employees of Astra Property Group.

3.2. Third Parties
Your personal data may be disclosed to third parties who are duly required under Indonesian law, pursuant to a contractual or business relationship proper, or for the purposes mentioned in Section 2 (Purposes of Collection and Further Processing (including but not limited to Disclosure) of your personal data (or directly related to such purposes). The relevant third parties mentioned above may include the following:

i. Professional advisors and corporate service providers, including auditors, lawyers, company secretaries and public consultants;
ii. Advertising and marketing partners;
iii. Payment processors;
iv. Customer support and communication;
v. Market research and surveys;
vi. Social media platforms;
vii. Analytics and tracking providers;
viii. Other service providers and entities, including but not limited to printing companies, conference/training/event organizers, travel agents, insurance companies, utility companies, contractors, suppliers, property management companies or authorized credit agencies;
ix. Law enforcement agencies in Indonesia including but not limited to local police; and
x. Authorized relevant government authorities in Indonesia.

 

4.1. Links to other sites
Links to other sites are provided for your convenience and information. These sites may have their own privacy statements, which we recommend you review if you visit any of the linked websites. We are not responsible for the content on any linked site or the use of any site.

4.2. Location-enabled products or apps
Location-enabled products or apps transmit your location data to us. We do not use the data sent or provided other than to provide the services you have requested. Location-enabling features are opt-in and you have control over your participation and can turn off these services at any time or uninstall them.

Some mobile applications will use programs such as Google Analytics (or similar comparable applications) to help us better serve you through product improvements, services and revisions to the mobile application. This collected data will not identify you to us. However, it may tell us anonymously which services and features you use most in the app, as well as your device type and hardware/software features, country, and language of download.

4.3. Cookie
Cookies may be used in the processing of your data. Cookies are text files that are placed into the memory of your computer and/or electronic device by our computers. A copy of this text file is sent by your computer and/or electronic device each time it communicates with our server. We use cookies to identify you. We may also collect your data during your visit to our official website and/or the eligible domain name from which you access our official website, or alternatively, your IP address:

i. the date and time you accessed each page on our official website;
ii. the URL of any website page from which you accessed our official website (referrer); and
iii. the official website browser you used and the page you accessed.

Some official website pages will require you to provide a limited amount of personal data to enjoy certain services on our official website (system login credentials, email and contact addresses, etc.). This data will only be used for its intended purpose, which is to respond to your message or provide the service requested by you.
 

You have the rights under the Personal Data Protection Law to, including but not limited to, access and correct your personal data held by us (subject to certain exceptions). We will make every effort to ensure your data is accurate and up-to-date therefore we request that any changes to your information must be notified to us directly and/or immediately. If you wish to access or correct your personal data, you can contact us to the contact details listed in Point 8 below.
 

6.1. Explicit Consent
What is meant by Explicit Consent which can be the basis for our processing of your Personal Data is your explicit legal consent for 1 (one) or several specific purposes that have been conveyed by us to you. The basis for processing Personal Data in the form of Explicit Consent will be used for marketing purposes and processing children's personal data.

6.2. Contractual Obligation 
What is meant by Contractual Obligation which can be the basis for processing your Personal Data by us is the fulfillment of agreement obligations in the event that you are a party to an agreement or to fulfill your request at the time of entering into an agreement. The basis for processing Personal Data in the form of Contractual Obligation will be used for the purposes of employee recruitment, employment, commercial transactions with customers and vendors and other third parties.

6.3. Legal Obligation 
What is meant by Legal Obligation which can be the basis for processing your Personal Data by us is the fulfillment of legal obligations from us in accordance with the provisions of applicable laws and regulations in Indonesia. The basis for processing Personal Data in the form of Legal Obligation in this Agreement will be used for tax purposes, risk management of Personal Data, payroll and employee management, processing of employee health data, pension funds, security management and employee access.

6.4. Vital Interest 
What is meant by Vital Interest which can be the basis for our processing of your Personal Data is the fulfillment of the protection of your Vital Interest/ Vital Interest. The basis for processing Personal Data in the form of Vital Interest will be used in the event of force majeure.

