NRI Indonesia Privacy Policy

A. INTRODUCTION

We, PT Nomura Research Institute Indonesia (hereinafter referred to as “NRI Indonesia”, “We/Our/Us”, or “Our Company”) are committed to protecting and respecting the privacy of Personal Data (defined below) of all the individuals whose Personal Data that we process, including the following individuals: (i) individuals who use our products or services. as well as individuals acting on behalf of or representing customers entities (“Users”); (ii) individuals who work at Our Company including all executives and employees whether engaged on a full-time or contract basis, as well as part-time, dispatched, or seconded employees (“Employees”), or apply for a position with Our Company (“Applicants”). (Users, Employees, Applicants, and any other individuals whose Personal Data that We process are hereinafter collectively referred to as “You/Your/Yourself”). This Privacy Policy explains information about how We process the Personal Data of You, including: receiving and collecting; processing and analyzing; storing; correcting and updating; transferring; disclosure; and/or deleting of Personal Data. This Privacy Policy applies to all of you, whether accessed through the website nri.co.id or through the NRI Indonesia Platform, the NRI Indonesia Application, and/or other NRI Indonesia services made available online through our website (collectively referred to as the “NRI Indonesia Services”), unless otherwise governed by a separate Privacy Policy. Applicable Law This Privacy Policy is governed by the personal data protection laws in Indonesia, specifically Law Number 27 of 2022 regarding the Protection of Personal Data, Regulation of the Minister of Communication and Information of the Republic of Indonesia Number 20 of 2016 regarding the Protection of Personal Data in Electronic Systems and other applicable laws (“Law”). Acknowledgement and Consent You should read this Privacy Policy carefully to ensure that You understand how We process Your Personal Data. By agreeing to this Privacy Policy, You acknowledge and confirm that You read, understand and consent to all the terms of this Privacy Policy.

Statement of Personal Data Protection As a company that processes Personal Data, NRI Indonesia has established a “Personal Data Protection Statement” as follows: • We will comply with NRI Indonesia internal rules set for the collecting, using and providing of Personal Data appropriate to the content and scale of each service. • We will develop and implement measures to prevent unauthorized access to Personal Data, including measures to prevent the loss, destruction, modification and/or leakage of Personal Data managed by NRI Indonesia. Besides that, if a disruption occurs, NRI Indonesia will immediately take corrective action. • We will comply with all laws, regulations and standards related to Personal Data. • We will continue to improve the systems used for Personal Data management. Privacy Policy on each Product and Services This Privacy Policy is set out for each NRI Indonesia product and NRI Indonesia Services on the website, platform, or NRI Indonesia application, including emails and notifications. If there are provisions that different from this Privacy Policy and/or special provisions are included, so the Privacy Policy that has been specifically set forth on each Product or NRI Indonesia Services. We may include or offer website links that connect to third-party products or services through the NRI Indonesia Services. These third-party websites have separate and independent Privacy Policy and terms of use that You should review before using their services. We are not responsible or liable for the content and activities of any third-party websites, including their products and services. We strive to protect the integrity of the NRI Indonesia Services site and receive any feedback regarding these third-party links.

B. TYPES OF PERSONAL DATA PROCESSED

Personal Data is data about an identified or identifiable natural person individually or in combination with other information either directly or indirectly through electronic or non-electronic systems. You may be asked to provide Us with information about Yourself when working at or applying to Our Company, or using the NRI Indonesia Services. Personal Data that We collect and process may include: (a) Your identity information, such as full name, date of birth, age, gender, nationality, religion, marital status, tax identification number (NPWP: Nomor Pokok Wajib Pajak), social security information or its registration number on Employment Social Security Agency and/or Health Social Security Agency; (b) Your personal profile information, such as educational background (including educational transcript) or professional background (including previous employment details and history, work certificates; professional membership details and training certificates (if applicable), medical information, physical or mental health condition, login details (including facial or fingerprint recognition), password, profile picture, language preference, next of kin details; (c) Your contact information, such as mobile or home telephone number, email address, residential address; (d) Your employment-related information such as position, role, department, job responsibilities, and performance within Our Company records created and maintained for human resources purposes concerning performance evaluations, remuneration, payroll and benefits administration, warning or disciplinary records maintained, leave, resignation, retirement, or termination of employment; (e) Your compliance and whistleblowing-related information including Personal Data contained in reports submitted through Our whistleblowing systems, whether You are involved as a reporter, witness, or an individual reported in connection with a reported event, as well as information relating to investigations, examinations, disciplinary actions, or legal or administrative proceedings; (f) Your electronic information, such as Your geolocation, IP address or other unique device identifier, service usage data, data related to visitors and Users visits to the NRI Indonesia Services, User device data; (g) Your verification information, such as KTP identity number, KK number, passport number, visa information and/or work permit or other working documents (for foreign nationals); (h) Your payment information, such as payment method, payment amount, invoice details, and/or account data (bank name, card type, card issuer name); (i) Your transaction information, such as purchases or orders, interests, preferences, feedback, responses, types of services searched or purchased by User; and/or (j) Any other information about You when You work at or apply to Our Company, or use the NRI Indonesia Services.

