Rupiah Cepat Privacy Policy

For ease of interpretation and comprehensive understanding of the provisions in this Privacy Policy, the following terms have the meanings as described below:

“Privacy Policy” means the policy created by Us containing an explanation regarding the procedures for obtaining, collecting, using, processing, storing, disclosing, and protecting Users’ Personal Data accessed, collected, and/or managed by RupiahCepat, including Data Subjects’ rights over their personal data and how RupiahCepat ensures compliance with the applicable laws and regulations on personal data protection.

“Services” means various services offered by Us through the Rupiah Cepat Platform, particularly information technology-based lending services provided from time to time through the Platform.

“User” or “You” means any party registered as a user of the Rupiah Cepat Platform.

“Personal Data” means data about an individual who is identified or can be identified individually or in combination with other information, whether directly or indirectly, through electronic or non-electronic systems. Personal Data constitutes Users’ personal information obtained, collected, processed, analyzed, displayed, stored, modified, deleted, and/or managed by RupiahCepat.

“Data Subject” means an individual or User who owns the Personal Data obtained, collected, used, stored, and/or processed by a party in Data Processing activities.

“PDP Law” means Law of the Republic of Indonesia Number 27 of 2022 concerning Personal Data Protection.

“OJK” means the Financial Services Authority.

“AFPI” means the Indonesian Joint Funding Fintech Association.

“FDC” means Fintech Data Center managed by AFPI.

“Lender” means a party registered on the Platform to provide and disburse loans to Borrowers through the Platform.

“Borrower” means a party registered on the Platform to receive loans from Lenders through RupiahCepat.

“Cookies” means tracking technology used to store Users’ preferences, improve Service performance, analyze usage behavior, and customize content displayed when Users access the Platform.

“Metadata” means data that describes other data, which in this Privacy Policy includes your device and network data, such as device type and model, operating system, system version, manufacturer name, operator, IP address, connection type, geographical location, system language, domain, as well as information related to the camera, microphone, screen resolution, and activities such as voice recordings or screenshots.

“Customer Service” means the unit or function responsible for processing inquiries, requests, complaints, providing technical assistance, and informing Users of any changes to our Platform or Services.

“Service Agreement” means an agreement governing the rights and obligations between RupiahCepat and Users in relation to the use of Services provided through the Platform.

“Emergency Contact” means third-party information consisting of name and phone number provided by the User as a party that can be contacted by RupiahCepat in emergency situations.

“Cloud Infrastructure” means internet-based computing infrastructure providing resources such as servers, storage, databases, networking, software, analytics, and intelligence over the internet (cloud) to enable data storage and information system processing.

“Chatbot” means a computer program designed to simulate human conversation via text or voice, enabling automated interaction with Users to provide information about Services or the Platform.

“Personal Data Protection Agreement” means separate agreement(s) between RupiahCepat and third parties participating in the Processing of Users’ Data, setting out the obligations of each party involved to comply with personal data protection principles and ensure the security of Users’ Personal Data in accordance with applicable laws and regulations from time to time.

“Terms & Conditions” means the terms and conditions or standard operating procedures or other provisions relating to the Platform developed by Us, as may be amended or supplemented from time to time.

We value your trust in using RupiahCepat services.

This Privacy Policy is issued by PT Kredit Utama Fintech Indonesia (“RupiahCepat” or “We/Us”) to openly explain how Personal Data is obtained, collected, processed, analyzed, displayed, stored, modified, deleted, and/or managed (“Data Processing”) when you access and use our website at www.rupiahcepat.co.id or the RupiahCepat application (collectively referred to as the “Platform”).

By accessing or using this Platform, you declare that you understand and agree to the provisions described in this Privacy Policy and our Terms & Conditions. We encourage you to read this Privacy Policy carefully to understand your rights as a user and how we protect your information.

By continuing to register or use the Platform, you declare that the Personal Data you provide is true and valid, and you acknowledge that you have read, understood, and agreed to the contents of this Privacy Policy, including granting consent to RupiahCepat to process your Personal Data for the purposes described herein.

IF YOU DO NOT AGREE WITH THE CONTENT OF THIS POLICY, WE RECOMMEND THAT YOU DO NOT CONTINUE USING THE PLATFORM.

Any access and use of the Platform by you after this document becomes available means that you acknowledge and agree to the applicable provisions regarding Personal Data as described in this Privacy Policy.

