Hana Bank Privacy Notice

Version 2.00

Effective Date: October 10, 2025

Please read this Privacy Notice carefully to ensure that you understand how the provisions of this Privacy Notice are applied. This Privacy Notice explains how we collect, use, transfer, disclose, and protect your identifiable personal information obtained through our services. By reading this Privacy Notice, we hope you feel assured that the security of your Personal Data and your privacy are our top priority.

This Privacy Notice is included as part of the Terms of Use. This Privacy Notice covers the following matters:

1) Definitions

2) Information we collect

3) Information you provide directly

4) Use of information we collect

5) Providing Information we collect

6) Personal data storage

7) Security

8) Changes to this Privacy Policy

9) Others

10) Acknowledgement and consent

11) Stop receiving notifications

12) Contact us

In this Privacy Notice, the use of the terms (i) “we” or “Bank” refers to PT Bank KEB Hana Indonesia, a Business Entity established under the laws of the Republic of Indonesia and engaged in banking (“Hana Bank”); (ii) “You” refers to each individual owner of Personal Data (data subject) who has and/or will use our products and/or services, visitors and users of our website/application/digital banking services, and any third party to which this Privacy Notice applies; (iii) “Applicable Regulations” refers to Law Number 27 of 2022 concerning Personal Data Protection and other relevant regulations in force, including amendments from time to time; (iv) “Processing” refers to the act of obtaining, collecting, processing, analyzing, storing, correcting, updating, displaying, announcing, transferring, disseminating, disclosing, deleting and/or destroying your Personal Data.

The Personal Data that we process is the Personal Data that you have provided and will provide to us, including Personal Data as stated in the Personal Data Acquisition and Collection section of this Privacy Notice to provide the Banking products and/or services that you request, including to fulfill our agreements or legal obligations regarding laws and regulations, when you visit, access, and/or use the Bank's products and/or services, including our website/application/Digital Banking Services in connection with the use of Bank products and/or services ("Services").

Your use of our applications and services is subject to these Terms of Use and Privacy Notice and indicates your agreement to these Terms of Use and Personal Data Privacy Notice.

1. Definisi

a. Bank is PT Bank KEB Hana Indonesia (Hana Bank), a company established under the laws of the Republic of Indonesia.

b. Personal Data is data about an individual who is identified or can be identified individually or in combination with other information either directly or indirectly through electronic or non-electronic systems.

c. Personal profile identification data, which may include full name, Population Identification Number, Taxpayer Identification Number, immigration documents, gender, nationality, place and date of birth, mother's maiden name, alias

ickname, religion, marital status, profession, voice recording, image recording, photo, signature form (wet and/or electronic), and/or biometric data.

d. Financial data, which may include account numbers, sources of income, monthly/annual income, monthly/annual expenses, transaction data, credit/financing data, investment-related data, asset-related data, collateral-related data, tax data, and service data from other financial services you receive.

e. Correspondence data, which may include the address as per your National Identity Card, address and domicile status, electronic mail address (e-mail), telephone/mobile phone number, and emergency contact which includes name, type of relationship with you, address, telephone/mobile phone number, and e-mail.

f. Digital activity data, which may include geolocation, IP/MAC address, your activity in the Bank application, and the interaction of the Bank application with other applications on your electronic device.

g. Personal Information is information about you that is personally identifiable that is collected through the application/digital banking services, such as your name, address, date of birth, telephone number, e-mail address and/or the like.

h. Digital Banking Services are digital banking applications licensed by the Financial Services Authority (OJK) and Bank Indonesia (BI) and registered as an Electronic System with the Ministry of Information Technology. A software application where all your instructions come from a mobile or online application.

i. Personal Data Protection is the overall effort to protect Personal Data in the Personal Data processing chain to guarantee the constitutional rights of Personal Data subjects..

j. Website is our website at www.hanabank.co.id and www.linebank.co.id.

k. Personal Data Subject is an individual to whom Personal Data is attached.