Personal Data that We collect directly or indirectly from You includes but is not limited to descriptions, documents, photos, voice recordings, and/or video recordings. All Personal Data that We collect will be followed up to the processing and analysis stage in accordance with the Purpose of Personal Data Processing. Source of Obtaining Personal Data We obtain Your Personal Data from several sources as follows: (a) Information that You provide or submit to us; (b) Information generated while You use the NRI Indonesia Services; for example, We may collect Your IP address and device information when You visit the website nri.co.id; (c) Information that we obtain from third parties (such as agents (including recruitment agencies), vendors, other users, business partners, or third-party websites); (d) Information collected through promotional and/or marketing activities; (e) Cookies stored by Your web browser on Your device when You visit Our website. (f) Personal Data of other third-party individuals that You provide to us (such as the Personal Data of family members, spouses, friends, or other individuals), for which You have obtained the consent of such third-party individuals. (g) Information that is publicly available or accessible to the public; (h) Other written or oral communications or documents submitted to Us before or during the provision of the NRI Indonesia Services (whether on a contractual basis or otherwise) to You; (i) from the other executive, employee or internal sources, including Our whistleblowing systems, or through other internal reporting channels, to the extent permitted by applicable laws. Providing of incomplete Personal Data If there is an agreement for the providing of NRI Indonesia Services to You that requires Your Personal Data to enter into an agreement, but You choose not to provide such Personal Data or provide incomplete Personal Data to Us when requested, We may not be able to provide the services and execute the agreement that We have or are in the process of entering into with You.

C. PURPOSE OF PERSONAL DATA PROCESSING

Collection and Use of Personal Data We collect and use Personal Data from You with the following objectives. If We intend to process Your Personal Data for a purpose that is materially different from those described below, We will obtain Your consent where required under the applicable laws.: i) Users (a) To provide NRI Indonesia products and services, such as employee recruitment activities, research activities, consulting services (including management, business operations, information systems, etc.), development and operation of information systems and computer network systems, information processing services, content services, and information provision services; (b) To distribute our publications, such as Chiteki Shisan Sozo (Creation and Integration of Knowledge), IT Solutions Frontier, and/or other publications; (c) To provide information about new products and services; (d) To provide notifications regarding updates about our Company, as well as various seminars and exhibitions; (e) To send customer satisfaction surveys and/or other questionnaires; (f) To conduct marketing and promotional campaigns; (g) To manage contracts with customers; (h) To manage shareholder information; (i) To handle and process data entrusted to us, including Personal Data; and/or (i) To communicate with You as a User of the NRI Indonesia Services. ii) Employees and Applicants (a) For employment purposes (including recruitment) and personnel management; (b) To conduct the Company’s business and any other relevant activities; (c) To manage or terminate employment relationships; (d) To fulfil contractual obligations and perform human resource management, including managing and complying with the employment agreement between You and us, such as administering remunerations, welfare and benefits, administering Your advance expenses, registering for social security fund, provident fund, administering leaves, recording Your working hours, managing Your working report, administering warning issuance, administering Your training session, administering Your resignation; (e) To determine the suitability, eligibility, or qualifications for promotion in employment or continuance in employment; (f) To proceed with visa, work permit or other working licenses when required by laws (if applicable); (g) To manage activities such as making reservations for hotels or plane tickets for business, work or Company trips; (h) Data archiving; (i) To operate and comply with the Company’s implementation and operation of Our information security tools and whistleblowing system. These purposes include: i. Upholding the Company’s whistleblowing policy and administering the Company’s whistleblowing system in relation to executive’s or employees’ conduct and compliance with the applicable laws and the Company’s internal rules and policies and other actions for implementing and operating the Company’s whistleblowing system; ii. Implementing the security system of the Company with the primary objective of supplementing identification/password certification, monitoring executives’ or employees’ use of the internet, and enhancing security of the Company’s issued devices, and other actions for implementing and operating the information security tools; and iii. Contacting You concerning any queries in relation to employment, management, operation, administration, or dealing with/by the Company. (j) To manage risks and undertaking in internal audit and administration, such as preventing fraud or undertaking detection, to investigate requests for the use of Our internal information systems; (k) To manage executive’s or employees’ health, safety and insurance such as recording locations, images, and videos through Our vehicles, dealing with emergency incidents, providing annual health check-ups, providing health insurance or other insurance, and claiming the compensation under the insurance policy, etc; (l) To comply with relevant regulations and laws such as corporate laws, tax laws, and social security laws, to report information to government authorities as required by laws or upon receiving an order or a writ of attachment from the authority, to undertake detection and investigation under legal procedures and other regulations including to establish, and to comply or exercise the rights to legal claims or defend against the rights to legal claims; (m) To conduct research or analysis for management, operation, or administration of the Company and or group; (n) Internal communication for work-related matters; (o) Internal and external publication and marketing purposes; (p) To provide education, training and development opportunities; (q) To provide office equipment and supplies You are entitled to use (including Company phone and Company cars); (r) To monitor and safeguard Company-issued devices such as computers and mobile devices; (s) To check logs relating to Company-issued devices in case of incidents or problems; (t) To gather evidence for the establishment, exercise or defense of legal claims (including for possible grievances or disciplinary actions); (u) To allow You to proceed with Your working obligations under Your employment agreement, such as setting up Your work profile, working email, and other access accounts, registering office insurance, and providing Your information to Our vendors; and (v) To verify Your identity in order to perform Your working obligations such as issuing Your executive or employee card and name card or recording facial recognition when entering Our offices and premises.

