Privacy Policy
A. INTRODUCTION
This Privacy Notice applies to the personal data and information managed by PT Maybank Asset Management (“Investment Manager”) as of 14 March 2025 in accordance with the terms and conditions of personal data processing applicable at the Investment Manager.
The Investment Manager recognizes the importance of personal data protection as stipulated in Law No. 27 of 2022 on Personal Data Protection, along with its implementing regulations as promulgated and amended from time to time (hereinafter referred to as the “PDP Law”), which is applicable to the Investment Manager. Therefore, the Investment Manager is committed to complying with the provisions of the PDP Law and relevant regulations to maintain confidentiality and ensure the protection of your personal data in accordance with applicable laws and regulations.
For the purposes of this Privacy Notice, “Personal Data” refers to information regarding an identified or identifiable individual, either separately or in combination with other information, whether directly or indirectly, that can be used to identify, contact, or track the Personal Data subject through electronic or non-electronic systems as referred to in the PDP Law, its relevant regulations, and Section C of this Privacy Notice. Personal Data also includes individual data contained in identification cards that can identify a person (including your photo), phone numbers, email addresses, personal financial data (including but not limited to Investment Manager account details, credit card details, and transaction data), email addresses, and date and place of birth.
This Privacy Notice and its amendments from time to time (the "Privacy Notice") explains how the Investment Manager processes Personal Data, including the collection, storage, analysis, processing, updating, disclosure, transfer, deletion, and/or destruction of your Personal Data (“Personal Data Processing”) through the use of Investment Manager services/products, websites and/or applications, participation in certain promotional programs or activities from the Investment Manager and/or third parties working with or having legal relations with the Investment Manager ("Third Parties"), both online and offline,
as well as through other activities, services, products, and features provided on the website and/or application (if any).
This Privacy Notice applies if you:
-
Request information regarding the Investment Manager products.
-
Become an Investment Manager customer; and/or
-
Become (i) a business partner, contractor, and/or supplier of the Investment Manager, and/or (ii) have a legal relationship with the Investment Manager for a specific purpose, such as corporate social responsibility (CSR) initiatives.
(Hereinafter collectively referred to as "You"). You must read and fully understand this Privacy Notice to be aware of and understand how the Investment Manager processes and protects your Personal Data.
B. STATEMENTS AND WARRANTIES FROM YOU REGARDING THE PROVISION OF PERSONAL DATA
You hereby declare and warrant that:
-
You have read and understood all the contents of this Privacy Notice (including the Personal Data Processing performed by the Investment Manager as described in this Privacy Notice);
-
You consent to the authenticity, completeness, and accuracy of the Personal Data you provide to the Investment Manager; and
-
You agree and understand that you will apply the principles of personal data protection in accordance with the PDP Law if, at any time, for any reason, you receive Personal Data from a Third Party, including the Investment Manager.
In certain circumstances, you may be required to provide Personal Data of others (such as legally recognized spouses, family members, or other parties) to the Investment Manager.
If you provide the Personal Data of another person for processing by the Investment Manager, you declare and warrant that you have lawfully obtained explicit consent from that individual as the subject of the Personal Data, and you understand that the Investment Manager relies on your statement and warranty in processing the Personal Data of the respective individual/party. You are fully responsible if the Personal Data you provide, particularly that of another individual (including the personal data of a Third Party provided to the Investment Manager), is obtained unlawfully or if your statements and warranties prove to be incorrect. The Investment Manager may request proof of consent from the respective individual whose Personal Data you have disclosed at any time if necessary.
C. TYPES OF PERSONAL DATA COLLECTED AND COLLECTION METHODS
The types of Personal Data collected depend on the purpose of Personal Data Processing. The collected Personal Data may include:
-
Your identification data, including full name, place and date of birth, gender, residential address, nationality, occupation, workplace address and phone number (if any), marital status, mother’s maiden name, signature, and identification card along with Personal Data contained therein (such as National Identification Number (NIK) and/or passport number), Taxpayer Identification Number (NPWP or Tax Identification Number).
-
Contact data, including email address, home phone number, and mobile phone number.
-
Financial data, including sources of funds, average annual income and/or net worth, and the purpose of business relationships or transactions conducted by prospective customers/customers.
-
Other personal data as stipulated by applicable laws and regulations.