2. Information We Collect

a. We respect the concerns regarding your data protection and privacy. Therefore, we will only use your data that relates to you in accordance with this Privacy Notice.

b. We only collect Data that is important to the Bank and the Bank will only collect Data that is needed for anything related to you. The Bank will only store your Data for as long as it is needed to fulfill legal obligations or as long as the Data is related to the purposes for which the Data was collected. The Bank's Privacy Notice follows applicable laws and regulations to maintain data confidentiality unless the Bank is required by applicable law to disclose data to authorized third parties such as the government or other government agencies, only if there is a valid order.

c. In order to support us in providing optimal service to you, we will collect your Personal Data from various sources, including the following:

i. From You directly;

ii. Information about you generated when you apply for a service, use our services, or have had previous services;

iii. Personal Data referred to in this agreement includes Personal Data belonging to parties related to the Bank and third parties who are partners who collaborate for the benefit of the Bank;

iv. Cookies, location services, your IP address when visiting our website/application/digital banking services, or when you fill out our contact form within our website/application/digital banking services, or data that you have authorized to be accessed through your device;

v. From feedback or questions submitted when you contact the Bank through the office network, contact center, social media, and other official communication media provided by the Bank;

vi. From correspondence between you and the Bank via e-mail, physical mail, or official Bank correspondence/communication media;

vii. From survey data notified to the Bank;

viii. The party you authorize (based on a Power of Attorney) to provide information, statements, and/or instructions in writing or verbally, provide data or supporting evidence related to your information, manage your account, and make decisions on your behalf;

ix. From visual data processing or processing devices located in the office network and other physical locations related to the Bank (such as: CCTV); and/or

x. Other activities carried out by the Bank which result in the submission of personal data to the Bank.

d. We collect certain Personal Information from you so we can find the Services you need from Service Providers. You will provide Personal Information directly (for example, when you register), and some information will be automatically collected when you use our websites/apps/digital banking services.

e. When you visit our website/application/digital banking service, our website/application/digital banking service administrators will process technical data such as your IP address, the web pages you have visited, the internet browser you use, the web pages you previously/subsequently visited, and the duration of each visit/session, which allows the Bank to deliver the functions of the website/application/digital banking service. With this technical data, the administrators of the Bank's website/application/digital banking service can manage it, for example by resolving technical difficulties or improving the accessibility of certain parts of the website/application/digital banking service. In this way, the Bank can ensure that you can (continue to) find information on the Website in a fast and simple way.

f. You will be asked to authorize the instructions using different types of security information (e.g. Security Code, username, password) if required.

g. After authorizing the website/application/digital banking service to carry out instructions according to your orders, you are required to ensure that you do not disclose your security information to other parties.

h. We ensure the confidentiality and security of the personal information you provide is well maintained. We will use your data in accordance with applicable provisions.

i. If you provide Personal Data belonging to another party to the Bank for service purposes—for example, a beneficial owner, a power of attorney, an emergency contact, or another related party—then you represent and warrant that such party has acknowledged and consented to the provision of their Personal Data to the Bank, and has understood how the data is processed as described in this Privacy Notice.

3. Information You Provide Directly

a. When registering on a website/application/digital banking service, you will provide the Bank with your e-mail address, name, telephone number, account password, LINE Messenger User ID or other personal information.

b. The types of your Personal Data that may be processed include Personal profile identification Data, Correspondence data, Financial Data, Digital Activity Data and other personal related data.

c. When you use the website/application/digital banking service, the Bank will also process your technical data such as IP address, Device Identity (ID) or MAC address, and information about the manufacturer, model, and operating system of your mobile device. The Bank uses this data to enable the Bank to deliver the functions of the website/application/electronic system/digital banking service, resolve technical difficulties, provide you with the correct and latest version of the Application and to improve the functionality of the Application.

