PRIVACY POLICY

SERVICES: INSIGHT HUB

Version: 01.24-02-2026

INTRODUCTION

Before registering as a participant and/or accessing and/or using the “Insights Hub” service organized by Us, you must first read, understand, comply with, and agree to be subject to and bound by this Privacy Policy, including any amendments thereto.

PT Global Loyalty Indonesia, as the organizer, is committed to protecting your privacy (hereinafter referred to as “We”, “Us”, or “Our”). We act as the data controller for any Personal Data collected from you.

In this Privacy Policy, We explain how We will obtain, collect, process, analyze, store, correct, update, display, announce, transfer, disseminate, disclose, delete, destroy, and/or protect your Personal Data (“Process Personal Data” or “Processing of Personal Data”). This Privacy Policy applies to you who access and/or use the Insights Hub services, including downloading data analysis reports and strategic analysis reports named the Spotlight report (“Services”), and who have agreed to this Privacy Policy.

Please read and understand this Privacy Policy carefully to learn how We implement our personal data protection practices.

A. CONSENT TO DATA PROCESSING

By agreeing to the Privacy Policy, you are deemed to: (i) Have read, understood, and agreed to all provisions in this Privacy Policy; and (ii) Have given consent to Us to Process your Personal Data in accordance with this Privacy Policy. In the event that you disclose Personal Data belonging to and/or relating to other parties to Us (Personal Data relating to a spouse, family members, or data subjects other than the provider of the Personal Data) for any purpose in connection with the utilization of the Services, We assume that you have obtained consent from that relevant party as the owner of the Personal Data to make the disclosure to Us. Accordingly, you represent such other party in consenting to the Processing of Personal Data that We have carried out. We may request proof of consent from that other party from you at any time, if necessary.

You have the right to withdraw consent to any or all Processing of your Personal Data; however, please be aware that We cannot run the services optimally for you without Processing your Personal Data, and the Processing of your Personal Data is required to execute the Services. Furthermore, you hereby acknowledge that by withdrawing consent, you have resulted in the termination of the Services, including the provision of its benefits, account deletion, or the termination of your contractual relationship with Us. Provided always, however, that rights and obligations that have arisen in connection with the contractual relationship between you and Us must remain fulfilled as long as they are not related to the provision of Service benefits that depend on the continuation of the Processing of your Personal Data.

We will still be able to process your Personal Data in connection with your request to withdraw consent within a reasonable period starting from the time the request to withdraw consent is received by Us, and subsequently will not process your Personal Data, unless required by Applicable Laws and Regulations (as defined below).

B.  CHANGES RELATED TO THE PRIVACY POLICY

We may review and update this Privacy Policy from time to time at Our discretion, as necessary. This is done to ensure the Privacy Policy remains in line with developments and changes in applicable legal or regulatory requirements, as well as the Services We provide. If We decide to change this Privacy Policy, We will notify you of such changes through an announcement that requires your consent, and will publish it in the Privacy Policy section of the Service and request your consent.

You agree that it is your responsibility to check this Privacy Policy periodically for the latest information on Our data processing and data protection practices. Your continued use of Our Services, communication with Us, or accessing and using the Services after any changes to this Privacy Policy will be deemed as your consent to this Privacy Policy and all amendments thereto.

C. YOUR PERSONAL DATA THAT WE COLLECT AND HOW WE COLLECT IT

“Personal Data” means any data regarding an individual who is identified or can be identified either individually or combined with other information, either directly or indirectly through electronic or non-electronic systems.

In this Privacy Policy, “Applicable Laws and Regulations” means all laws, regulations, provisions, policies, ratifications from the government or other state authorities, court decisions, and policy guidelines applicable up to the time this Privacy Policy is issued and as long as this Privacy Policy remains effective.

All Personal Data We collect depends on the classification of data required in accordance with the basis, purpose, and circumstances of collection within the Personal Data Processing cycle. In addition, relevant Personal Data is collected based on the needs of the Service or your transaction activity patterns on Our Service.

