How can we help?

PRIVACY POLICY 
FOR VENDORS AND BUSINESS PARTNER OF PT FAST RETAILING INDONESIA
 

INTRODUCTION

PT Fast Retailing Indonesia (“Company”, “our”, “us” or “we”) are committed to protecting your privacy and safeguarding your personal data in our possession. This privacy policy will also be known as Personal Data Protection (PDP) Notice​​​​ ​(“​​Policy​​​​”) transparently explains how, when, and why we use your personal data, as well as your rights regarding the usage of such personal data when you interact with us. We only collect and use your personal data as outlined below.  

This ​Policy​ may only apply to our vendors and business partners. By interacting with us, you acknowledge that any personal data you provide to us is true, complete, lawfully obtained, and that you are fully entitled to provide such personal data to us. By interacting with us, you are deemed to have read and understood this ​Policy​.

TABLE OF CONTENTS

1. DEFINITION
2. PERSONAL DATA WE COLLECT FROM YOU
3. YOUR PERSONAL DATA THAT WE COLLECT FROM OTHER SOURCES
4. PURPOSES AND LAWFUL BASES WE USE FOR PROCESSING
5. SHARING AND/OR DISCLOSURE OF YOUR PERSONAL DATA AND THE RECEIVING PARTIES
6. TRANSFER OF YOUR PERSONAL DATA OUTSIDE OF INDONESIA
7. AUTOMATED PROCESSING OF YOUR PERSONAL DATA
8. PERSONAL DATA STORAGE
9. YOUR RIGHTS AS A DATA SUBJECT
10. HOW WE PROTECT YOUR PERSONAL DATA
11. CORPORATE ACTIONS
12. CHANGES TO THIS POLICY
13. APPLICABILITY
14. GOVERNING LAW AND JURISDICTION
15. NOTIFICATION AND COMMUNICATION
16. CONTACT US
17. LANGUAGE

1. Identification information (e.g., ​name, date of birth, address, city, province, product selection, password, bank account and credit-card details and/or any other data required by us with respect to the use of website​); 

2. Contact details (e.g., postal address, phone number, and email address); 

3. Financial information (e.g., your bank account number); 

4. Information about the company you are working for (e.g., name of the company and your position in the company); and 

5. Records of communications between you and us and the personal data you provide to us through those communications (e.g., communications of coordination with the Company​, information when you report a problem on our website​)

1. Parties within your company who interact directly with the Company (e.g. sales agents of your company, and/or representatives of your company); 

2. Parties who recommended you to us; and 

3. Publicly accessible sources (e.g., your company website or social networking platforms). 

4.1 We process your personal data with the following lawful bases: 

1. To fulfil contractual obligations between us and you or to fulfill necessary matters to conclude an agreement with you; 

2. To fulfil the Company’s legal obligations in accordance with the provisions of laws and regulations; 

3. To fulfil legitimate interest of the Company;  

4. To fulfil the protection of your vital interests; and/or 

5. When you have given explicit consent.   

4.2 If we ask for your consent to process your personal data, you may at any time object or withdraw such consent. In relation to your right to object or withdraw consent, please refer to Section 9 of this Policy. 

4.3 We may process your personal data for purposes other than those we have listed above. If such processing occurs, we will inform you in advance through updates to this Policy    

5. SHARING AND/OR DISCLOSURE OF YOUR PERSONAL DATA AND THE RECEIVING PARTIES 

5.1 We will maintain the confidentiality of your personal data, but we may share your personal data with third parties (who must also keep your personal data secure and confidential) in certain circumstances, as follows: 

6. TRANSFER OF YOUR PERSONAL DATA OUTSIDE OF INDONESIA  

6.1 We may be required by the laws and regulations to send your personal data to certain parties to fulfil certain purposes..  

6.2 Additionally, we may need to transfer your personal data outside of Indonesia, such as for business purposes to our affiliated companies ​or to suppliers, service providers, and other business partners domiciled outside of Indonesia in order for those other providers to provide their services to us. 

6.3 In sending your personal data overseas, please understand that the destination country may have different data protection regulations than Indonesia. In certain circumstances, the court, law enforcement officials, or regulatory bodies in such countries may have the right to access your personal data. 

