Privacy Notice of PT XL Axiata Tbk.
(“Privacy Notice” atau “Notice”)
PT XL Axiata Tbk. (“XL Axiata”) is a telecommunications company legally domiciled in Indonesia, which is part of the Axiata Group Berhad (hereinafter referred to as "XL Axiata", or "us"). XL Axiata is the Data Controller of all personal information collected, unless stated otherwise. Contact details for XL Axiata are listed in the “Contact Us” section below.
In carrying out operational activities, we are always committed to protecting the personal data of parties related to XL Axiata, including the personal data of XL Axiata customers, contractors and business partners.
Our position on protecting your privacy can be summarized by the privacy protection principles below:
We are always open about what, why and how we collect and protect your personal data so that you can make the right decisions and express consent for us.
We respect your rights as an individual, so your Personal Data is completely under your control.
we use your Personal Data only for the specific purposes we state in this Notice, and we will retain it as long as necessary for that purpose or based on regulatory provisions.
We have established strong cyber security practices in line with leading industry standards to protect your Personal Data that you have shared with us.
We are very careful when transferring your Personal Data to third parties such as vendors, contractors, business partners and government authorities.
This Privacy Notice applies to personal information about yourself (“Personal Data”) that we collect, obtain, or process when you:
In short, this Privacy Notice applies to:
In carrying out operational activities, XL Axiata is your Personal Data Controller who collects Personal Data based on legal grounds based on laws and regulations, and will depend on the type and purpose of collecting Personal Data.
In general, we collect and process Personal Data on several grounds, including:
If you have any questions regarding this matter, please contact us on the contact details provided in the "Contact Us" section below.
XL Axiata collects your Personal Data when you:
The Personal Data we may collect from you includes but is not limited to:
We may obtain and process your Personal Data for the following purposes:
In some services and features, we use your Personal Data to generate automated decision making (including profiling) that may affect you. Automatic decisions are decisions regarding the provision and offering of services that are made automatically based on the results of algorithmic calculations, without any human intervention.
We use automated analysis to make predictions such as the types of products or services you may be interested in, or for profiling to prevent criminal activity. XL Axiata's artificial intelligence can lead to automatic processing of your Personal Data in various ways. If our automated decision-making initiatives or plans have significant consequences for you, we will implement measures to protect your rights, freedoms and interests, by conducting a Data Privacy Impact Assessment to identify measures that may appropriate to protect these rights, or obtain your consent as required by laws and regulations.
Before using XL Axiata's network, products, and/or services, we will only collect and process Personal Data belonging to children under the age of 18 who have obtained approval from the parent or guardian of the owner of the Personal Data.
In the case of processing Personal Data belonging to persons with disabilities, consent can be given by the persons with disabilities concerned and/or their guardians.
Personal Data that has been collected will be stored for the period necessary to fulfill the purposes stated above. We may retain your Personal Data to provide the services you have requested, or for other legitimate interests, such as complying with our legal obligations under laws and regulations and obligations from government authorities, resolving legal issues, and carrying out our business operational activities. The retention period for Personal Data is based on applicable legal requirements. However, if there are no relevant laws and regulations, your Personal Data will be stored for the required time. Furthermore, we may store this Personal Data in the form of printed or electronic copies.
We may store your data in data centers or archival storage facilities managed by us or by data storage service providers, for and on our behalf. All of our storage locations, systems and products are equipped with the necessary security controls to ensure the protection of Personal Data.
Retention periods may vary based on the type of information and legally required retention periods, the course of judicial proceedings, business conduct requirements, intellectual property rights exercise, agreements, operational requirements, and archiving. In the event that your Personal Data is deleted from our system, the data will be deleted or destroyed using appropriate security protocols so that it cannot be reconstructed or read again by unauthorized parties.
