Privacy Policy

Introduction and Data Controller

Dewaruci Brothers International ("DBI," "we," "us," or "our") is committed to protecting the personal data of our clients, website visitors, prospective clients, and business partners. This Privacy Policy describes how we collect, use, store, and disclose personal data, and sets out your rights as a data subject under Indonesian law.

DBI acts as the Data Controller (Pengendali Data Pribadi) for the personal data described in this Policy, in accordance with Undang-Undang Nomor 27 Tahun 2023 tentang Perlindungan Data Pribadi ("UU PDP") and its implementing regulations.

Data Controller contact details:

• PT. Dewaruci Brothers International, Jakarta, Indonesia
• Email: privacy@dewarucibros.com

Personal Data We Collect

We collect the following categories of personal data, depending on your relationship with DBI:

We do not intentionally collect sensitive personal data (Data Pribadi yang Bersifat Spesifik) as defined under Article 4 of UU PDP (including health data, biometric data, genetic data, criminal records, or financial data beyond what is strictly necessary for service delivery), except where required by applicable law or expressly consented to by the data subject.

Legal Basis for Processing

We process your personal data on the following legal bases under UU PDP:

• Contract performance: Processing necessary to enter into or perform a service agreement with you or your organization
• Legal obligation: Processing required to comply with Indonesian law, including tax, anti-money laundering (Anti Pencucian Uang), and customs regulations
• Legitimate interests: Processing necessary for DBI's legitimate business interests, including business development, client relationship management, and fraud prevention, where these interests are not overridden by your rights
• Consent: Where we rely on your consent (e.g., for marketing communications), you may withdraw consent at any time by contacting us at privacy@dewarucibros.com

Purposes of Processing

We use your personal data for the following purposes:

• Providing trade advisory, market entry, and legal advisory coordination services
• Managing client onboarding, due diligence, and engagement administration
• Communicating with you regarding your engagement, inquiries, or requests
• Complying with Indonesian regulatory requirements, including reporting to relevant government authorities such as the Direktorat Jenderal Bea dan Cukai (DGCE), Kementerian Perdagangan, and the Indonesia Financial Services Authority (OJK), where applicable
• Sending service updates, newsletters, or marketing communications where you have provided consent
• Improving our website and digital services

Disclosure of Personal Data

We may share your personal data with the following parties, strictly on a need-to-know basis:

• Licensed legal practitioners and notaries in Indonesia and the Netherlands, engaged to provide formal legal services on your behalf
• Trade finance institutions, freight forwarders, and logistics providers involved in delivering services you have engaged DBI for
• Indonesian government bodies and regulatory authorities where legally required
• IT service providers and cloud platforms used for data storage and business operations, subject to appropriate data processing agreements

DBI does not sell, lease, or otherwise commercially transfer your personal data to third parties for their own marketing purposes.

International Data Transfers

As DBI operates across the Indonesia–Europe corridor, personal data may be transferred to and processed in the Netherlands, Italy, or other countries in connection with service delivery. Such transfers are carried out in accordance with Article 56 of UU PDP, and DBI ensures that appropriate safeguards are in place, including:

• Transfers to countries recognized by the Indonesian government as providing an adequate level of personal data protection
• Contractual protections with receiving parties equivalent to the standards required under UU PDP

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by Indonesian law. Typical retention periods are:

• Client engagement records: 10 years from the end of the engagement, in line with Indonesian tax and commercial law requirements under Undang-Undang Nomor 6 Tahun 1983 tentang Ketentuan Umum dan Tata Cara Perpajakan (as amended) and Undang-Undang Nomor 8 Tahun 1997 tentang Dokumen Perusahaan
• Marketing and communications data (where consent-based): Until consent is withdrawn
• Website technical data: 12 months

Upon the expiry of the applicable retention period, personal data will be securely deleted or anonymized.

Your Rights as a Data Subject

Under UU PDP (Undang-Undang Nomor 27 Tahun 2023), you have the following rights with respect to your personal data:

• Right to access (hak akses): Request a copy of the personal data we hold about you
• Right to rectification (hak untuk memperbaiki): Request correction of inaccurate or incomplete personal data
• Right to erasure (hak untuk menghapus): Request deletion of your personal data, subject to applicable legal retention obligations
• Right to restriction (hak untuk membatasi): Request that we restrict processing of your personal data in certain circumstances
• Right to data portability (hak portabilitas data): Receive your personal data in a structured, machine-readable format
• Right to object (hak untuk menolak): Object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please submit a written request to privacy@dewarucibrothers.com. We will respond within 14 (fourteen) working days, in accordance with UU PDP. In certain cases, we may be required by law to retain data notwithstanding your request for deletion.

Cookies

Our website may use cookies and similar technologies to improve user experience and analyze website traffic. We use:

• Essential cookies: Necessary for the website to function correctly
• Analytics cookies: To understand how visitors use our site (e.g., Google Analytics). These are only activated with your consent

You may manage your cookie preferences through your browser settings. Disabling certain cookies may affect your ability to use some features of the website. Our cookie practices comply with Peraturan Pemerintah Nomor 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik (Government Regulation No. 71 of 2019 on Electronic Systems and Transactions).

Security

DBI implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encrypted communications, restricted staff access to personal data on a need-to-know basis, and regular review of our security practices. Notwithstanding these measures, no data transmission over the internet can be guaranteed as entirely secure.

Complaints

If you believe that DBI has processed your personal data in a manner inconsistent with this Policy or applicable law, you have the right to lodge a complaint with the relevant Indonesian supervisory authority responsible for personal data protection under UU PDP. You also retain the right to seek legal recourse through Indonesian courts.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. The revised version will be posted on our website with an updated effective date. We encourage you to review this Policy periodically.