6.4 We will comply with the PDP Regulations and exercise all reasonable and sufficient measures, such as entering into a binding data transfer agreement with data recipients, or obtaining your explicit consent, to ensure that our overseas affiliates, business partners, joint ventures, and all such third parties provide a level of protection comparable to our commitments under this Policy.  

6.5 When transferring personal data to organisations in other countries, we will ensure that they agree to apply an equivalent level of personal data protection that we apply. Where this is not possible (for example, if the laws and regulations stipulate that we must transfer personal data), we will ensure that the personal data is transferred in accordance with the applicable laws and regulations. Where a data protection authority does not consider certain countries to have an adequate level of personal data protection, we will establish appropriate safeguards (such as contractual safeguards), in accordance with the PDP Regulations, to ensure that your personal data is adequately protected. 

7. AUTOMATED PROCESSING OF YOUR PERSONAL DATA 

7.1 Our use of your personal data may involve profiling. This means that we may process your personal data (including specific/sensitive personal data) using software that can process your personal data and other factors to predict risks or outcome. We may also use profiling or other automated methods, to make decisions about you related to the following matters: 

1. Inspection of anti-money laundering and countering the financing of terrorism; 

2. Identity and address check; and 

3. Prevention of criminal offences or fraud. 

7.2 The above activity is known as ‘automated decision-making’ and we do this as part of the purposes for which we use your personal data and the lawful bases we have set out in Section 4 of this ​Policy. 

7.3 You may contact us to object automated decision-making on you, as we have set out in Section 9 of this ​​Policy

8. PERSONAL DATA STORAGE 

8.1 We will retain your personal data for a specified period of time. After our relationship with you has ended (e.g., after the end of our cooperation agreement), we will only retain your personal data for a period of time appropriate for the type of personal data and the purpose for which it is retained, or for as long as such retention is required or authorised by applicable laws and regulations. 

8.2 We will only retain your personal data that enables us to, among others:

1. Keep a record of our business activities for analytical or audit purposes; 

2. Comply with the relevant laws and regulations, including ​retaining data for​​     ​ the prevention, detection, and investigation of money laundering and financing of terrorism); 

3. Defend or take legal actions (such as in a legal dispute), including to anticipate such legal actions legal action in relation to our relationship with you or your company; or 

4. Assist in monitoring the prevention of fraud offences. 

9.2 Your ability to apply for the fulfilment of these rights depends on a number of factors, and in some circumstances, we may not be able to comply to your request​.​ ​This may include circumstances where the personal data may contain references to other individuals or where the request for access or request to correct is for reasons which we reasonably consider to be trivial, frivolous or vexatious. 

9.3 Please note that the exercise of certain rights (such as withdrawal of consent) may affect access to and/or limit the Company’s obligations to you or the company where you work. ​Additionally, withdrawal of consent may also take at least three (3) days to process. 

9.4 In certain circumstances and where reasonable and enforceable under the PDP Regulations, we may charge you a reasonable fee for our administrative costs in the fulfilment of your rights. 

9.5 If you want further information about your rights or you want to make a request to exercise your rights, you may contact us in written form through our contact details as set out in Section 16 of this Policy​

10. HOW WE PROTECT YOUR PERSONAL DATA 

10.1 We take the security of your personal data very seriously and make reasonable efforts to protect any of your personal data. We constantly endeavour to improve our standards of protection, however, we are not liable for any losses arising from the destruction or loss of your personal data that occurs beyond our control. We store your personal data by:  

1. Utilising ​SSL (Secure Sockets Later) encryption technology to help protect your personal data. By using an SSL compatible browser such as Microsoft Internet Explorer, Mozilla Firefox, or Safari, you can help ensure that your personal data is inaccessible to unauthorised users and processed confidentially; 
2. Limiting the access to your personal data;  
3. Ensuring audit logs are available to areas that store personal data to prevent unauthorised access;
4. Securely destroy your personal data when we no longer need it for the purposes outlined in Section 4 of this Policy; and  
5. Implementing strict internal policies for the safe and appropriate management and storage of personal data, including training staff on data security best practices.