Data Collected

Our Platform collects Personal Data for the purpose of providing, maintaining, risk evaluating, and improving our services in accordance with applicable laws and regulations. If you do not provide complete information as requested, We may not be able to provide services in full.

The Personal Data that We may collect includes:

• Contact Information: Full name, mobile phone number, email address, residential address, domicile address, and/or Emergency Contact.
• Identity Information: ID card photo, National ID Number (NIK), Tax ID Number (NPWP), mother’s maiden name, face photo, marital status, educational background, employment status, job title, company name, length of employment, and office address.
• Financial Information: Bank account information, virtual account number, credit history, income information (e.g. source of income, salary slip, payment date, monthly income), loan purpose, and information on loans or obligations with other parties or institutions.
• Technical Information and Metadata: Your device and network data, such as device type and model, operating system, system version, manufacturer name, operator, IP address, MAC address, connection type, geographical location, system language, domain, as well as information related to the camera, microphone, screen resolution, and activities such as voice recordings or screenshots.

We may request access to read the list of applications installed on your device, which will be used solely for fraud prevention and security purposes. This access request will be conveyed through in-app notifications, and you have the option to approve or deny it.

We may also collect other information you voluntarily provide when contacting Customer Service, completing user satisfaction surveys, or surveys related to funding. This information is used to improve the quality of our services.

To maintain account security and prevent misuse, we may record your usage behaviour on the Platform, including network access patterns, frequently used software, and links considered risky for your account security.

Methods of Data Collection

We may obtain your Personal Data directly or indirectly through your interactions with Our Platform or from legitimate external sources. Data collection is carried out to fulfill operational service needs as well as applicable legal obligations.

The ways we collect Personal Data include:

• a. Information You Provide Directly when registering and/or using the Platform;
• b. Information Automatically Collected by the Platform, such as Technical Information and Metadata of usage activities, as well as transaction information when you perform financial transactions through the Platform;
• c. Information Obtained from Legitimate Third Parties related to the provision of Our services, such as identity verification providers, credit bureaus, payment gateways, digital identity and digital signature providers, marketing partners, subject to applicable laws and your consent if required.

Legal Basis for Data Processing

We process your Personal Data based on one or more of the following legal grounds, depending on the context and purpose of data collection:

• a. Performance of Service Agreement
  Processing is carried out to fulfill Our obligations to You as a User, as stipulated in the Terms & Conditions, Service Agreement, and other relevant documents;
• b. Legitimate Interests
  In certain situations, We may process data based on RupiahCepat’s or a third party’s legitimate interests, provided that it does not override your fundamental rights as a Data Subject and is in accordance with applicable laws from time to time;
• c. Your Consent
  For certain purposes that require consent, We will seek your approval beforehand. You have the right to withdraw such consent at any time, subject to applicable legal provisions;
• d. Compliance with Legal Obligations
  We may also process Personal Data to fulfill legal and regulatory obligations, including reporting obligations, fraud prevention, and requests from authorized authorities.

Purposes of Data Processing

Personal Data will be used for various legitimate purposes, including but not limited to:

• a. Service Processing
  To facilitate registration, identity verification, Service applications, matching Lenders with Borrowers, User credit scoring assessments, risk analysis, processing disbursement, repayment, and collection activities.
• b. Customer Service
  To facilitate the Customer Service unit for Users and to process inquiries, requests, complaints, handle grievances, provide technical assistance, and inform Users of any changes to Our Platform or Services.
• c. Marketing Activities (Based on Consent)
  To send information, promotions, and updates about Our services that are relevant to your interests and preferences.
• d. Analysis and Improvement of Platform and Services
  To support the technical operation of the Platform, understand User usage patterns and preferences, and improve the overall User experience.
• e. Compliance with Applicable Regulations and Laws
  To fulfill regulatory requirements, including verification processes and risk assessments required for anti-money laundering and counter-terrorism financing purposes, and other obligations under applicable regulations and laws from time to time.
• f. Requests from Authorities/Agencies/Authorized Institutions
  To respond to requests from authorized authorities/agencies/institutions such as OJK, courts, or other legitimate regulators in accordance with applicable laws.
• g. Detection and Prevention of Misuse
  To detect, monitor, and investigate suspicious or potentially illegal activities, and to take corrective actions to ensure security.
• h. We may also use information from applications installed on your device for risk analysis, credit limit assessment, or account misuse prevention purposes. This information will be securely transmitted to Our internal systems.