In accordance with Applicable Laws and Regulations, We obtain, collect, process, analyze, store, correct, update, display, announce, transfer, disseminate, disclose and/or delete and destroy Personal Data that We have classified as follows:

1. Individual Data to be submitted by you to Us, including among others:
2. Data of a general nature:

(1) Name;

(2) Email address;

(3) Mobile phone/telephone number;

1. Data of a specific nature:

(1) Name of the Company where you work;

(2) Department/unit where you work.

1. Other personal data as per applicable legal provisions.
2. Technical / Device Data: Including but not limited to IP address, Device Identity (ID), and/or your other updated technical data (if any) and information regarding the manufacturer, model, and operating system version of your mobile device.

1. Log Data: Including logs on servers that receive data such as device IP address, date and time of access, Service features or pages viewed, Service operational processes and other system activities, browser type, and/or third-party sites or services that the User used before and while interacting with the Service.

1. Data Collected Through Cookies and Other Technologies: Information about how you access and use our Website (e.g., browser type, access times, and Internet Protocol (IP) address) as well as your hardware and software is automatically collected through the use of cookies (small text files placed on your hard drive) or other technologies and tools. This information is used to improve the quality of our Website, make our products and services more useful to you, and for other business purposes.

1. Non-Electronic Data: For specific program requirements, We may also collect non-electronic data that you provide to Us when you use Our Services.

1. Disclaimer. We may:
2. Create, use, license, or disclose aggregations of your Personal Data in the form of statistical or demographic data for any reasonable purpose. Aggregated Data may be derived from your Personal Data but will not be considered Personal Data as this data will not directly or indirectly reveal your identity; and/or

1. Create, use, license or disclose available Personal Data,

with the note that to do both of the above, We will ensure: (i) that elements for identifying specific individuals have been removed in such a way that the data, alone or together with other available data, cannot be associated or linked with or cannot identify anyone, and (ii) such data is then aggregated with similar data so that the original data forms part of a larger data set.

D.  PURPOSES OF PROCESSING PERSONAL DATA

1. We may use the collected Personal Data for the following purposes as well as for other purposes permitted by Applicable Laws and Regulations ("Purposes"):
2. Profiling visitors who download the Spotlight report;
3. Analyzing the engagement level and performance of Spotlight; and
4. Determining and identifying target prospective Business Analyst clients based on the characteristics of visitors who download the report.
5. We may also carry out automated decision-making processes in accordance with any or several of the purposes as per provision D.1 above.

E.  SUBJECTS OF PERSONAL DATA DISCLOSURE

We will share your Personal Data with affiliated companies, partners, associates, and/or other third parties based on a confidentiality agreement, as necessary, to facilitate the Services for you, to the extent necessary to provide their services, including but not limited to, transaction processing, delivery and/or provision of products, application development and maintenance, execution of marketing activities, handling claims, and others.

We use these third-party services solely to process your data for the purposes explained in this Privacy Policy. As required, We may share your data with government agencies and other related authorities based on a valid order as required by Applicable Laws and Regulations.

We may also disclose your Personal Data through announcements and/or other publications within the public sphere to facilitate publications, including but not limited to, marketing, communications, and/or notifications related to winners and/or lucky draws.

F.  HOW WE DISCLOSE YOUR PERSONAL DATA TO OTHER PARTIES

We may disclose, provide access to, or share your Personal Data with other third parties for the following purposes as well as for other purposes permitted by Applicable Laws and Regulations:

