Polis Privasi

Dear Valued Users and Guests,

This Privacy Policy and Personal Data Protection Notice (the "Notice") is provided to all valued users and guests of PT GOMO CARS INDONESIA (Company Registration No: 4023092631107336) and its subsidiaries and its affiliates (the "GOMO") in accordance with the provisions of the Law No. 27 of 2022 concerning the Personal Data Protection Law (the "PDPA").

During your engagement with us, we will collect and process your personal data for various purposes, including but not limited to communication, provision of products and/or services, response to inquiries, delivery of information and updates on our products, services, and promotions offered by GOMO, and other necessary activities to operate and maintain our business as set out in our Personal Data Protection Policy (as defined below) (collectively referred to as the "Purposes").

At GOMO, we prioritize the security of your personal data. We have implemented robust measures to ensure that your information is securely stored and protected from unauthorized access or misuse. You have the right to request access to and/or obtain a copy of your personal data held by us. You also have the right, at any time, to request the limitation of processing and use of your personal data. To exercise any of these rights, please submit a written request to our Compliance Officer at hello@gomocars.com. We will review and respond to your request promptly in accordance with applicable data protection laws and regulations.

By accessing this website and/or providing your personal data to us, you are deemed to have carefully read, fully understood, and unconditionally accepted the terms of this Notice. Furthermore, by continuing to use our services, you expressly consent to the collection and processing of your personal data by GOMO in strict compliance with this Notice and our Personal Data Protection Policy.

We reserve the right to update and amend this Notice, as well as our Personal Data Protection Policy, from time to time. Any amendments will be communicated to you through announcements on our website or other appropriate means.

Thank you for your understanding and cooperation.

Dated: 12 June 2024

PERSONAL DATA PROTECTION POLICY (the “Policy”)

1. INTRODUCTION

1.1 This Policy applies to the processing of personal information about individuals, including but not limited to customers, vendors, distributors, suppliers, service providers, joint venture/business partners, job applicants, and employees, held by us. We are committed to processing your Personal Data (as defined below) in compliance with the provisions of the Law No. 27 of 2022 concerning the Personal Data Protection Law (the “PDPA”) and its implementing rules and regulations, as well as any other applicable laws and regulations governing data protection and privacy in the Republic of Indonesia.

1.2 By providing your Personal Data to us and/or continuing to access and use our website (the "Site"), you acknowledge that you have read, understood, and expressly consent to the processing of your Personal Data by us in accordance with the provisions set out in this Policy and the requirements of the PDPA and its implementing rules and regulations.

1.3 We reserve the right to modify, update, and/or amend this Policy from time to time, with reasonable prior notice to you. We will notify you of any amendments through announcements on the Site or by other appropriate means, as required by law. It is your responsibility to review the Policy periodically to stay informed of any changes.

1.4 In the event that you do not agree to this Policy or any amendments made to this Policy, we may not be able to provide you with our services, and you may be required to terminate any relevant agreements with us and/or discontinue accessing or using the Site, as permitted by applicable laws and regulations.

2. COLLECTION

2.1 The term "Personal Data" shall refer to any information in our possession or control that directly or indirectly relates to an individual, to the extent that the individual can be identified or is identifiable fromthat information and other data in our possession. This may include, but is not limited to, name, address, telephone number, identification/passport number, date of birth, photograph, email address, household information, as well as Sensitive Personal Data as defined under the PDPA, which includesinformation regarding the physical or mental health or condition of a data subject and religious beliefs.

2.2 The types of Personal Data collected depend on the purpose of collection. We may process your Personal Data by collecting, recording, organizing, storing, using, disclosing, transferring, and/or otherwise processing it, as permitted or required by applicable laws and regulations.

2.3 Your Personal Data may be collected from you during your dealings with us in any manner, including but not limited to transactions, communications, events, seminars, road shows, customer satisfaction surveys organized and/or sponsored by us, as well as from publicly available sources. We may also receive, store, and process your Personal Data provided or made available by third parties, credit reference bodies, regulatory and law enforcement authorities, for purposes including the deliveryof our products and/or services, the performance of contractual obligations, and compliance with legal and regulatory obligations.