Disclosure of Personal Data to Third Parties

RupiahCepat is committed to maintaining the confidentiality and security of your Personal Data. We guarantee that there will be no disclosure, sale, transfer, distribution, and/or lending of your Personal Data to any party without a legitimate legal basis.

However, in relation to the provision of Our Services and compliance with applicable regulations, We may share your Personal Data with certain third parties within a limited scope and for legitimate purposes, including but not limited to:

• a. Lenders and Borrowers
  To enable interactions between parties within the funding ecosystem in accordance with the provisions of the agreement, including for loan disbursement and repayment processes.
• b. Partners or Third-Party Service Providers
  In order to provide safe, reliable, and compliant services, RupiahCepat may cooperate with third parties acting as service providers to assist in the following functions, including but not limited to:
  • • Identity verification, National ID Number (NIK) checks, and validation of documents provided to Us by Users;
  • • Data storage and information system processing based on Cloud Infrastructure, IT service providers;
  • • Risk analysis, credit scoring modeling, credit bureaus, fraud prevention, electronic signature providers, telecommunications operators, insurance companies;
  • • Payment systems services, fund account management, and financial partners;
  • • Customer Service, Chatbots, and communication facilities;
  • • Auditing, data security, and user activity monitoring.
  In such cases, We may provide limited access to your Personal Data to partners or service providers who are contractually bound to comply with applicable provisions and/or Personal Data Protection Agreements that are legally binding.
• c. Management, Employees, and Affiliates or Subsidiaries
  If necessary for the implementation of services, mergers, internal restructuring, or other legitimate and regulatory-compliant strategic purposes.
• d. FDC and/or Official Associations
  As part of credit data reporting and monitoring obligations.
• e. Regulators and Authorized Legal Authorities
  We may disclose Personal Data upon official requests from authorized authorities, such as OJK, legal requests, court orders, prosecutors, or other government agencies pursuant to laws and regulations or to protect Our rights or security.
• f. Overseas Disclosure
  In certain circumstances, We may need to disclose your Personal Data to the aforementioned third parties located outside the territory of the Republic of Indonesia. In such cases, We will ensure that such processing is protected by security standards and protections equivalent to those stipulated in the PDP Law and its implementing regulations, including contractual protection mechanisms or cross-border data protection standards.

Data Security, Storage, and Deletion

• a. Security Measures
  RupiahCepat implements specific security measures and procedures to prevent unauthorized access, use, modification, disclosure, or destruction of Personal Data, such as firewalls, encryption, passwords and/or OTPs (One Time Passwords), access restrictions, and internal procedures compliant with ISO/IEC 27001 standards. Our team also routinely monitors and evaluates risks to systems handling data.
• b. Storage and Potential Processing Overseas
  Your Personal Data may be stored or processed by designated service provider partners, including those located outside the territory of the Republic of Indonesia. In such cases, RupiahCepat will ensure that such third parties are subject to data protection commitments equivalent to applicable legal provisions, either through contractual agreements or additional safeguards as regulated by the PDP Law.
• c. Retention Period and Deletion of Data
  We retain Personal Data as long as necessary to fulfill the purposes described in this Privacy Policy. After you no longer use Our Platform, Personal Data will be retained for at least 5 (five) years as required by law.

  After this period, We will delete or anonymize your data, provided that:

  • 1. The data is no longer required for processing purposes; and/or
  • 2. There is no legal obligation to retain it.
  However, you may request deletion of Personal Data at any time by submitting a request to Our Customer Service. We may restrict or refuse deletion of Personal Data (account) if there are still outstanding contractual Service obligations.
  
  Please note that deletion of Personal Data may result in account closure and does not affect the validity of processing or cancel any previous legal obligations or commitments (if any).
• d. Limitation of Liability
  Although RupiahCepat has made its best efforts to protect your Personal Data, please understand that no data transmission system over the internet or electronic storage method is completely risk-free. Therefore, any disclosure of Personal Data made by Users directly to other parties outside Our official system is the personal responsibility of the respective User.

Cookies and Tracking Technologies

When you access or use Our Platform, We may use Cookies and similar tracking technologies to store User preferences. We use essential Cookies to ensure the basic functionality of the Platform. Currently, We do not use third-party tracking or analytics Cookies.

Cookies also help Us recognize you when you return to the Platform and enable Us to enhance your overall experience.

You can manage your Cookie preferences through your browser settings on your device (if available).