-
Third Party Data, including Third Party identification data, contact data, and other Personal Data details as mentioned above that are provided to or obtained by the Investment Manager from you.
The Personal Data processed by the Investment Manager is provided directly or indirectly by you through a Third Party, including through form submissions, electronic or non-electronic document submissions, or other media. This may occur, for example, when you invest in the Investment Manager products and/or undergo a due diligence process or in other contexts necessary to achieve the purposes of Personal Data Processing (including from publicly available data sources or those provided by authorized government agencies).
D. PROCESSING OF YOUR PERSONAL DATA
The Investment Manager processes Personal Data as follows:
-
Collection and Acquisition
-
Determining the basis for processing before collecting Personal Data;
-
Clearly defining the purpose of Personal Data collection with consideration of the interests of the Personal Data subject;
-
Limiting the extent of collected Personal Data based on the determined purpose;
-
Establishing a secure mechanism for the acquisition and collection of Personal Data;
-
Providing information on the purpose of processing before acquiring Personal Data; and
-
Applying Personal Data processing principles as per applicable laws and regulations.
-
Processing and Analysis
For processing and analyzing Personal Data, the Investment Manager will:
-
Establish mechanisms and/or implement data quality standards to ensure the accuracy and completeness of the processed and analyzed Personal Data.
-
Inform the Personal Data subject if processing and analysis extend beyond or are in addition to the original purpose.
-
Conduct a Data Protection Impact Assessment (DPIA) for processing and analysis activities that pose a high potential risk to the Personal Data subject.
-
Facilitate the right of the Personal Data subject to object to decisions based solely on automated processing; and
-
Apply the principles of Personal Data processing in accordance with applicable laws and regulations.
-
Storage
For storing Personal Data, the Investment Manager will:
-
Establish and implement security controls to safeguard Personal Data stored physically and electronically.
-
Establish and implement a Personal Data retention mechanism.
-
Determine the retention period for Personal Data in accordance with applicable laws and regulations.
-
Prevent failures in Personal Data protection during storage by:
-
Implementing encryption and/or data masking.
-
Creating backup copies of Personal Data; and
-
Encrypting and/or masking backup copies of Personal Data.
-
Restrict access to Personal Data to authorized parties only.
-
Identify, record, and/or document the location and media used for Personal Data storage; and
-
Apply the principles of Personal Data processing in accordance with applicable laws and regulations.
-
Correction and Updates
For correcting and updating Personal Data, the Investment Manager will:
-
Facilitate the Personal Data subject in completing, updating, and/or correcting inaccuracies or errors in their Personal Data.
-
Verify the accuracy of the Personal Data provided by the Personal Data subject; and
-
Apply the principles of Personal Data processing in accordance with applicable laws and regulations.
-
Disclosure, Transfer, Distribution, or Announcement For displaying, announcing, transferring, distributing, or disclosing Personal Data, the Investment Manager will:
-
Establish a legal basis for processing Personal Data before displaying, announcing, transferring, distributing, or disclosing it, except where otherwise stipulated by applicable regulations.
-
Comply with the legal requirements for cross-border transfers of Personal Data as outlined in applicable regulations.
-
Implement security controls to protect Personal Data in accordance with legal requirements.
-
Restrict disclosure of Personal Data only to the extent necessary for the specified processing purpose and with the consent of the Personal Data subject, while ensuring compliance with applicable regulations; and
-
Apply the principles of Personal Data processing in accordance with applicable laws and regulations.
-
Deletion or Destruction
For deleting or destroying Personal Data, the Investment Manager will:
-
Delete or destroy Personal Data, except where retention is required under applicable laws and regulations.
-
Implement a secure mechanism for the deletion or destruction of Personal Data.
-
Facilitate the Personal Data subject's right to request the deletion of their Personal Data, if it does not conflict with legal requirements.
-
Act on valid requests from Personal Data subjects to delete their Personal Data in compliance with legal regulations by:
-
Deleting or destroying Personal Data in accordance with legal requirements.
-
Ensuring the removal of Personal Data from all storage locations.
-
Retaining evidence of Personal Data deletion or destruction in the form of an official record; and
-
Providing proof of deletion or destruction to the Personal Data subject; and
-
Apply the principles of Personal Data processing in accordance with applicable laws and regulations.
