Privacy Notice

The following Privacy Notice explains how we, Pengelola Nama Domain Internet Indonesia (PANDI) and/or its affiliates ("PANDI" or "We") obtain, collect, store, control, use, process, analyze, correct, update, display, announce, transfer, disclose and protect ("Process" or "Processing") your personal data ("Personal Data"). This Privacy Notice applies to all users and/or service providers ("User" or "You") on our system and/or application, features and services (collectively referred to as the "Application"), unless governed by a separate privacy notice. We are committed to protecting your privacy and Processing your Personal Data in accordance with applicable Indonesian law, including Law No. 27 of 2022 on Personal Data Protection (UU PDP).

We collect the following categories of Personal Data: • Identity Personal Data — full name • Contact Personal Data — email address • Payment Personal Data — transaction records (we do not store full card or bank account numbers) • Usage Personal Data — pages visited, actions taken on the Application, IP address, browser type, device information • Communication Personal Data — support ticket content, emails exchanged with our team For KYC verification, we do not collect or store your National Identity Number (NIK) or any government-issued identity document numbers. Identity verification is handled entirely by our trusted KYC provider, e.id, without transmitting sensitive identity document Personal Data to our systems.

We Process your Personal Data for the following purposes: • Account registration and authentication • Processing domain applications and communicating their status • Conducting mandatory KYC verification required by PANDI and regulatory obligations • Processing payments and issuing invoices • Sending transactional emails (registration confirmations, payment receipts, domain status updates) • Sending service announcements and important Application updates • Preventing fraud, abuse, and unauthorized access • Improving Application performance and user experience (using aggregated analytics) • Complying with legal obligations

We Process your Personal Data based on: • Contractual necessity — Processing required to fulfill our agreement with you (account management, domain registration, payment processing) • Legal obligation — KYC and identity verification as required by PANDI registration rules • Legitimate interests — fraud prevention, Application security, and aggregate analytics • Consent — analytics cookies and optional marketing communications (you may withdraw consent at any time)

We share your Personal Data with trusted third parties only as necessary: • PANDI & KORIKA — as the domain registry authority, they receive domain application Personal Data required for registration processing • e.id — our KYC provider facilitates identity verification; we do not transmit your NIK or identity document numbers to e.id or store them in our systems • Google Analytics — receives anonymized usage Personal Data for Application analytics (subject to your cookie consent) • Cloud infrastructure providers — for hosting and Personal Data storage We do not sell your Personal Data to any third party. All third-party processors are bound by Personal Data processing agreements.

We use cookies and similar technologies: • Strictly necessary cookies — required for authentication, session management, and language preferences. These cannot be disabled. • Analytics cookies (optional) — Google Analytics cookies (_ga, _ga_*) help us understand how visitors use the Application. These are only set with your explicit consent via our cookie consent banner. You can manage your cookie preferences at any time by clicking "Manage preferences" in the cookie consent banner.

We retain your Personal Data for the following periods: • Account Personal Data — for the duration of your account plus 5 years after closure • KYC documents — as required by PANDI regulations (minimum 5 years) • Payment records — 10 years as required by Indonesian tax and financial regulations • Usage logs — 90 days rolling • Support communications — 2 years After the retention period, Personal Data is securely deleted or anonymized.

Under Indonesian law (UU PDP) and applicable privacy regulations, you have the right to: • Access — request a copy of the Personal Data we hold about you • Correction — request correction of inaccurate or incomplete Personal Data • Deletion — request deletion of your Personal Data where no legal basis for retention exists • Portability — receive your Personal Data in a structured, machine-readable format • Objection — object to Processing based on legitimate interests • Withdrawal of consent — withdraw any consent you have given (does not affect prior Processing) To exercise these rights, contact us at admin@domain.ai.id. We will respond within 30 days.

We implement appropriate technical and organizational measures to protect your Personal Data against unauthorized access, disclosure, alteration, or destruction. These include encrypted Personal Data transmission (TLS), access controls, and regular security reviews. However, no internet-based transmission is 100% secure; you use the Application at your own risk.

Some of our service providers (including Google Analytics) may Process Personal Data outside Indonesia. When we transfer Personal Data internationally, we ensure appropriate safeguards are in place consistent with UU PDP requirements.

The Application is not directed to individuals under 18 years of age. We do not knowingly collect Personal Data from minors. If you believe we have inadvertently collected Personal Data from a minor, please contact us and we will delete it promptly.

We may update this Privacy Notice from time to time. We will notify you of material changes via email or a prominent notice on the Application. Continued use after the effective date constitutes acceptance of the updated Privacy Notice.

For privacy-related requests or inquiries: Email: admin@domain.ai.id Address: Indonesia For general support: admin@domain.ai.id