User Rights: Access, Correction, and Withdrawal of Consent

• a. Data Accuracy
  RupiahCepat continuously strives to maintain the accuracy and completeness of Personal Data We process. Users are encouraged to actively notify Us if there are any changes, inaccuracies, or incompleteness in the data provided.
• b. Right to Access and Correction
  Users have the right to access and/or request corrections to Personal Data stored by RupiahCepat. For this purpose, Users must submit a written request and provide sufficient proof of identity. We reserve the right to refuse requests, in whole or in part, in accordance with applicable law, if:
  • • The request is irrelevant, disproportionate, or inconsistent with Our legal obligations;
  • • The data relates to another individual; or
  • • The request cannot be reasonably verified.
  Requests will be processed within a reasonable timeframe as stipulated by applicable laws and regulations.
• c. Withdrawal of Consent
  If Personal Data is processed based on your consent, you have the right to withdraw such consent at any time by submitting a request through Customer Service (or Our other official channels). However, please note that:
  • • Withdrawal of consent does not affect the legality of processing carried out prior to the withdrawal;
  • • If Personal Data is required for the performance of ongoing Service Agreements, withdrawing consent may affect the continuation of such Services, or Users may not have the option to withdraw consent for processing that is an integral part of fulfilling the Service Agreement;
  • • RupiahCepat will cease processing your Personal Data in accordance with the scope requested, except where We are required to retain it for legal or regulatory purposes.

Personal Data Breach Notification

If a data breach occurs that threatens the security of your Personal Data, and legislation requires it, RupiahCepat will notify you and/or the relevant authorities without undue delay, no later than 3 x 24 hours after becoming aware of the incident.

The notification will include:

• • A brief explanation of the nature of the data breach
• • The types of Personal Data affected
• • The estimated potential impact on Users
• • Mitigation and recovery steps that have been or will be taken by Us

We will take all necessary actions to limit the impact of the breach and prevent similar incidents in the future. If necessary, We may also conduct further internal investigations and cooperate with authorities in accordance with legal provisions.

Limitation of Liability

By using RupiahCepat Services, Users agree to release and indemnify RupiahCepat (including its affiliates, directors, and employees) from any claims, demands, or losses arising directly or indirectly from:

• a. Loss or misuse of Personal Data resulting from interception, unauthorized access, or processing by other third parties beyond RupiahCepat’s control;
• b. Leakage or misuse of Personal Data caused by the User’s own actions, negligence, or carelessness;
• c. Risks originating from devices, applications, networks, or third-party internet services used by Users to access or manage their accounts;
• d. Users’ decisions to disclose Personal Data publicly or to other parties without RupiahCepat’s control or instruction.

RupiahCepat is not responsible for losses or account misuse caused by Users’ own negligence or actions.

Marketing and Communication

You may choose not to receive marketing communications from RupiahCepat by contacting Our Customer Service via email at cs@rupiahcepat.co.id or by phone at (021) 30006000.

However, please note that even if you opt out of marketing communications, We may still send you important notifications related to the Services and Platform, such as transaction information, account updates, or applicable operational policies.

Changes to the Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in Data Processing practices, legislation, or Our internal policies. Any material changes will be notified through the official RupiahCepat Platform.

We encourage Users to review this Privacy Policy periodically to remain informed about how We manage and protect your Personal Data.

Submission of Complaints

a. If you have any concerns, questions, or objections regarding how We process or handle your Personal Data, you may contact Customer Service via email at cs@rupiahcepat.co.id or by phone at (021) 30006000, accompanied by sufficient information to identify yourself and describe the complaint.

b. We will investigate each complaint reasonably and endeavor to respond within a reasonable timeframe after receiving the request. If necessary, We may also cooperate with the relevant authorities to resolve the issue.

Compliance with Applicable Laws and Regulations

Any matters not covered or explicitly regulated in this Privacy Policy shall follow the applicable laws and regulations within the jurisdiction of the Republic of Indonesia.

RupiahCepat is committed to complying with all relevant legal obligations and is subject to the supervision of the competent authorities to ensure the full protection of Users’ rights.

In the event of any inconsistency between the contents of this Policy and the applicable laws and regulations, the provisions of such laws and regulations shall prevail.

Integration

In addition to this Privacy Policy, the following also apply to the Services and Platform and are considered an integral part:

• a. General Terms and Conditions;
• b. Terms and conditions in the Loan Agreement and Funding Agreement;
• c. Other agreements with Us governing your use of the Services.