2.4 The Personal Data provided by you to us, collected by us from you, or obtained from other sourcesnecessary for the fulfilment of the Purposes stated at the time of collection, may be processed for, including but without limitation to, the following purposes (collectively referred to as the "Purposes"):

(a) Communication with you;
(b) Maintenance and improvement of customer relationships;
(c) Assessment, processing, and provision of products, services, and/or facilities;
(d) Administration and processing of payments related to products, services, and/or facilities requestedby you;
(e) Establishment of your identity and background verification;
(f) Response to your inquiries or complaints and resolution of any issues and/or disputes arising in connection with any dealings with us;
(g) Provision of information and/or updates on our products, services, upcoming promotions offered byus, and/or events organized by us and selected third parties that may be of interest to you from time totime;
(h) Direct marketing purposes via SMS, phone call, email, fax, mail, social media, and/or any other appropriate communication channels;
(i) Facilitation of your participation in, and administration of, any events including contests, promotions,or campaigns;
(j) Awarding points in a loyalty or rewards program;
(k) Maintenance and updating of internal record keeping;
(l) Internal administrative purposes;
(m) Sending seasonal greetings messages from time to time;
(n) Sending invitations to join our events, promotions, and product launch events;
(o) Monitoring, reviewing, and improving our events, promotions, products, and/or services;
(p) Conducting credit reference checks and establishing your creditworthiness, where necessary, in providing you with the products, services, and/or facilities;
(q) Administration and execution of your commercial transactions with us (such as tender awards, contracts for service, or tenancy agreements);
(r) Processing of any payments related to your commercial transactions with us;
(s) Processing and analysis of your Personal Data either individually or collectively with other individuals;
(t) Conducting market research or surveys, internal marketing analysis, customer profiling activities, analysis of customer patterns and choices, planning, statistical and trend analysis in relation to our products and/or services;
(u) Sharing of your Personal Data with auditors for our internal audit and reporting purposes;
(v) Sharing of your Personal Data pursuant to any agreement or document which you have duly entered into with us for purposes of seeking legal and/or financial advice and/or commencing legal action;
(w) Sharing of your Personal Data with our joint venture/business partners to jointly develop products and/or services or launch marketing campaigns;
(x) Sharing of your Personal Data with insurance companies necessary for the purpose of applying and obtaining insurance policy(ies), if necessary;
(y) Sharing of your Personal Data with financial institutions necessary for the purpose of applying and obtaining credit facility(ies), if necessary;
(z) Audit, risk management, and security purposes;
(aa) Detection, investigation, and prevention of fraudulent, prohibited, or illegal activities;
(bb) Enabling us to perform our obligations and enforce our rights under any agreements or documents that we are a party to;
(cc) Transfer or assignment of our rights, interests, and obligations under any agreements entered intowith us;
(dd) Compliance with applicable legal and regulatory requirements and making disclosures under the requirements of any applicable law, regulation, direction, court order, by-law, guideline, circular, or code applicable to us;
(ee) Enforcement or defense of our rights and your rights under, and compliance with, our obligations under the applicable laws, legislation, and regulations; and
(ff) Verification and background checks as part of any recruitment and selection process in connection with your application for employment with us; and/or for other purposes required to operate, maintain and better manage our business and your relationship with us, which we notify you of at the time of obtaining your consent; and you agree and consent to us using and processing your Personal Data forthe Purposes in the manner as identified in this Policy. If you do not consent to us processing your Personal Data for one or more of the Purposes, please notify us at the contact details below.

2.6 The collection of your Personal Data by us may be mandatory or voluntary, depending on the Purposes for which your Personal Data is collected, and as required by applicable laws and regulations. In cases where it is mandatory for you to provide us with your Personal Data, and you fail or choose not to provide us with such data or do not consent to the processing of your Personal Data as outlined in this Policy, we may be unable to provide the requested products and/or services or otherwise engage with you to the extent necessary.

3. DISCLOSURE

3.1 We are committed to maintaining the confidentiality of your Personal Data and will not sell, rent, transfer, or disclose it to any third party without obtaining your explicit consent. However, there may beinstances where we need to disclose your Personal Data to third parties for one or more of the Purposes mentioned above. These instances may include, but are not limited to:

(a) Sharing with GOMO's related corporations and affiliates, either in the Republic of Indonesia or overseas, to facilitate the efficient provision of our products and/or services.

(b) Disclosing to your immediate family members and/or emergency contact person, as notified to us, in order to address any urgent matters.

(d) Disclosing to individuals or entities under a duty of confidentiality that we have engaged to fulfill ourobligations to you and who have undertaken to maintain the confidentiality of your Personal Data.

(e) Disclosing to relevant parties involved in legal proceedings or potential legal proceedings.

(f) Sharing with auditors, consultants, lawyers, accountants, or other financial or professional advisers on a strictly confidential basis, appointed by us to provide services for our business operations.

(g) Sharing with nominated or jointly appointed parties by GOMO and other service providers for the establishment and maintenance of a common database, where there is a legitimate common interest.

(h) Storing data in data centers and/or servers located within or outside Republic of Indonesiafor purposes of data storage or related operations.

(i) Sharing with payment channels, including financial institutions, for assessing, verifying, effectuating,and facilitating payment of any amounts due in connection with your purchase of our products and/or services.