iii) Other Individuals Where We process Personal Data of individuals who do not fall within the categories above, We may process such Personal Data for purposes related to Our business operations, the administration and operation of Our whistleblowing system, compliance with applicable laws, the establishment, exercise or defense of legal claims, and any other lawful purposes directly related to the purposes for which the Personal Data was collected. Personal Data Storage We will only store Your Personal Data for as long as it is necessary to fulfill the Purpose of Personal Data Processing, during the retention period or as long as such retention is required or permitted by applicable laws and regulations. We will stop retaining Your Personal Data as soon as it is deemed that the Purpose of Personal Data Processing is no longer needed by retaining Your Personal Data, or upon Your request to delete Your Personal Data, or retention is no longer necessary for the purpose of providing NRI Indonesia Services or after You no longer work for NRI Indonesia.

D. RIGHT OF USER

You as the owner of Personal Data have certain rights based on the provisions of applicable laws and regulations. You have the right to: (a) Obtain information about the basis and purpose of the request and use of Personal Data and the use of Personal Data; (b) Obtain access and obtain copies of Personal Data about him/herself in accordance with the provisions of applicable laws and regulations. (c) Users may add, complete, update, delete and/or correct mistakes and/ or inaccuracies in Personal Data about themselves in accordance with the Purposes of Personal Data Processing. Revocation of Consent You may revoke Your consent for the processing of Your Personal Data that We manage or under Our control, by sending an email to Us at admin@nri.co.id. We will then process Your request in accordance with this Privacy Policy and Our obligations following the applicable laws and regulations.

Request Rejection We may reject some or all of Your requests regarding Your Personal Data to the extent permitted by applicable laws and regulations, if the request is based on reasons that We consider irrelevant, not serious, fabricated, or are indicated to be related to acts that violate the terms and conditions of the Privacy Policy or violations of the law.

E. ACCURACY OF PERSONAL DATA

You are responsible for ensuring that any Personal Data provided to Us is true, accurate, and complete, and for promptly updating such Personal Data whenever there are any changes. We shall not be responsible for any consequences arising from inaccurate, incomplete, or outdated Personal Data provided by You.

F. RESTRICTIONS ON THE RIGHTS IN THE WHISTLE BLOWING SYSTEM For the purpose of protecting the confidentiality and safety of reporters or other individuals involved in the whistleblowing system, the Company may, to the extent permitted by applicable laws and regulations, restrict the exercise of certain rights by You in relation to Personal Data.

