Privacy Policy

At PT Eka Nusantara Gemilang ("1ENGAGE"), trust is the foundation of our business relationships, and safeguarding personal data is core to conducting business responsibly. This Privacy Policy ("Policy") explains how 1ENGAGE collects, uses, stores, transfers, and protects personal data in accordance with Law No. 27 of 2022 on Personal Data Protection ("PDP Law") and international privacy standards.

1ENGAGE recognises that personal data must always be handled fairly, transparently, accurately, securely, and for lawful purposes. This Policy reflects those principles and sets out 1ENGAGE's general commitments to data subjects.

For the purpose of this Policy, the following terms shall have the meanings set out below:

1. "Personal Data" means any data relating to an identified or identifiable individual, whether directly or indirectly, through electronic systems or otherwise.
2. "Processing" means any activity carried out on Personal Data, including but not limited to collection, recording, storage, modification, use, transmission, disclosure, dissemination, erasure, or destruction.
3. "Controller" means 1ENGAGE, which has the authority to determine the purpose and method of processing Personal Data.
4. "Processor" means any third party that processes Personal Data on behalf of 1ENGAGE pursuant to a written agreement.
5. "Data Subject" means any individual whose Personal Data is collected, used, or otherwise processed by 1ENGAGE.
6. "Transfer" means the disclosure, distribution, or provision of access to Personal Data to another party, including cross-border transfer.
7. "Consent" means a freely given, explicit, and informed indication of the Data Subject's agreement to the processing of their Personal Data.

1. Who this Policy Applies to

This Policy applies to all personal data processed by 1ENGAGE in the course of its business operations. It covers personal data relating to:

• employees, officers, directors and commissioners;
• shareholders and investors;
• clients, vendors, service providers, and subcontractors (including client's vendors, service providers, and subcontractors);
• any other individuals whose personal data is collected or otherwise processed in connection with 1ENGAGE's activities.

2. Covered Situations

This Policy applies to personal data processing activities carried out by 1ENGAGE, whether such data is:

• collected directly from the data subject;
• obtained from third parties lawfully authorized to provide such data; or
• processed through 1ENGAGE's internal systems, digital platforms, or other business processes.

3. Exclusions

This Policy does not apply to anonymous data that cannot reasonably be used to identify an individual, or personal data processed by third parties acting independently of 1ENGAGE under their own privacy policies.

a. Categories of Personal Data Collected

Where 1ENGAGE collects personal data not specifically listed above, affected data subjects shall be notified as required by law.

b. Collection Principles

1ENGAGE collects personal data only on a lawful basis, for clear and legitimate purposes, and in a fair and transparent manner.

c. Collection Methods

Personal data shall be collected directly from the data subject wherever possible. If data is obtained from third parties, 1ENGAGE will ensure that such parties are lawfully authorized to disclose the information.

1ENGAGE respects and upholds the rights of individuals in relation to their personal data, as provided under applicable laws. Subject to lawful limitations and verification of identity, Data subjects shall be entitled to exercise the following rights:

• Right of Access – to request confirmation as to whether their personal data is being processed, and to obtain a copy of such data together with relevant processing details.
• Right to Rectification – to request correction or completion of personal data that is inaccurate, incomplete, or misleading.
• Right to Erasure – to request deletion of personal data when it is no longer necessary, where consent is withdrawn, or where processing is unlawful, subject to applicable retention obligations.
• Right to Restrict Processing – to request limitation of processing in circumstances permitted by law.
• Right to Data Portability – to obtain and reuse their personal data in a structured, commonly used, and machine-readable format, and to transmit such data to another controller where technically feasible.
• Right to Object – to object to the processing of personal data on grounds relating to their particular situation, where processing is based on legitimate interest or for direct marketing purposes.
• Right to Withdraw Consent – to withdraw consent previously given for processing, without affecting the lawfulness of processing carried out before such withdrawal.

Requests to exercise any of the above rights may be submitted to 1ENGAGE's designated Data Protection Officer (LDPO), whose contact details are set out in this Policy. 1ENGAGE will respond within the timeframes prescribed by applicable law.

1ENGAGE collects and processes Data provided by you when you access, input any information, create an account, or upload any Data to the 1ENGAGE Platform. We also collect and process Data based on your usage of the 1ENGAGE Platform and/or our products and services, including your technical and behavioral information, transactions, activities, permission granting, and communications.

1ENGAGE also collects any usage, inferred, technical, location, and media Data that you directly or indirectly share through your usage of the 1ENGAGE Platform. We may use cookies and other similar technologies to automatically collect Data, measure, and analyze your usage of the 1ENGAGE Platform.

If you choose to access or use 1ENGAGE Platform through a third-party social network account details (such as sign-in through your Google or Facebook account), you also provide us with the Data related to such account. Advertisers, measurements, merchants, and other partners may share information with us about you and the actions you have taken outside of 1ENGAGE Platform that might be of relevance to us and/or 1ENGAGE Platform. We may also collect information about you from other publicly available sources.

