This Personal Data Processing Agreement (“Agreement”) is part of the INDICO Service Provider Master Agreement between PT Telkomsel Ekosystem Digital (“INDICO”) and INDICO's client (“Client”), wherein one of INDICO's services involves processing the Client's personal data.

​

Both the Client and INDICO are referred to as “Parties” hereafter. The Parties hereby declare the following:

• The Client acts as the Personal Data Controller for the Client’s Personal Data;

• The Client, in conducting its business, wishes to process its Personal Data for business purposes;

• INDICO and the Client have signed the INDICO Service Provider Master Agreement, necessitating a derivative agreement for Personal Data Processing related to INDICO services, which will be governed by this Agreement.

​

Thus, INDICO and the Client agree to be bound by this Agreement under the following terms:

​

A. DEFINITIONS AND INTERPRETATIONS

​

Unless otherwise defined in this Agreement, terms in this Agreement will have the following meanings:

​

1. “Personal Data” means any information about an individual, either identified and/or identifiable, directly or indirectly, through electronic and/or non-electronic systems.

2. “Client’s Personal Data” refers to Personal Data under the control of the Client in conducting its business activities.

3. “INDICO Service Provider Master Agreement” refers to the master agreement between INDICO and the Client for the provision of INDICO services.

4. “Personal Data Controller” refers to the Client entity determining the purpose and means of processing Client’s Personal Data.

5. “Personal Data Processor” refers to INDICO, which processes Personal Data on behalf of the Personal Data Controller.

6. “Data Subject” refers to an individual associated with the Personal Data.

7. “Sub-Processing” refers to another processor appointed by INDICO to process Client’s Personal Data.

8. “Personal Data Protection Law” refers to all laws, codes, statutes, ordinances, regulations, or enforcement rulings related to data protection or personal data, issued by governmental or quasi-governmental authorities in any jurisdiction, as amended from time to time, applicable to the implementation of this Agreement by either party. This includes, but is not limited to, Law No. 27 of 2022 on Personal Data Protection, Law No. 11 of 2008 (last amended by Law No. 1 of 2024 on Electronic Information and Transactions), Government Regulation No. 71 of 2019 on the Organization of Electronic Systems and Transactions, Ministry of Communication and Informatics Regulation No. 5 of 2021 on the Organization of Telecommunications Services, and Ministry of Communication and Informatics Regulation No. 20 of 2016 on Personal Data Protection in Electronic Systems, including its implementing regulations.

​

B. PERSONAL DATA PROCESSING

​

1. In processing the Client’s Personal Data, INDICO will:

• Conduct Personal Data processing in accordance with the Personal Data Protection Law;

• Process Personal Data following the instructions and purposes established by the Client as the Personal Data Controller; and

• Process Client’s Personal Data as necessary for INDICO services per the INDICO Service Provider Master Agreement.

2. INDICO will also take reasonable steps to ensure the reliability of any employee, agent, or other party who may have access to the Client’s Personal Data, ensuring that such access is limited to those who need to know/access the Client’s Personal Data to fulfill INDICO services under this Agreement and in compliance with the Personal Data Protection Law.

​

C. SECURITY

​

1. Considering the circumstances, implementation costs, processing nature, scope, context, and purposes, as well as varying security risks, INDICO will apply appropriate technical and organizational measures to ensure a level of security appropriate to the risks of processing Client’s Personal Data under the Personal Data Protection Law.

2. For security purposes in the processing of Personal Data, the Client’s Personal Data disclosed will be stored following the Personal Data Protection Law.

​

D. TERM AND TERMINATION

​

1. This Agreement will remain valid and in effect for the duration stipulated in the INDICO Service Provider Master Agreement.

2. For the termination or expiration of this Agreement, the Parties waive the applicability of Article 1266 of the Indonesian Civil Code, whereby court rulings, decisions, or orders are unnecessary to terminate this Agreement.

​

E. SUB-PROCESSING

​

INDICO will not appoint (or disclose Client’s Personal Data to) any Sub-Processor unless necessary for the implementation of INDICO services.