4. Use of Information We Collect

Legal Basis and Purpose of Personal Data Processing

The Bank will only process your Personal Data in accordance with the legal basis for Personal Data Processing determined by law, namely:

a. Fulfillment of contractual obligations to meet the Bank’s obligations under an agreement between you and the Bank, or prior to entering into an agreement with you;

b. Fulfillment of legal obligations that must be complied with by the Bank in accordance with the provisions of the applicable laws and regulations;

c. Fulfillment of other legitimate interests of the Bank, or of another person or legal entity, without overriding the rights of the Personal Data Subject, particularly in efforts to improve the Bank’s products and/or services;

d. Implementation of duties in the public interest, public services, or the implementation or authority of the Personal Data Controller based on statutory regulations;

e. Fulfillment of the protection of vital interests to fulfill the protection of the vital interests of personal data subjects and prevent harm to a person's life, body or health; or

f. Valid explicit consent from you for one or more specific purposes as communicated by the Bank to you, which are not included in the legal bases for processing set out in (1) through (5);

The Bank uses your e-mail, name, phone number, LINE Messenger ID information on one of the Bank's digital banking Applications and your account password to verify your ownership of an account to provide you with information about the Application. The Bank may also use your name, e-mail and phone number to send you messages, general updates about the Application. The Bank may also send you e-mails asking you to subscribe to our Mailing List. You may opt out of receiving these updates at any time.

The Bank uses information such as the name of the bank where your account is created, the name where the account is held and the amount transferred for the payment you make. You hereby agree that your data will be used by the Bank's internal data processing to provide better Services to you.

The Bank's processing of your Personal Data is carried out including for the following purposes:

i. For marketing purposes, namely offering products or services, including special offers, promotions, contests, or information that may be of interest to you. These marketing messages may be sent to you by the Bank and/or Business Partners in various ways, including through physical mail, electronic mail, short message service, telephone, facsimile, correspondence, and other official Bank information delivery media in accordance with and subject to applicable laws and regulations.

ii. To provide, design and/or develop banking services, facilities, products or services, including assisting the Bank in analyzing how the Bank's services are used, responding to inquiries, or notifying you if there are any changes to the services.

iii. For profiling and scoring activities to automatically make decisions regarding you to improve your services and the Bank's risk management.

iv. For the purposes of carrying out the Bank's business operations involving consultations with professional advisors or external auditors of the Bank, including legal advisors, financial advisors, and consultants, Group Companies, and any party bound by confidentiality obligations with the Bank. In this regard, the Bank will use its best efforts to ensure that the parties mentioned pay attention to this Privacy Notice.

v. To fulfill the requirements of the Know Your Customer principle, the Bank's risk mitigation efforts, and the implementation of verification/authentication of the truth of your data, as required by applicable laws and regulations.

vi. To comply with regulations or legal requirements, including for the implementation of the administration of the Bank's business activities, reporting to regulators, or inspections by authorized parties, which are carried out in accordance with applicable laws in Indonesia.

vii. To conduct research and statistical analysis including the use of new technologies.

viii. For other purposes in accordance with the Bank's internal policies and provisions, or in accordance with the terms and conditions governing the relationship between the Bank and you, which are implemented in accordance with applicable laws and regulations.

You as the data owner have the right under statutory regulations to:

i. Obtain access and request copies of your Personal Data, including obtaining and/or using your Personal Data in a form that conforms to the structure and/or format commonly used or can be read by electronic systems, where we have the right to charge a reasonable fee to fulfill this request.

ii. Request the Bank to correct incorrect data, complete incomplete Personal Data, update Personal Data. However, we cannot accommodate requests to change Personal Data if we believe that such changes would violate any statutory provisions or legal requirements or cause the information to be incorrect.

iii. Submit a complaint to a data protection authority or other independent regulator about how we use your Personal Data and request the right to compensation and the obligations that the Personal Data Controller must fulfill for violations of the Personal Data Processing.

iv. Request the Bank to end processing, delete, update and/or destroy your Personal Data if your Personal Data is no longer required for the purposes set out in the Personal Data Use Section or if there is no other legal basis for the Processing of Personal Data or this is not limited by provisions including Banking Reporting provisions.

If you wish to exercise your rights, or wish to obtain an explanation of your rights, please contact us via one of the channels listed in the Contact Us section.