1. To enable service and/or goods providers to provide Services, process or deliver orders, including to contact you;
2. Responding to regulatory inquiries, investigations, decisions, and reporting, to comply with archiving terms and requirements, as specified in Applicable Laws and Regulations;
3. If instructed, requested, or required by the authorized government, for the purposes mentioned in letters, government policies, government regulations, or other Applicable Laws and Regulations;
4. For the purposes of legal processes, if there is a legal process of any kind between you and Us, or between you and another party, in connection with or related to the Services;
5. In connection with any verification process by Us or a third party We have appointed, which is required before a service and/or goods provider provides their services and/or goods to you or your registration, including the Know Your Customer (KYC) process by Us;
6. In connection with public interests, we may share your Personal Data with authorized government authorities and/or other authorities appointed by the authorized government or within the scope of cooperation with Us, for contact tracing purposes, supporting government initiatives, policies, or programs, and other purposes as reasonably required;
7. In the event of a merger, asset sale, consolidation or restructuring, financing or acquisition of all or part of Our business by or against another company, for the purposes of such transaction (even if the transaction is subsequently not proceeded with);
8. In connection with insurance claim and verification processes, We will provide your Personal Data for the purpose of processing insurance claims to insurance companies that work together or collaborate with Us;
9. To third parties (including vendors, goods providers, partners, and other parties who provide services and/or goods to Us or you or other parties who enter into commercial cooperation with us), in connection with the purposes for which such third parties are involved to carry out disclosures to related parties in processing your transactions or the purposes of Our cooperation with such third parties (as applicable), which may include provisions allowing such third parties to carry out product or service and/or goods marketing activities to you, or conduct other activities including research, analysis, and product development; and
10. With affiliates or other third parties who assist Us in providing Services, operating the business (including, when you decide to subscribe to Our email list, for marketing purposes), for the purpose of assessing and monitoring risks and/or activities contrary to law (including its investigation, if required), or for data processing purposes on Our behalf.

When Personal Data is not required to be linked to you, We will make reasonable efforts to remove elements in such Personal Data that can identify you before disclosing or providing access to such data to the relevant third party.

Other than as provided in this Privacy Policy, We may disclose and share your Personal Data if We notify you or We have obtained your consent for such disclosure or sharing.

G.  SCOPE OF PERSONAL DATA PROCESSING

We carry out the Processing of your Personal Data both in Indonesia and outside the territory of Indonesia. We may also display, transfer, and disclose your Personal Data to Our affiliates and third-party partners outside the territory of Indonesia for purposes that will be further explained through this Privacy Policy.

H.  FULFILLMENT OF YOUR RIGHTS

You have various rights as a data subject regarding your Personal Data based on Applicable Laws and Regulations.

We respect your rights as a Data Subject granted by your Applicable Laws and Regulations, including the right to make corrections to and/or deletions of your Personal Data that is under Our possession and control. If you wish to submit a request to exercise data subject rights regarding the Personal Data you own, you can submit a request to Us by contacting Us at the contact details provided in this Privacy Policy. By submitting an account deletion request, you have agreed to receive follow-up information that We will send to you through the contact data you provide to Us.

We may refuse your request for access to, correction of, and/or deletion of part or all of your Personal Data that We possess or control if required or necessary based on Applicable Laws and Regulations. This includes circumstances where such Personal Data may contain references to other people or where the request for access or request to correct or delete is for reasons that We consider irrelevant, not serious, or frivolous, or indicated to be related to acts violating terms of use or with unlawful activities or violations.

In accordance with Applicable Laws and Regulations, We have the right to charge an administrative fee for each access and/or correction request.

I. PERIOD OF PERSONAL DATA PROCESSING

We will carry out the Processing of your Personal Data as long as you provide and do not withdraw the consent required to fulfill the purposes of obtaining and collecting such Personal Data. We will store your Personal Data as long as We carry out Data Processing, to fulfill legal obligations, as long as the Personal Data is still within the retention period set by Us in accordance with Applicable Laws and Regulations, and/or as long as the Personal Data relates to the purposes that existed when the information was collected.

J.  HOW WE RETAIN YOUR PERSONAL DATA

Your Personal Data will be stored for as long as necessary to fulfill the purpose of its collection, during the retention period, or for as long as such storage is required or permitted by Applicable Laws and Regulations. We will cease storing your Personal Data once it is deemed that the Personal Data is no longer necessary for the achievement of the purposes of Personal Data Processing, there is a withdrawal of consent for Personal Data Processing by you, there is a request from you, and/or storage is no longer necessary for business purposes or to fulfill legal obligations.

We will delete and/or remove elements that can identify you from the User's Personal Data under Our control if (i) the User's Personal Data is no longer necessary to fulfill the purpose of its collection; (ii) the retention period expires; and (iii) storage is no longer necessary for compliance purposes according to the provisions of Applicable Laws and Regulations.

However, please note that there is still a possibility that some of your Personal Data may be stored or controlled by other parties, including government institutions, in certain ways. In the event that We share your Personal Data with authorized government institutions and/or other institutions that may be appointed by the authorized government or have a cooperation with Us, you agree and acknowledge that the storage of your Personal Data by the relevant institution will follow the respective institution's data storage policy. 