This Privacy Notice does not discuss, and we are not responsible for, policies and practices carried out by third parties or other organizations that do not operate for and on behalf of XL Axiata, including policies and practices relating to privacy and security, collection, processing, use, storage and disclosure of Personal Data. This includes:
We strive to process your information in a secure environment by preventing unauthorized or unlawful access. We also protect your Personal Data from loss or damage. We have implemented various types of physical, technical, and administrative safeguards to protect your Personal Data and our network from unauthorized access. These steps include:
We require our suppliers and vendors to apply similar protections when they access or use the Personal Data we share with them. We also always encourage you and all users of XL Axiata services to protect the data, systems, networks and services they use. However, no technology, data transmission or system can be guaranteed to be 100% secure. Therefore, if you identify a leak of Personal Data, please notify us immediately in the manner listed in the "Contact Us" section below.
We cooperate with other partners to provide services as part of fulfilling our obligations to you. When we share your Personal Data with our partners, we implement the necessary steps to limit the use of your Personal Data to lawful reasons only in accordance with this Privacy Notice, as well as adequate confidentiality and security measures. In addition to these purposes, we also share information with third parties to fulfill our legal obligations such as when requested by government authorities and to handle legal processes, to protect your vital interests, to carry out tasks in the public interest when requested by government authorities, public services, or the exercise of our authority based on laws and regulations, as well as to fulfill other legitimate interests by taking into account our goals, needs and the balance of our interests and your rights.
We may disclose your Personal Data as part of our corporate actions to the extent necessary, such as in the event of a reorganization, merger, sale of company assets, establishment of a joint venture, transfer of all or part of our business, assets or shares (including in connection with bankruptcy). In the event of a corporate action that results in the transfer of Personal Data, we will notify you as required by law.
XL Axiata always takes necessary and reasonable steps to keep your Personal Data accurate, complete and up to date. You can choose not to receive promotional e-mails or other XL Axiata communications by contacting us at the contact details listed below. This choice does not apply to receiving product or service communications that are considered part of XL Axiata products or services (such as billing information or service expiration), unless you choose not to use the product or service anymore.
In addition, we do not require you to provide us with your Personal Data. The decision to provide Personal Data is voluntary. However, if you do not wish to provide the required Personal Data, you may not be able to continue activities or receive benefits from our services where such Personal Data is required.
We may transfer your Personal Data across geographic boundaries to other parties as long as we can ensure that the protection of their Personal Data is at the same level as we do. Transfer of Personal Data is carried out based on our standard contracts with data protection clauses or data transfer agreements with the same rights and obligations for the party receiving the information to protect the security and confidentiality of your Personal Data. XL Axiata does not share your Personal Data, except under the following conditions:
In all cases, third parties must agree to strict obligations to maintain the confidentiality of Personal Data and use it only for the purpose for which it was obtained.
We respect your rights and privacy, and we always take the necessary steps to ensure that your personal data is always accurate and up to date. We guarantee you that:
To exercise your rights, you must comply with all policies, procedures and steps that we have set. In the event that there is a request for service termination by you, this remains subject to our approval to the extent permitted by law. You can contact us in the ways listed in the "Contact Us" section listed below.
You can use our products or services and access our platforms or websites without providing your Personal Data. However, some activities or services on our products, services, platforms or websites require us to collect certain Personal Data about you. If you cannot provide the Personal Data, then it can:
If you wish to correct or update your Personal Data, or to request access to your Personal Data held by us, you can contact us to make a written request in the manner listed in the "Contact Us" section below. If you wish to change your Personal Data, please note that we may still need to retain certain information for record-keeping purposes, and/or to complete any transactions you initiated prior to requesting the change (for example, when you make a purchase or enter a promotion, you may not may change the Personal Data provided until after the completion of the purchase or promotion). Some of your information may also remain in our systems and other records where necessary to comply with applicable laws. At your request and where the law requires us to do so, we will tell you what Personal Data we hold about you.
If you have questions about this Privacy Notice, or if you choose to exercise one of your rights above, you can contact us via:
In cases of alleged violation of your privacy, in relation to the processing of your Personal Data by us, you can submit an objection to the competent authority based on statutory provisions.
So long as it is necessary, XL Axiata has the right to update this Privacy Notice without prior notification to you. This Privacy Notice is the most current and will supersede any previous version. We strongly recommend that you check this Privacy Notice from time to time to be informed of any changes to the Privacy Notice.
This Notice was last updated on 22nd August 2023.