Data that we obtain directly from you through filling in the website/application/digital banking service. Data collected when you use the website/application/digital banking service that the Bank may use to identify you and authenticate you for loss and fraud prevention purposes.

Moreover, the Bank will use the Data you provide for the administration of your Account with the Bank for the purposes of verification and managing transactions related to the website/application/digital banking services, conducting research on your demographic data of the website/application/digital banking services, developing the website/application/digital banking services, sending you information that the Bank deems useful for you including information about services from the Bank after you have given the Bank your consent that you do not mind being contacted regarding Bank services.

The Bank may use your personal information, including your date of birth, to verify your identity, assist you, determine which Services are right for you and beneficial to you, and to understand the most interesting aspects of the website/application/digital banking service.

Aggregated data will be considered non-personal information for the purposes of this privacy policy. When you register as a user of the website/application/electronic system/digital banking service, the Bank will also use your personal information to send you marketing services from time to time.

Transactions you make through the website/application/digital banking service are processed by the Bank. You must provide accurate and non-misleading Data to the Bank. You must update and notify the Bank if there are changes to the Data related to you. The Bank will store your transaction details for Bank security reasons. You can access this information by logging into your Account via the website/application/digital banking service application.

You can view details of transactions you have made, information on funds and subscriptions from marketing services that websites/applications/digital banking services perform. You will not allow third parties to access your personal data. The Bank is not responsible for misuse of passwords and/or PIN. You must notify the Bank if you believe that your password and/or PIN is being misused by another party.

5. Providing Information We Collect

The Bank may employ third party companies and individuals, in this case information regarding third parties who collaborate with the Bank to facilitate or provide certain Applications and services on behalf of the Bank, to provide consumer assistance, provide information, to perform services related to the website/application/digital banking services (e.g., without limitation, maintenance services, database management, web analytics and improvement of Website/application features) or to assist the Bank in analyzing how the Bank's Services are used or for the Bank's professional advisors and external auditors, including legal advisors, financial advisors, and consultants. These third parties only have access to your personal information to perform these tasks on behalf of the Bank and are contractually bound not to disclose or use such personal information for any other purpose.

The Bank does not share your Personal Information with any party other than the relevant Service Providers and third party companies and individuals mentioned in the above section, without your consent. However, the Bank will disclose your Personal Information if required by law, or is necessary to comply with laws, regulations and government requirements, or in the event of a dispute or any form of legal process between you and the Bank, or between you and other users in connection with, or related to, the Services, or in an emergency related to your health and/or safety.

By providing your Personal Information to the Bank, your Personal Information may be transferred, stored, used, and processed in a jurisdiction other than Indonesia where the Bank's servers are located. For the purposes of Personal Data Processing, you agree that we may process your Personal Data outside of Indonesia. In carrying out the transfer of your Personal Data outside of Indonesia, we will ensure that the destination country of the transfer has a level of Personal Data protection that is equivalent to or higher than the protection of Personal Data in Indonesia. If the destination country of the transfer does not have an equivalent or higher level of Personal Data protection, then we will implement adequate and binding Personal Data protection (such as entering into a contract with the recipient of your Personal Data transfer and/or written provisions and/or instruments), or if still not met, then you agree that the Bank may still transfer Personal Data outside of Indonesia based on your consent.

The Bank does not sell or rent your Personal Information to third parties. The Bank will retain your information until you delete your account on the Application.

6. Personal Data Storage

The Bank stores your information and/or personal data as long as you are still using the Bank's services, as long as the agreement is still valid, until the purpose of data collection is fulfilled, or in accordance with the retention period set by the Bank's internal policies or in accordance with the provisions of applicable laws and regulations. In providing services, some of your information and/or Personal Data may also be stored by Third Parties who collaborate with the Bank, while still ensuring data security and complying with applicable Personal Data protection provisions.

Banks also have a legal obligation to store your information and/or Personal Data if it is related to the resolution of an ongoing case. Once the retention period expires and there is no longer a legal or business need, the Bank will take commercially reasonable steps to delete or destroy such Personal Data.