6.5. Legitimate Interest
What is meant by Legitimate Interest which can be the basis for processing your Personal Data by us is the fulfillment of other legitimate interests by taking into account the purpose, need and balance of our interests and your rights. The basis for processing Personal Data in the form of Legitimate Interest will be used for the purposes of collecting Personal Data from visitors through CCTV cameras, Drones and other electronic devices or security systems to ensure security in the Astra Property Group project area.
 

Our collection of your Personal Data with your prior consent will entitle us to transfer your data outside Indonesia. We will take reasonable and appropriate and adequate measures to provide protection for the Personal Data transferred (including encryption of such Personal Data) and will provide contractual protection for the transfer of Personal Data to Astra Property Group located outside Indonesia. All such contractual provisions are made subject to the prior written approval of our Legal Department.
 

If:
i. You wish to obtain further data on how to restrict the processing of your data information or withdraw your consent to the processing of personal data;
ii. You wish to request to restrict your personal data or withdraw your consent to the processing of personal data (note that we may retain your data if there is a legal basis to do so);
iii. You have further questions; or
iv. You wish to make a complaint in relation to your personal data.

you may contact:

dpo@astraproperty.co.id
 

9.1. Data Security
The confidentiality of your Personal Data is of utmost importance to us. We will use best efforts to protect and secure your Personal Data from access, collection, use or disclosure by unauthorized persons and from processing contrary to Indonesian law, accidental loss, destruction and damage or similar risks. However, as the transmission of data over the internet is not completely secure, we cannot fully guarantee that such Personal Data will not be intercepted, accessed, disclosed, altered or destroyed by unauthorized third parties, due to factors beyond our control. You are responsible for maintaining the confidentiality of your account details and must not share your account details, including your password and One Time Password (OTP) with any party, and you must always maintain and be fully responsible for the security of the device you use.
In the event of failure of Personal Data Protection, We will provide written notification no later than 3 x 24 (three times twenty four) hours to:
a) Personal Data Subject; and
b) Personal Data Protection Agency.

9.2. Data Retention
During the retention period or as long as the retention of Personal Data is required or permitted by the prevailing laws and regulations in Indonesia, we will retain your personal data for the period required to fulfill the following:  

i. the purpose for which the personal data was provided,
ii. identifiable and ongoing business needs, including for record keeping purposes,
iii. certain legal or regulatory requirements applicable in Indonesia, and/or
iv. the requirement to retain the data as may be appropriate with a notified investigation or ongoing legal proceedings.

We will cease to retain Personal Data, or remove the purpose of associating such Personal Data with you as an individual by deleting, disposing of, anonymizing and/or where permitted by applicable laws in Indonesia, securely blocking, Personal Data under our control if (i) the Personal Data is no longer necessary to fulfill the purpose for which it was collected; (ii) the retention period expires; (iii) retention is no longer necessary for business purposes or compliance with applicable laws and regulations in Indonesia; (iv) the purpose for which the Personal Data was collected has ended; and (v) there is a request from you to delete your account.

Please note that there is still a possibility that some of your Personal Data is stored or controlled by other parties including government institutions in certain ways. In the event that we share your Personal Data to authorized government institutions and/or other institutions that may be appointed by the authorized government in Indonesia or have cooperation with us, you agree and acknowledge that the storage of your Personal Data by the relevant institutions will follow the data storage policies of each such institution.
To the extent permitted by the prevailing laws and regulations in Indonesia, you release us from and against any and all claims, suits, demands, losses, liabilities, costs, damages and expenses (including but not limited to legal fees and full indemnity expenses) resulting directly or indirectly from any Personal Data processing activities conducted by us.
 

We may share your Personal Data with other parties in connection with the merger, separation, acquisition, consolidation or dissolution of legal entities of the Astra Property Group. However, your Personal Data will remain subject to our obligations made in the pre-existing Privacy Notice to which you have consented. In connection with this transfer of your Personal Data, we will provide advance notice to you by email, both before and after any merger, separation, acquisition, consolidation or dissolution of legal entities of the Astra Property Group.

We will amend this Privacy Notice from time to time. The latest version will be posted on our official website and our official mobile application with an update date so that you will know when the Privacy Notice was last updated. Please check back frequently to view any updates or changes to this Privacy Notice. If we make any material changes to this Privacy Notice, we will provide notice to you via an authorized email from us.

Appendix of Privacy Notice Astra Property, view here.