Back

Data Collection, Use, Storage, and Retention Policy

BTN strives to implement best practices and policies to ensure privacy and protect your personal data in accordance with the provisions and regulations related to personal data protection applicable in Indonesia. The collection, use, and storage of customer information is documented based on the principles of prudence and transparency. All data collected by BTN is determined based on the applicable transaction requirements. However, BTN is committed to minimizing requests for personal data, ensuring that the data requested is relevant and in accordance with regulatory provisions. The data collected includes general personal data, specific personal data, personal data created and obtained from the use of BTN's services, and personal data from BTN's subsidiaries, Affiliated Companies and/or other third parties that participate in partnerships with BTN or collaborate with BTN.

1. General personal data includes information such as:

Data contained on identity cards, such as identity card number, full name, gender, religion, address as stated on the identity card, place and date of birth, and nationality
Employment details, such as occupation, employment history, position, name of office/place of business, office/place of business telephone number, length of employment/business, business income or salary, and benefits received
Contact information, such as email, home telephone number, and mobile phone number
Residential address
Mother's maiden name
Signature specimen
Education
Company internet protocol address and email address
Employee and company assets and data, including beneficial owners
A combination of Personal Data used to identify a person, such as a combination of mobile phone number, geolocation, and internet protocol address.

2. Specific personal data includes:

Biometric data
Financial details
Tax information
Information related to customer risk profiles
Other data regulated in accordance with the provisions of laws and regulations

3. Personal Data created and obtained from the use of BTN services includes:

Technical processing of data
Information about customers obtained from banking service usage activities

4. Personal Data from BTN Subsidiaries, Affiliated Companies, and/or other third parties that participate in partnerships with BTN or collaborate with BTN.

BTN guarantees that customer data will only be used for legitimate banking transactions, in accordance with applicable security and data protection regulations and with the customer's consent. BTN is committed to storing customer personal data with the best protection for as long as necessary to provide banking services. Some customer personal data may also be managed, processed, and stored by third parties working with BTN to ensure that BTN can provide banking services to customers while complying with obligations regarding access and effectiveness in accordance with regulations and laws.

In order to ensure BTN's compliance with Law No. 27 of 2022 concerning Personal Data Protection (PDP Law), BTN stores personal data in accordance with the Bank's internal policies with a minimum retention period of 10 years for transaction data, customer data, and credit data categories. BTN will store and process Personal Data for as long as necessary in accordance with the purposes of collecting and processing Personal Data, while remaining subject to regulations and laws. In the event that personal data is no longer required by BTN for business purposes and has legally passed the retention period stipulated by BTN's policy, BTN will conduct an evaluation to take steps permitted by laws and regulations to stop storing personal data, unless the data falls into the exception category listed in Article 50 paragraph 1 of the Personal Data Protection Law, namely:

1. National defense and security interests;

2. Law enforcement interests

3. Public interests in the context of the state

4. Interests in the supervision of the financial services, monetary, payment systems, and financial system stability sectors carried out in the context of state administration.

To ensure data security, BTN implements masking features on sensitive data in accordance with internal provisions set forth in the Technical Guidelines related to Security Baseline. In addition, BTN also applies data transmission limitations through Data Loss Prevention (DLP) devices in accordance with internal provisions set forth in the Technical Guidelines related to Data Loss Prevention and implements access control based on data classification using the least privilege and need-to-know principles.