In the event that the Bank shares your information and/or Personal Data with authorized government institutions and/or other institutions that may be appointed by the authorized government or have a partnership with the Bank, you agree and acknowledge that the storage of your information and/or Personal Data by the relevant institutions will follow the data storage policies of each of these institutions.

7. Security

The Bank ensures that the information and/or Data collected will be stored securely.

The Bank does not guarantee that the data you provide will not be intercepted or intercepted while being sent to the Bank. Any information sent by you to the Bank is at your own risk. You must not disclose your password to anyone. No matter how effective a technology is, there is no security system that cannot be penetrated.

To access your bank's digital banking services you can use several methods:

i. Using Password

Customers need to enter User ID and Password.

ii. Using Patterns

Customers can register login using a pattern after successfully logging in using User ID and Password, then setting the pattern according to the instructions listed in the application. The terms of use of the pattern are as follows:

1. Customers select the admin menu, then select the pattern.

2. Draw a pattern by connecting at least 5 dots and then follow the instructions on the device.

3. Enter the transaction PIN to confirm pattern registration.

iii. Using Fingerprint (Biometric)

Customers can register login using fingerprints, which will only run on devices that have a fingerprint login feature. The terms of use of fingerprints are as follows:

1. Customers can register their fingerprints on the MyHana application which has been registered on one installed device;

2. For every fingerprint data registration or deletion activity, customers need to log in first to the application, then select the admin menu and select biometrics then confirm by agreeing to the statement and entering the transaction PIN.

iv. Using Face Login (Biometric)

Customers can register login using their face, which will only run on devices that have a login feature using their face (Face Login/ID). The terms of use of face login are as follows:

1. Customers can register facial data in the application that has been registered on the device, provided that the face is clearly visible, without a face covering and clear lighting;

2. For every activity of registering or deleting facial data, customers need to first log in to the application, then select the admin menu and select biometrics, then confirm by agreeing to the statement (during registration) and entering the transaction PIN.

In the login service using biometrics, there are several policies as follows:

a. Fingerprint and facial login data will be lost and customers will need to re-register if they log in and enter other user data on the device being used.

b. The Bank is not responsible for any misuse by other parties whose biometrics are registered on the customer's smartphone.

c. The Bank is not responsible for any losses experienced by customers in connection with biometric login (either intentionally or unintentionally) or using the Bank Application, even if the Bank has notified them of the possibility of losses, including losses arising from:

i. Violation of Bank provisions regarding the login process using Application biometrics.

ii. The occurrence of an unauthorized access process and/or unauthorized use of electronic devices.

iii. Use in any form by other parties of information or data related to customers due to using the Application's biometric login and/or obtained from customer use when logging in via biometrics.

iv. Access to the Application with biometric login by any party other than you.

v. Any incident beyond the Bank's control or due to unreasonable use, and/or the occurrence of disconnection or termination during biometric login or the Application.

d. Customers are responsible for the accounts used in the Application and are not allowed to be transferred to other parties in any way. All consequences arising from misuse of the Account are the full responsibility of the customer.

e. You are responsible for obtaining and using the necessary software and/or equipment to access the Application at the customer's own risk.

f. The Customer is also responsible for the performance and security (including without limitation taking all necessary steps to prevent unauthorized use or access) of any equipment used by the Customer to access the Application.

g. The Customer authorizes the Bank that for security reasons, the Bank has the right to block the customer's access to the Application if there is an error in the Password/PIN 5 (five) times when accessing or making transactions or due to other matters which the Bank considers reasonable to suspect could cause losses to the Customer.

In the event of illegal access and activities on the confidentiality of your Personal Data beyond the Bank's control, the Bank will immediately notify you at the first opportunity so that you can reduce the risks arising from this. You are responsible for maintaining the confidentiality of your detailed information and Personal Data, including information regarding your username, password, email, and OTP, from anyone, and to always maintain and be responsible for the security of the device you use.