​

F. DATA TRANSFER

​

The Client agrees and consents that INDICO may transfer Client’s Personal Data upon written consent from the Client to provide INDICO services under this Agreement, ensuring that the transfer is carried out in accordance with the Personal Data Protection Law.

​

G. PERSONAL DATA BREACH

​

1. INDICO will notify the Client without undue delay upon becoming aware of any Personal Data breach involving Client’s Personal Data, providing the necessary information to fulfill any obligations under the Personal Data Protection Law or to notify the relevant Data Subjects.
    

2. INDICO will cooperate with the Client to take reasonable steps to assist in investigating, mitigating, and remedying any affected Client’s Personal Data from the breach.

​

H. PERSONAL DATA DELETION

​

1. INDICO will promptly delete Client’s Personal Data in accordance with the Personal Data Protection Law under the following conditions:

• Upon the completion of processing Client’s Personal Data according to the Client’s request;

• Upon the Client’s request to delete the relevant Personal Data during the processing; or

• Upon the termination of INDICO services per the INDICO Service Provider Master Agreement.

​

2. INDICO will notify the Client in writing about the deletion of Client’s Personal Data.

​

3. If the Client does not respond within 24 hours of the written notice, INDICO is authorized to proceed with the deletion.

​

4. Upon deletion, INDICO will provide proof of the deletion.

 

5. After deletion, the Client releases INDICO from any claims or liabilities related to the deleted Personal Data.

​

I. LEGAL BASIS FOR PROCESSING PERSONAL DATA

​

The Client guarantees that it has a valid legal basis for processing Personal Data, including but not limited to:

• Explicit consent from the Data Subject for specific purposes.

• Consent for processing by third parties other than the Client.

• Fulfillment of the Personal Data Controller’s legal obligations.

• Processing based on legitimate interests, provided these are balanced against the Data Subject’s rights.

• Compliance with other relevant provisions under the Personal Data Protection Law.

​

J. AUDIT RIGHTS

​

1. INDICO will provide the Client with necessary information to demonstrate compliance with this Agreement. INDICO will also allow and cooperate with audits and inspections by the Client or its authorized auditors.
    

2. Audit rights will only apply to the processing of Client’s Personal Data under this Agreement.

​

K. LAW AND JURISDICTION

​

1. This agreement is governed by and interpreted in accordance with the laws of the Republic of Indonesia.
    

2. If a dispute or disagreement of any kind (hereinafter referred to as “Dispute”) arises between the Parties in connection with this Agreement, the Parties are obligated, for a period of 30 (thirty) calendar days after the receipt of written notification from one Party regarding the existence of a Dispute by the other Party, to attempt to resolve the Dispute initially through mutual consultation and agreement between the Parties.
    

3. If the Dispute cannot be resolved within 30 (thirty) calendar days through mutual consultation as referred to in clause 18.2, the Parties agree to settle the Dispute through the Indonesian National Arbitration Board (BANI) in accordance with the BANI procedural rules (hereinafter referred to as “BANI Rules”). The arbitration will be held in Jakarta and conducted in the Indonesian language. The Parties hereby agree and acknowledge that in accordance with Article 60 of Law Number 30 of 1999 (hereinafter referred to as the “Arbitration Law”), the arbitration award is final and binding, and cannot be appealed to any court or judicial body. The Parties hereby agree to waive Article 48 paragraph (1) and Article 73 item (b) of the Arbitration Law, and thus the mandate of the arbitral tribunal will remain valid until the issuance of the arbitration award. All costs, expenses, and/or expenditures incurred during the arbitration process until the arbitration award is issued will be shared equally between the Parties.

​

L. GENERAL PROVISIONS

​

1. Confidentiality: INDICO and the Client must maintain the confidentiality of the other Party’s information and may not disclose it without written consent unless required by law or already in the public domain.

2. Notices: All notices under this Agreement must be in writing and delivered to the address or email specified in the INDICO Service Provider Master Agreement or as updated by the Parties.

3. Amendments: Any amendments to this Agreement are invalid unless made in writing and signed by authorized representatives of both Parties.

4. Severability: The invalidity of any provision of this Agreement does not affect the validity of the remaining provisions, which remain in full force and effect.

​