E. PURPOSE OF PERSONAL DATA PROCESSING
Based on your explicit and lawful consent, the Investment Manager may act as a data controller to process your Personal Data for the following purposes:
-
Provision and Processing of Selected or Owned Products, Including:
-
Providing information about the Products (including updates and modifications over time);
-
Implementing regulatory requirements, including Customer Due Diligence (CDD), Anti-Money Laundering, Counter-Terrorism Financing, Prevention of Proliferation of Weapons of Mass Destruction, and Anti-Bribery and Corruption Policies related to the provision of Products;
-
Responding to and resolving requests related to the provision of Products;
-
Modifying, enhancing, and/or developing Products, including updates and adjustments; and/or
-
Fulfilling other necessary requirements related to the provision or processing of Products for you.
-
Execution and Enhancement of Operational Activities in Compliance with Applicable Regulations,including:
-
Performing activities related to accounting, auditing, taxation, and reconciliation associated with both the Products and the Investment Manager, as well as internal administrative processes.
-
Fulfilling contractual obligations to you and/or third parties (including, but not limited to, vendors and partners).
-
Preventing, detecting, and investigating suspicious transactions, criminal activities, or any prohibited activities under applicable laws.
-
Communicating with you through various channels, including responding to inquiries, comments, or complaints.
-
Complying with legal enforcement requests and protecting the rights of the Investment Manager and/or yourself; and/or
-
Meeting other operational needs in line with business execution and regulatory compliance.
-
Product Offers and Promotions
The promotion of investment products, events, or other forms of marketing aligned with your needs and profile. The Investment Manager may offer products provided either directly or through third-party collaborations via various channels, including oral and written communications such as phone calls, emails, brochures, and other electronic or non-electronic media in accordance with applicable regulations (“Other Promotions”).
-
The Investment Manager may process Personal Data in the event of corporate actions and/or other transactions, including but not limited to mergers, spin-offs, acquisitions, consolidations, restructurings, and/or other activities involving the transfer of intellectual property rights, insofar as they involve the processing of Personal Data.
-
The Investment Manager may process Personal Data if instructed or required by an authorized government institution, for purposes as specified or regulated under applicable laws and regulations.
F. LEGAL BASIS FOR PERSONAL DATA PROCESSING
Any processing of Personal Data carried out by the Investment Manager is based on a legitimate legal basis and is compatible with the purpose of the processing. The Investment Manager processes Personal Data based on the following legal bases:
-
Your explicit and lawful consent to this Privacy Notice;
-
Fulfillment of contractual obligations to provide Products or other necessary services as outlined in this Privacy Notice;
-
Compliance with legal obligations under applicable regulations;
-
Legitimate interests pursued by the Investment Manager as a data controller while ensuring a balance between the Investment Manager objectives and your rights as a Personal Data subject; and/or
-
Any other legal grounds for Personal Data processing as required by applicable laws and regulations.
G. PERSONAL DATA STORAGE, DELETION, AND SECURITY
-
You hereby explicitly consent that the Investment Manager may transmit, store, use, and process your Personal Data on servers located in data centers designated by the Investment Manager. These data centers may be managed by third parties in compliance with applicable regulations. Notwithstanding this, the processing of your Personal Data in relation to the Products will continue to be governed by this Privacy Notice and applicable laws.
-
Once your Personal Data is no longer required for its stated purpose, as described in this Privacy Notice, the Investment Manager will take necessary measures to delete, destroy, anonymize, and/or restrict access to or further processing of such data for any purposes other than those outlined in this Privacy Notice.
-
Additionally, certain Personal Data may still be retained or controlled by third parties, including government agencies, for the purposes outlined in this Privacy Notice. If the Investment Manager discloses your Personal Data to authorized government institutions or other entities, you acknowledge and understand that the storage and retention of such data will be subject to the policies of the respective institutions, which may override certain rights you have as a Personal Data subject under applicable regulations.
-
The Investment Manager is committed to maintaining appropriate physical, technical, and procedural safeguards to protect your Personal Data from loss, misuse, unauthorized access, copying, damage, or alteration.
-
While the Investment Manager has implemented what it considers to be the best and most effective measures to protect your Personal Data—including using security methods and technology provided both internally and by third parties—the Investment Manager cannot guarantee absolute security for transmitted Personal Data. However, the Investment Manager will continue to make every effort to safeguard and ensure the security of your Personal Data and take responsibility for the activities of third parties collaborating with the Investment Manager.