(j) Disclosing to government agencies, law enforcement agencies, courts, tribunals, regulatory bodies, industry regulators, ministries, statutory agencies, or bodies, offices, or municipalities, in any jurisdiction, if required or authorized by applicable laws, regulations, orders, judgments, or queries from relevant authorities.

(k) Sharing with joint venture/business partners, third-party product and/or service providers, suppliers,vendors, contractors, data processors, or agents that are involved in providing related products and/or services, supporting our business operations, or fulfilling the Purposes outlined above. This may include call centers, telecommunication companies, logistics companies, information technology companies, and data centers, as well as insurance companies for insurance-related matters.

(l) Disclosing to financial institutions for the purpose of applying and obtaining credit facilities, if necessary.

(m) Sharing with financial institutions, merchants, and credit card organizations for commercial transactions between you and GOMO.

(n) Publishing your name, photographs, and other Personal Data without compensation in the event you become a winner in a contest, solely for advertising and publicity purposes to the general public.

(o) Disclosing to third-party credit reporting or employment agencies as part of the recruitment and selection process or other employment-related purposes in connection with your application for employment with GOMO.

(p) In the event of a potential, proposed, or actual sale, disposal, merger, acquisition, consolidation, reorganization, funding exercise, or asset sale relating to GOMO, your Personal Data may be disclosed or transferred to a third party. Such disclosure or transfer would occur as a result of or in connection with the Transaction.

3.2 Cross-Border Data Transfer: In certain circumstances, it may be necessary for us to transfer your Personal Data to recipients located in countries outside of the Republic of Indonesia. These countries may have data protection laws that differ from those in the Republic of Indonesia. By providing your Personal Data to us and consenting to this Notice, you acknowledge and agree that we may transfer your Personal Data to such recipients as necessary for the fulfilment of the Purposes outlined in this Notice, in accordance with applicable laws and regulations. We will take appropriate measures to ensure that any cross-border transfer of your Personal Data is done in compliance with relevant data protection laws and that adequate safeguards are in place to protect the security and privacy of your Personal Data. Please note that if you have any concerns about the transfer of your Personal Data to countries outside the Republic of Indonesia, you may contact us for further information and clarification regarding the safeguards we have implemented.

4. ACCURACY

4.1 We are committed to maintaining the accuracy, completeness, and reliability of all Personal Data in our possession. It is crucial that the Personal Data you provide to us is accurate, not misleading, updated, and complete. As such, by accessing our products, services, and/or facilities, you expressly warrant and declare that all your Personal Data submitted or to be submitted to us are accurate, not misleading, updated, and complete in all respects. You further confirm that you have not withheld any material Personal Data. By providing your Personal Data, you authorize us to rely on the accuracy andup-to-dateness of the information provided for processing purposes.

4.2 It is your responsibility to promptly update us if any of the Personal Data previously provided to us becomes inaccurate, incomplete, misleading, outdated, or undergoes any changes. You can fulfil this obligation by contacting us at the contact details provided below.

5. ACCESS

5.1 Subject to the exceptions provided under the PDPA you have the legal right to request access to, obtain a copy of, update, or correct your Personal Data held by us. We may charge a reasonable fee, as permitted by the PDPA, to cover the administrative costs associated with processing your request for access to your Personal Data.

5.2 While you have the legal right to access and/or correct your Personal Data, we reserve the right to refuse your request in accordance with the provisions of the law. Grounds for refusal may include situations where providing access to your Personal Data would involve disproportionate expenses relative to the risks to your privacy, or where the rights of others may be infringed, among other reasons recognized under the law.

5.3 You have the legal right at any time to request that we limit the processing and use of your Personal Data. For example, you may request that we cease sending you marketing and promotional materials or contacting you for marketing purposes.

5.4 Furthermore, you have the legal right, by providing written notice to us, to withdraw your consent (in full or in part) that was previously given to us, subject to any applicable legal restrictions, contractual conditions, and a reasonable duration of time for the withdrawal of consent to take effect. Itis important to note that the withdrawal of consent may have legal consequences. Depending on the extent of your withdrawal of consent for us to process your Personal Data, it may result in the discontinuation of your existing relationship with us and/or the termination of any contracts you have with us.

6. RETENTION

6.1 Any of your Personal Data provided to us is retained for as long as the Purposes for which the Personal Data was collected continues continue. Your Personal Data will be destroyed from our records and system in accordance with our retention policy in the event your Personal Data is no longer required for the said purposes unless its further retention is required to satisfy a longer retentionperiod to meet our operational, legal, regulatory, tax or accounting requirements.

7. SECURITY

7.1 We are fully committed to ensuring the security and confidentiality of your Personal Data. In order to prevent unauthorized access, disclosure, alteration, or other similar risks, we diligently implement appropriate technical, physical, electronic, and procedural security measures in accordance with the requirements of applicable laws, regulations, and industry standards. These measures are designed tosafeguard your Personal Data against unauthorized or unlawful processing, accidental loss, destruction, alteration, unauthorized disclosure, or access.