G. DISCLOSURE OR TRANSFER OF PERSONAL DATA

For the implementing of NRI Indonesia business operation, We may disclose Your Personal Data to third-parties, including: (a) Any party to whom We are forced or required to do so based on the provisions of applicable laws and regulations, or based on a court order/decision or request from another agency that is given authority based on applicable laws and regulations; (b) Any associated and related companies, affiliates and subsidiaries of NRI Indonesia, including those to be established in the future; (c) Any party that provides services or products in connection with the provision of NRI Indonesia Services, such as contractors, vendors, business partners, and/or any other party assisting Us in carrying out the Purposes of Personal Data Processing under this Privacy Policy; (d) Any professional service provider and relevant regulatory authorities both within and outside Indonesia, in connection with the plan of acquisition, merger and/or consolidation of NRI Indonesia either directly or indirectly (even if the transaction is not continued); (e) Any party or organization that is bound by a confidentiality agreement with Us; (f) Our auditors, consultants, accountants, lawyers or financial advisors or other professionals working on Our business. (g) Our affiliates located in other jurisdictions (including, but not limited to, Japan, Singapore and Malaysia) for the purpose of managing and handling whistleblowing reports. Other than as set out in this Privacy Policy, We may disclose and/or share Your Personal Data by notifying You or requesting Your consent for such disclosure or sharing. We will not sell Your Personal Data. When Your Personal Data is transferred outside the jurisdiction of Indonesia, We will ensure that will be protected to the same standards as the laws and regulations on the protection of Personal Data applicable in Indonesia, as may be amended from time to time. Personal Data Transfer Provisions We may process and/or transfer Your Personal Data both within and outside the territory of Indonesia. We will ensure that any Personal Data transferred outside the jurisdiction of Indonesia is protected in accordance with standards equivalent to those required under the applicable laws and regulations on Personal Data protection in Indonesia, as may be amended from time to time.

H. Security Management System for Personal Data

We shall implement appropriate security management measures, including data security protocols, to prevent loss, alteration, or leakage of Personal Data obtained in connection with this matter. We shall also strive to prevent unauthorized access, leakage, loss, and falsification of such Personal Data. In the event of a failure in its security control, We may notify You electronically.

I. WEBSITE SECURITY

We provide Website security using SSL (Secure Sockets Layer) data encryption technology used as a security measure to prevent tapping, hacking, and/or leaks on the network when Your Information and/or Personal Data is provided to Us on the Website. SSL (Secure Sockets Layer) is a common protocol used as a security measure for communication on the Website. This protocol functions to prevent tapping, hacking, and/or leaks of Your Information and/or Personal Data by encrypting it before it is sent over the Internet. We will make every effort to protect Your Information and/or Personal Data. However, the absence of absolute guarantees or security cannot be avoided.

J. COOKIE

We may collect certain information through technologies such as cookies. Cookies are small text files that store information on Your computer, mobile phone, or other device locally. With the help of cookies, the web server can save preferences and settings on the device You are using which will then automatically reopen on subsequent visits to Our website. Cookies can also be useful to make it easier for Users to access the website, such as Users do not have to repeat the login process when visiting Our website again. You have the right to decide whether to accept or reject cookies. Your consent to this Privacy Policy means agreeing to the use of Cookie technology on the NRI Indonesia Services.

K. PERIOD OF PERSONAL DATA PROTECTION

We will process the Personal Data that You provide to Us as long as You give Your consent. We will retain Your Personal Data for a retention period of 10 (ten) years, except You send Us a request to delete Your Personal Data via the email listed in the Contact Information. Provisions of retention period of 10 (ten) years and/or Your request for deletion of Personal Data can be waived if Your Personal Data is requested by the competent authority agency or still needed to fulfill the provisions of the applicable laws and regulations.

L. AMENDMENT OF PRIVACY POLICY

This Privacy Policy may be amended at any time in connection with amendments to applicable laws and regulations, amendments to Our internal policies, or other reasons for the purpose of protecting Your Personal Data. Information on amendments to this Privacy Policy may be notified in writing and/or via email, where Your email address is available. Information on amendments to this Privacy Policy may also be notified via the website, and/or platform unless applicable laws require Us to notify You directly. You may check Our website, platform or Your email inbox periodically to see any updates and/or amendments to this Privacy Policy.

M. CONTACT INFORMATION

If You have any questions, problems, complaints and/or comments regarding this Privacy Policy, You can contact Us via email: info@nri.co.id or Call Center: +62(21) 252-32112.