-
If needed, you may obtain more information about the Investment Manager efforts to protect your Personal Data by contacting the Investment Manager through the channels listed in Section J of this Privacy Notice.
H. CROSS-BORDER PERSONAL DATA TRANSFER
The Investment Manager may transfer your Personal Data outside the jurisdiction of the Republic of Indonesia, and if required, details of such transfers may be provided upon request.
The Investment Manager will comply with applicable laws and regulations and make its best efforts to ensure that the level of protection provided is equivalent to that in the Republic of Indonesia and aligns with this Privacy Notice. This includes the use of standard contractual clauses for Personal Data protection related to cross-border transfers where relevant and necessary.
I. YOUR RIGHTS AS A PERSONAL DATA SUBJECT
As a Personal Data subject, you have rights as stipulated under applicable laws and regulations concerning Personal Data protection. The Investment Manager is committed to ensuring that you can exercise these rights, subject to the applicable laws and their limitations, which include:
-
The right to obtain information;
-
The right to access and/or obtain a copy of your Personal Data;
-
The right to complete, update, and/or rectify any errors or inaccuracies in your Personal Data;
-
The right to terminate the processing of your Personal Data;
-
The right to request the deletion of your Personal Data;
-
The right to data portability, meaning the right to obtain and/or use your Personal Data from the Investment Manager as the data controller in a structured and/or standardized format;
-
The right to data interoperability, meaning the right to use and transmit your Personal Data to another data controller;
-
The right to withdraw consent for the processing of your Personal Data;
-
The right to suspend or restrict the processing of your Personal Data in a proportionate manner; and
-
The right to file a complaint and seek compensation in case of a violation of Personal Data processing due to the Investment Manager negligence or errors that directly result in harm to you.
If you would like to submit a request to exercise your rights as outlined above, you may do so through the channels or contacts provided in Section J of this Privacy Notice.
The Investment Manager will conduct verification and screening for all requests regarding your Personal Data rights and respond within 3 (three) business days upon receipt of your request. To process your request, the Investment Manager may require you to provide supporting information or documentation to validate the request. Once verified, the Investment Manager will inform you of any consequences associated with exercising your rights. Upon your confirmation, the request will be processed within the timeframe stipulated by applicable regulations.
However, under certain circumstances as regulated by applicable laws, the Investment Manager reserves the right to deny your request to exercise your Personal Data rights (including deletion or destruction requests) if such actions:
-
Affect national defense and security interests;
-
Affect law enforcement processes;
-
Affect public interests in state administration;
-
Impact financial sector supervision, financial stability, and financial system oversight in the execution of state administration;
-
Are necessary for compliance with legal obligations, such as Customer Due Diligence (CDD) and the prevention of criminal activities;
-
Are irrelevant to the Investment Manager Personal Data processing activities or your role as a data subject;
-
Threaten the safety, physical, or mental health of the data subject or others; and/or
-
Result in the disclosure of other individuals’ Personal Data.
Without prejudice to legal restrictions, the Investment Manager also reserves the right to deny your request if you still have outstanding rights and obligations with the Investment Manager, its partners/agents, or third parties.
The Investment Manager may charge an administrative fee for requests related to your Personal Data rights, as permitted under applicable laws.
J. INVESTMENT MANAGER CONTACT INFORMATION
If you have any questions or complaints regarding this Privacy Notice or the Investment Manager Personal Data processing activities, including requests to exercise your rights as a data subject, you may contact PT Maybank Asset Management Customer Service at +622180657701 or +622180657700, or via email at id.cs@maybank.com.
K. GOVERNING LAW
This Privacy Notice is governed by the laws of the Republic of Indonesia.
L. CHANGES OR UPDATES TO THE PRIVACY NOTICE
The Investment Manager may modify, update, and/or amend this Privacy Notice from time to time (with prior notification) to ensure alignment with the Investment Manager procedures and practices in Personal Data processing, as well as compliance with applicable laws and regulations.
You may access this Privacy Notice periodically on the website of PT Maybank Asset Management, which is licensed and supervised by the Financial Services Authority (Otoritas Jasa Keuangan - OJK).