7.2 We will regularly review and update our security measures to maintain their effectiveness and ensure that any authorized third parties who have access to your Personal Data are bound by strict confidentiality obligations and use it solely for the Purposes stated in this Policy.

7.3 While we strive to implement robust security procedures to protect the Site and your electronic communications with us, it is important to acknowledge that the Internet cannot guarantee absolute security. Therefore, we cannot guarantee the security of any information transmitted over the Internet. However, we take all reasonable steps to protect your Personal Data and require all our employees, joint venture/business partners, agents, contractors, vendors, suppliers, data processors, and third-party product and/or service providers involved in the processing of your Personal Data to uphold the confidentiality and security of your information.

7.4 Please be aware that communications over the Internet, such as emails and webmails, may not besecure unless encrypted. The transmission of data via the Internet may involve risks, including delays, data breaches, and unauthorized access by third parties. While we take precautions to secure your Personal Data, we cannot guarantee the security of such transmissions.

7.5 We shall not be held responsible for any loss, damage, unauthorized access, interception, or compromise of Personal Data that is beyond our reasonable control, including but not limited to unforeseen circumstances, force majeure events, or acts of third parties.

8. TRANSFER OUTSIDE OF THE REPUBLIC OF INDONESIA

8.1 Our information technology storage facilities and servers may be located in other jurisdictions outside of the Republic of Indonesia. This may include instances where your Personal Data isstored on servers located outside the Republic of Indonesia. Furthermore, your Personal Data may be disclosed or transferred to entities located outside the Republic of Indonesia or accessed from countries outside the Republic of Indonesia when using the Site. Please note that these foreign entities may be established in countries that may not provide a level of data protection equivalent to that offered in the Republic of Indonesia under Republic of Indonesia data protection laws. By accessing our services and providing your Personal Data, you expressly consent to the transfer of your Personal Data outside of the Republic of Indonesiafor such purposes. We will take reasonable steps to ensure that all such third parties located outside the Republic of Indonesia shall not use your Personal Data for purposes other than those specified in this Policy and that appropriate safeguards are in place to protect the confidentiality and privacy of your Personal Data.

9. EXTERNAL LINKS

9.1 If any part of the Site includes links to other websites, please be aware that those websites operateindependently and are not governed by this Policy. We do not assume any responsibility or liability for the privacy practices, content, or activities of those websites.

9.2 Likewise, if you subscribe to an application, content, or a product from our strategic partner and you directly provide your Personal Data to that third party, please note that your Personal Data will be subject to the privacy/personal data protection policy of that third party (if they have such a policy) and not to this Policy.

9.3 In order to protect the interests of GOMO and its users, we may employ measures to monitor the links provided on the Site to ensure their safety, security, and compliance with applicable laws and regulations. We reserve the right to remove or disable any links that may pose a risk or harm to GOMO, its users, or the integrity of our services.

9.4 We strongly recommend that you carefully review and understand the privacy/personal data protection statement/policy posted on those other websites to familiarize yourself with their proceduresfor collecting, processing, using, and disclosing personal data. It is important to assess their privacy practices before submitting your Personal Data to those websites.

10. COOKIES

10.1 We utilize industry-standard technology known as "cookies" on our Site. Cookies are small piecesof information stored on the hard drive of your computer or device for record-keeping purposes. Thesecookies enable us to track your visits to the Site and may be used to store your preferences for enhanced ease and convenience during your usage of the Site. It is important to note that third-party advertising networks may also employ their own cookies on your hard drive when serving advertisements.

10.2 The anonymous clickstream data collected by us through the use of cookies may include your Internet Protocol (IP) address, web browser software, date and time of your visit to the Site, and the success of your requests (including search requests and interactions with Site links). Please be informed that all such information collected through cookies does not constitute Personal Data and does not enable your identification. This information is solely utilized for the purpose of managing and enhancing user experience and identifying areas for improvement on the Site.

10.3 The utilization of cookies has become an industry standard and is commonly employed on most major websites. Most web browsers are initially set to accept cookies. However, if you prefer, you have the option to reset your browser settings to receive notifications when cookies are sent to your device or to reject the acceptance of cookies altogether. It is important to be aware that certain features of the Site may not function properly if you choose to disable cookies in your browser settings.

11. CONTACT

11.1 Should you have any inquiries, concerns, or complaints regarding this Policy, or if you wish to exercise your rights to make data access or correction requests relating to your Personal Data, you may contact our designated Compliance Officer. Please direct your communication to our Compliance Officer via email at hello@gomocars.com. We will make reasonable efforts to respond to your inquiries and address your concerns in a timely and appropriate manner.

Dated: 12 June 2024