Privacy Notice

PT Axia Global Trada ("AXIA Group", "we", "us", or "our") is a professional services company incorporated in Indonesia, providing integrated management system consulting, technology, cybersecurity, and professional competence development services. Our registered office is at EightyEight@Kasablanka, Level 12, Casablanca Raya Kav. 88, South Jakarta, Special Capital Region of Jakarta, Indonesia 12870.

This Privacy Notice describes how we collect, use, disclose, and safeguard personal information when you interact with our website, engage our services, or contact us in the course of our business. By accessing our website or engaging our services, you acknowledge that you have read and understood this notice.

For questions about this policy or how we handle your information, please contact us at privacy@axia-group.id.

Contact and Identity Information

When you contact us, submit an inquiry, or engage our services, we collect information such as your name, job title, company name, business email address, and phone number. This information is provided directly by you through our contact form, email, or in person.

Business and Engagement Information

In the course of delivering professional services, we may collect information about your organization's operations, processes, systems, and compliance status. This typically includes organizational data necessary for conducting assessments, audits, or training engagements.

Website Usage Data

We automatically collect certain technical information when you visit our website, including your IP address, browser type and version, pages visited, time and date of visit, and referring URL. This data is collected through server logs and analytics tools.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate our website and understand how visitors interact with it. See Clause 9 for full details on our use of cookies.

We use the information we collect for the following purposes:

• to provide, manage, and fulfill the professional services you have engaged us for, including consulting, auditing, training, and technology services.

• to respond to your inquiries, send service-related notifications, and keep you informed about your engagement with us.

• to send you information about our services, frameworks, and events where you have expressed an interest or where we have a legitimate interest in doing so.

• to analyze website usage patterns, identify technical issues, and improve the functionality and content of our website.

• to meet our obligations under Indonesian law and applicable regulations, including record-keeping and reporting requirements.

• to detect, prevent, and respond to fraud, unauthorized access, or other security incidents.

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

Our processing of personal information is grounded in one or more of the following legal bases under Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP) and applicable regulations:

• processing is necessary to perform a contract you are party to, or to take steps at your request prior to entering a contract.

• processing is necessary for our legitimate business interests, such as improving our services and communicating with prospective clients, provided those interests are not overridden by your rights and freedoms.

• processing is necessary to comply with a legal obligation applicable to us, including tax, employment, and regulatory requirements.

• where none of the above bases apply, we will ask for your consent before processing your information, and you may withdraw that consent at any time.

We do not sell, rent, or trade your personal information to third parties. We may share your information with the following categories of recipients, only to the extent necessary:

• third-party vendors and partners who support our operations (e.g., cloud hosting, analytics, email delivery), bound by confidentiality obligations and prohibited from using your data for their own purposes.

• lawyers, accountants, and auditors who advise us on legal, financial, and compliance matters, subject to professional confidentiality obligations.

• where required by Indonesian law, court order, or to protect the rights, property, or safety of AXIA Group, our clients, or others.

• in connection with a merger, acquisition, or sale of all or part of our business, your information may be transferred to the relevant third party subject to equivalent data protection obligations.

In all cases we require third parties to respect the security of your personal information and to treat it in accordance with applicable law.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting obligations.

For client engagement data, we generally retain records for a period of seven (7) years following the conclusion of the engagement, consistent with Indonesian commercial and tax record-keeping requirements.

Contact and inquiry data from prospective clients who do not proceed to engagement is retained for up to two (2) years, after which it is deleted or anonymized unless you have separately consented to receiving ongoing communications from us.

Website usage data collected through analytics tools is retained for up to thirteen (13) months in aggregated or anonymized form.

To request deletion of your personal information before the end of the applicable retention period, contact us as described in Clause 11.

PT Axia Global Trada is incorporated and operates primarily in Indonesia. Personal information we collect is principally stored and processed within Indonesian territory.

Where our service providers operate data centers or processing facilities outside Indonesia, we ensure that appropriate safeguards are in place, including contractual clauses that require the recipient to protect personal information to a standard at least equivalent to Indonesian law requirements under UU PDP.

By providing us with your personal information, you acknowledge that it may be transferred to, stored in, and processed in countries other than your country of residence. We will take all steps reasonably necessary to ensure that your information is treated securely and in accordance with this notice.

Under Indonesian Law No. 27 of 2022 on Personal Data Protection, you have the following rights in respect of your personal information:

• to obtain confirmation of whether we hold your personal information and to receive a copy of it.

• to request correction of inaccurate or incomplete personal information we hold about you.

• to request deletion of your personal information where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.

• to request that we limit our processing of your information in certain circumstances.

• to receive your personal information in a structured, commonly used format for transfer to another controller, where technically feasible.

• to object to our processing of your information where we rely on legitimate interests, including for direct marketing purposes.

• where we process your information on the basis of consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please submit a written request to privacy@axia-group.id. We will respond within 14 business days. We may request proof of identity before processing your request.

Our website uses cookies — small text files placed on your device — to enable essential site functionality and to understand how visitors interact with our content.

Types of cookies we use

• required for the website to function and cannot be switched off. They are set in response to actions you take, such as setting privacy preferences or navigating between pages.

• allow us to count visits and traffic sources so we can measure and improve site performance. All data is aggregated and anonymous.

• enable the website to remember your preferences (such as language or region) to provide a more personalized experience.

Managing cookies

You can control and delete cookies through your browser settings at any time. Note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit allaboutcookies.org.

AXIA Group takes the security of personal information seriously. We implement appropriate technical and organizational measures to protect your information against unauthorized access, accidental loss, destruction, or disclosure. These measures include:

While we employ robust security measures, no method of transmission over the internet or electronic storage is completely secure. If you believe your personal information has been compromised through your interaction with us, please contact us immediately at privacy@axia-group.id.

We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page.

For significant changes that materially affect how we use your personal information, we will provide a more prominent notice — such as an email notification to clients or a notice on our website — prior to the change taking effect.

We encourage you to review this page periodically to stay informed about how we protect your information. Your continued use of our website or services after any changes indicates your acceptance of the updated notice.

If you have any questions, concerns, or requests regarding this Privacy Notice or the handling of your personal information, please contact our privacy team:

• privacy@axia-group.id

• Privacy Team, PT Axia Global Trada, EightyEight@Kasablanka Level 12, Casablanca Raya Kav. 88, South Jakarta 12870, Indonesia

We aim to acknowledge all written requests within 3 business days and provide a substantive response within 14 business days. If you are not satisfied with our response, you may lodge a complaint with the relevant data protection authority in Indonesia.