We use Data we collect to provide a personalized experience to you, including but not limited to allowing you to use 1ENGAGE Platform's functionalities, promoting the 1ENGAGE Platform, and customizing suggestions and advertisements that based on our assessment might be beneficial to you. The Data we use for these purposes is automatically processed by our systems, but we are not limited to conduct our manual review of the Data. In an effort to protect your privacy, we might de-identify or aggregate Data, among others by anonymizing it so that it no longer identifies you as an individual user. We use this Data in the same way we use your Data as described in this section.

The usage of your Data includes without limitation:

• To meet requirements for products, services, and features of the 1ENGAGE Platform, support and information for internal operations, including troubleshooting, data analysis, testing, research, statistics and surveys, and to solicit your feedback to the 1ENGAGE Platform.
• To send promotional material through any media, from us or on behalf of our affiliates and/or trusted third parties.
• To improve and grow 1ENGAGE platform and lead product development.
• To measure and understand the effectiveness of advertising and other content we provide, including targeted advertising on 1ENGAGE Platform.
• To enable you to explore the features of 1ENGAGE Platform.
• To understand how you use the 1ENGAGE Platform, including on your devices.
• To infer additional information about you that enables us to provide personalized services through 1ENGAGE Platform
• To facilitate research conducted by independent researchers who meet certain criteria.
• To communicate with you, including to notify you about changes to our services.
• To enforce our terms of use and other terms and policies as relevant.

1ENGAGE processes personal data solely for lawful, fair, and proportionate purposes, including but not limited to:

Where expressly required by law, the consent of the data subject is also obtained to process personal data.

1ENGAGE will ensure that all personal data is stored securely using appropriate organizational, technical, and physical safeguards, consistent with ISO 27001 and recognized industry standards.

Retention periods for personal data will be established on the basis of legitimate business requirements, contractual obligations, and applicable legal or regulatory provisions.

When personal data is no longer required for the purposes for which it was collected, it will be securely deleted, irreversibly anonymized, or archived in accordance with applicable legal and regulatory requirements, and subject to documented internal procedures.

Internal Transfers: Personal data may be shared across the Group on a need-to-know basis, subject to strict access controls.

External and Cross-Border Transfers: Transfers to third parties, including outside Indonesia, will only take place where adequate safeguards are in place and subject to written agreements in compliance with the PDP Law.

1ENGAGE and its vendors, merchants, and other related third parties use cookies and other similar technologies ("Cookies") to among others automatically collect information, analyze and assess your technical and behavioral activities for 1ENGAGE Platform development, improve our services, and enhance your experience while using 1ENGAGE Platform. Cookies may be able to collect information such as your Internet Protocol (IP) address; the type of browser and Operating System (OS) that you use; day, date and time when you are accessing 1ENGAGE Platform; data from click-streams that more or less function to monitor your activity when you are accessing 1ENGAGE Platform; and tools/feature/link you access. Cookies perform to record important information that help you in using 1ENGAGE Platform, in the event that you decided to re-visit the 1ENGAGE Platform in another day.

1ENGAGE uses Cookies for multiple purposes, such as giving you different experience whenever you visit 1ENGAGE Platform, counting the number of users in 1ENGAGE Platform, or reminding you of special events, programs, or activities that 1ENGAGE Platform may hold.

In the event that you decline the usage of Cookies, you can click the "Option" in your browser to set options not to accept Cookies. Click "Help" to find out more about how to set Cookies preference. If you choose to reject all Cookies options, you may not be able to access several functions or important features in 1ENGAGE Platform. Should this happen and you need any assistance, you can contact us through our correspondence address in the "Our Address" information.

1ENGAGE also uses "Tracking" feature to navigate users interactions on the 1ENGAGE Platform. The usage of this tracking mechanism is to give you the most relevant experience when using or accessing 1ENGAGE Platform.

1ENGAGE engages third-party service providers only under written agreements that impose equivalent data protection obligations, ensuring confidentiality, integrity, and accountability as required by PDP Law and in accordance with recognized privacy standards.

1ENGAGE is committed to protecting personal data against unauthorized access, disclosure, alteration, loss, or destruction. To this end, 1ENGAGE applies organizational, technical, and physical security controls proportionate to the level of risk and sensitivity of the personal data being processed.

Security measures include, but are not limited to:

• Organizational safeguards: implementation of governance structures, employee training, access rights management, and confidentiality undertakings.
• Technical safeguards: use of encryption, firewalls, intrusion detection and prevention systems, secure software development practices, and monitoring of information systems.
• Physical safeguards: restricted access to facilities, secure storage of physical records, and environmental controls to prevent damage or loss.

1ENGAGE's security practices are aligned with ISO/IEC 27001 standards and are subject to regular risk assessments, audits, and continuous improvement processes.

In the event of a personal data breach, 1ENGAGE will follow established incident response protocols, including notification to the relevant authority and affected data subjects, where required by applicable law.

Questions, concerns, or requests regarding this Policy or the exercise of data subject rights should be directed to: hello@1Engage.ai

This Policy will be reviewed periodically and may be updated to reflect changes in law, regulation, or business practice. Updated versions will be made available internally and externally, as appropriate.