8. Changes to this privacy policy

The Bank has the right to change the Bank’s Privacy Notice in accordance with the Terms & Conditions from time to time. The Bank encourages you to review this page periodically for updates regarding the applicable Privacy Notice provisions.

If the Bank changes this Privacy Notice, the Bank will inform you via the website and/or electronic mail (email) or other communication media determined by the Bank.

9. Others

This Privacy Notice is made under the laws of Indonesia and shall be governed and interpreted in accordance with the laws of Indonesia. This Privacy Notice is written in Indonesian. All subsequent correspondence relating to this Privacy Notice shall be conducted in the Indonesian language.

Governing law and jurisdiction. This Privacy Notice is governed by and to be interpreted in accordance with the laws of the Republic of Indonesia. Any and all disputes arising from this Privacy Notice will be governed by the exclusive jurisdiction of the South Jakarta District Court.

Exclusively for LINE Bank Application

LINE ID Privacy Policy for LINE Bank by Hana Bank

In order to support digital banking provided by PT Bank KEB Hana Bank Indonesia namely "LINE Bank by Hana Bank" via online or offline (hereinafter referred to as "Service"), LY Corporation ("LYC", "we" or "us") has adopted this LINE

ID Privacy Notice for LINE Bank by Hana Bank to explain our handling of additional information obtained, used, or shared by the Company to LYC (or LY Corporation).

The LINE ID Privacy Notice for LINE Bank by Hana Bank constitutes additional provision to the LINE Privacy Notice, which shall remain in force and apply equally to the additional information items described in this Privacy Notice.

Privacy Notice for use of LINE Bank location information by Hana Bank

You agree to provide location information to LINE Bank by Hana Bank in order to receive personalized services, experiences, and benefits while using LINE Bank services. Any form of location information will be processed and handled in accordance with LINE Bank by Hana Bank's Privacy Notice.

Information Shared by LINE with Hana Bank

You agree that In order to provide the Service facilities, and support customers in connection with our Services to prevent unauthorized use of our Services, LY Corporation may provide personal information that has been collected by LY Corporation to Hana Bank to the extent of providing the Services described in this Privacy Notice.

When you submit a request to correct and/or update your personal information in LY Corporation's system, LY Corporation collects such personal information for the purpose of updating our records. LY Corporation will also automatically share such personal information with Hana Bank for the purpose of updating Hana Bank's system records, for the purpose of providing the Services and ensuring your smooth experience.

Personal information shared by Hana Bank with LYC (or LY Corporation) will be processed and handled in accordance with Hana Bank's Privacy Notice.

Information Shared by Hana Bank to LINE

Please refer to Hana Bank's Privacy Notice for details of information shared by Hana Bank with LYC (or LY Corporation) for all data shared for and/or to other parties based on the Customer's individual consent.

10. Acknowledgement and Consent

By accessing and using Bank Services, you acknowledge that you have known, read and understood this Privacy Notice and the terms of use, practices, processing and transfer of your personal information by the Bank as stated in this Privacy Notice.

You also represent that you have the right to share all information you have provided to the Bank and to grant the Bank the right to use and share such information with Service Providers.

The Bank strives to verify you and your Personal Data to ensure optimal accuracy, completeness, and consistency. By agreeing to this Privacy Notice, you release the Bank from any claims regarding the accuracy, completeness, and/or consistency of any data, without prejudice to the Bank's obligation to continue to make improvements.

11. Stop Receiving Notifications

The Bank has a policy to opt-in/opt-out of the databases. If you wish to stop receiving notifications including but not limited to emails and/or other media from the Bank, please submit your objection via the channels provided by the Bank.

12. Contact Us

If you have further questions about the privacy and security of your information, then please contact us through the following contact information:

Call Center: 1-500-021

Email: customervoice@hanabank.co.id / help@linebank.co.id

Or you can visit the nearest office network.

We care about your data, get to know more here

Privacy Notice

Get LINE Bank app on your mobile

Any questions?

1-500-021

Mail Inquiries