Data submitted through communication between users and service providers conducted other than through the use of the Service (such as through phone calls, SMS, mobile messages, or other means of communication and the collection of your Personal Data by Our agents) may also be stored in several ways. We do not permit the Processing of Personal Data between Alfamart Members and service providers that occurs outside of Our Service. Therefore, Alfamart Members and service providers are fully responsible for such Processing of Personal Data.

To the extent permitted by Applicable Laws and Regulations, you release Us from and against any and all claims, losses, liabilities, costs, damages, and expenses (including but not limited to legal fees and full compensation costs) resulting directly or indirectly from any activity carried out outside of our Service.

K.  HOW WE MAINTAIN THE CONFIDENTIALITY OF PERSONAL DATA

We will take reasonable steps to ensure that your Personal Data is kept confidential and secure, and take reasonable technical and organizational measures to protect your Personal Data from unlawful or accidental destruction, accidental loss, or unauthorized or unlawful forms of processing.

However, you understand and agree that data transmission over the internet is never completely secure. Although We strive to make Our best efforts to secure and protect information from unauthorized access, collection, use, or disclosure by unauthorized persons and from processing that is contrary to law, accidental loss, destruction, and damage or similar risks, We cannot guarantee the security of any information provided or transmitted by you to Us. The risk of any provision or transmission of Personal Data by you to Us in such a manner lies in your own hands. In the event that your Personal Data is stolen due to malicious software and/or malware and/or viruses originating from your device, We will not be responsible for such risk.

Therefore, you are responsible for maintaining the confidentiality of your account details, and you must not share your account details, including your password and One Time Password (OTP) with anyone. You must also maintain the confidentiality of your shopping e-receipt, and you must always maintain and be responsible for the security of the device you use.

L.  OTHER WEBSITES AND SERVICES

The Services and Marketing Materials (as defined below) may contain links to websites or applications operated by third parties, including Our affiliates. Any Processing of Personal Data on such websites or applications is fully controlled by the third party and is under the responsibility of the third party. If you agree to access websites or applications operated by such third parties, you are subject to the terms and conditions and privacy policies of the third-party websites or applications. Therefore, you acknowledge and agree to read the terms and conditions and privacy policies of such third-party websites or applications to know how they collect and use your Personal Data.

Advertisements contained on Our Services or Marketing Materials serve as links to the advertiser's website or application, and as such, any data they collect based on your clicks on that link will be collected and used by the relevant advertiser in accordance with that advertiser's privacy policy.

M.  MARKETING AND PROMOTIONAL ACTIVITIES

We and Our partners (including vendors, suppliers, merchants, and/or other third parties associated with Us for the benefit of commercial and/or non-commercial activities) may send you direct marketing, advertisements, and promotional communications through Service push-notifications, in-Service messages, online messenger platforms, Point of Sales, social media, and email (“Marketing Materials”). If you object to receiving Marketing Materials, you can contact Us through the contact details provided in this Privacy Policy.

However, please note that We always reserve the right to send you non-promotional messages which, at Our discretion, are necessary for you.

N.  CONTACT US

If you have any questions or complaints regarding this Privacy Policy, wish to exercise your rights as a data subject regarding your Personal Data, or require assistance regarding technical matters, you can contact Us at:

1. Email: info@gli.id
2. Telp: 021-80821510

All correspondence you provide to Us will be noted, recorded, and/or stored for the corporate archive purposes of Our company.

O. GENERAL

1. This Privacy Policy is made based on, interpreted by, and subject to the laws applicable in Indonesia.
2. This Privacy Policy governs the processing of your Personal Data when you access or visit Our Site from today onwards until further revisions are uploaded and announced through Our Site. You are responsible for conducting periodic checks whenever there is a notification and/or announcement of any revision or change to this Privacy Policy.
3. Consent given in accordance with this Privacy Policy is in addition to and does not replace other consents you provide to the Company related to the processing of your Personal Data.
4. For the avoidance of doubt, if personal data protection laws and regulations in Indonesia permit organizations like Us to process your Personal Data without your consent, the permission granted by such personal data protection laws and regulations in Indonesia will always apply.