KFCKU ONLINE SERVICE PRIVACY POLICY

A. COLLECTION OF PERSONAL DATA

We may obtain User's Personal Data from various sources (e.g., directly from Users or through third parties), including:

1. Information obtained (directly or indirectly) about the computer, phone device, or other hardware used to access the Online Services (including Users' IP address, geographic location, browser/platform type and version, internet service provider, operating system, gender, access to device cameras, referral/exiting pages, visit duration/usage, page views, and any search terms used by Users) ("Device Information").
2. Information obtained (directly or indirectly) on the Online Services when Users place orders, register accounts, participate in loyalty programs, make online purchases, submit inquiries or complaints, subscribe to mailing lists, bulletins, or other marketing communications, surveys, or use other features of our services, including name, date of birth, gender, address, phone number, and email address of Users.
3. We may link or combine activities and information collected from you on the Online Services with information we collect from you offline (e.g., at KFC Indonesia outlets), information received from third parties, and information automatically collected through tracking technology (as defined below). These third parties include, but are not limited to, services like Google Analytics, Meta Pixel, or similar.

B. USE OF PERSONAL DATA

We may use the Personal Data we obtain about Users for the following purposes:

1. To verify the User's eligibility to use the features and functions of the Online Services.
2. To process the registration of the User's KFC Account as an Online Services User, maintain, and manage User registration.
3. To develop and provide services within the Online Services.
4. To provide services to Users and customer service related to the use of Online Services, including collaborating with third parties to facilitate payments for the purchase of goods and services, shipping, and other related services for purchases, imposing refunds, sending notifications about User transactions, and responding to User inquiries, feedback, claims, or disputes.
5. To improve and develop our offerings through research and development of new functions for Online Services or new products and services that we may offer from time to time.
6. To conduct research, statistical analysis, or surveys, whether verbally or in writing, to manage and protect our business, including information technology infrastructure, measure the performance of Online Services and other services we offer, and ensure User satisfaction with our services.
7. To analyze trends, usage, and other behaviors (both individually and collectively) that help us better understand how Users and our User groups access and use the Online Services and the commercial activities behind them, including for service improvement purposes and responses to User inquiries and preferences.
8. Subject to obtaining User consent in accordance with applicable laws as referred to in section D below, we may provide direct marketing information to Users regarding the services we offer and our affiliates and selected third parties, using the User's Personal Data to contact the User via phone, short message service (SMS), email, mail, and fax.
9. If you make a purchase, your KFC Account financial information (such as balance and purchase details).
10. Customer Support - To facilitate your communication with us, we use your Personal Data:
    • To quickly and securely verify your identity and link directly to your order history.
    • To redeem orders you purchase from the Online Services.
    • To complete the order information you have paid for via the Online Services.
11. To detect, investigate, prevent, or address violations of the Terms and Conditions, all internal policies of the Online Services, applicable industry guidelines, other guidelines, laws, or related regulations.
12. To disclose information to prevent harm or financial loss, report any suspected illegal activity, or respond to any claims or potential claims filed against us or our affiliates. To enable any due diligence and other assessments or evaluations for proposed mergers, acquisitions, financing transactions, or joint ventures.
13. For other legitimate business purposes such as protecting Users from harm, safeguarding lives, ensuring the security of our products and systems, and protecting our rights and/or other property.
14. We may also use User Personal Data in other ways, which we will provide special notice for at the time of data collection or subsequently approved by the User.

C. DISCLOSURE OF PERSONAL DATA

The User's Personal Data that we store will be kept confidential; however, we may provide information to the following parties (whether within the country or outside the User's country of residence) for the purposes outlined in sections B.1 to B.13 above:

1. KFC accounts and other KFC services that are wholly or partially owned by the corporate group.
2. Agents, contractors, or third-party service providers who collaborate with us in providing services to Users, including fraud prevention, bill collection, data entry, database management, promotions, marketing, customer service, technology services, product and service notifications, as well as payment extension services.
3. Entities with whom we have business referral relationships or other commercial agreements, including third parties and KFC-owned entities.
4. Payment gateways, merchants, and other organizations such as card associations, payment networks, or financial institutions, to or through whom payments are made using Online Services or other entities that enable the use of Online Services.
5. Third-party marketing service providers.
6. Professional advisors, law enforcement agencies, insurance companies, government authorities, and other relevant institutions where KFC is required to disclose information in accordance with applicable laws, regulations, or commercial arrangements, including agreements with card associations or payment networks.

D. DIRECT MARKETING ACTIVITIES

As stipulated in provision B.7 above, we may intend to use Users' Personal Data in direct marketing (Marketing & Promotion) activities and, in the future, obtain Users' consent for the planned scope and intended methods of direct marketing activities. If Users subsequently provide such consent, please note that:

1. Certain Personal Data that we obtain from time to time may be used in direct marketing and promotional activities.
2. We may offer goods and services to Users that we believe are relevant to them, for which specific further consent from Users will be obtained. This includes goods and services offered by us, any of our affiliates, business partners, or selected third parties, including payment and financial products.
3. We may provide Users' Personal Data to certain third parties for use in marketing their goods and services, including:
   • Our affiliates
   • Business partners
   • Other third parties
4. Users' consent to the use of their Personal Data for direct marketing purposes will be obtained by selecting to check a box or other positive indication signifying no objection.
5. At any time, if Users do not wish to continue using or providing their Personal Data to others for use in direct marketing as described above and in the related consent, they may exercise the “opt-out” right by notifying us.

E. SECURITY MEASURES AND DATA STORAGE

We take all reasonable and utmost possible steps, including providing technical, administrative, and physical safeguards, to help protect Users' Personal Data that we process from the risk of loss, misuse, unauthorized access, disclosure, alteration, and destruction.

We will store and ensure that our service providers store Users' Personal Data only as long as necessary for the purposes set forth in this Privacy Policy and in accordance with the Privacy Policy and all applicable regulatory requirements. We implement appropriate security measures to protect your information, although we cannot guarantee complete system security.

For Users registered with a KFC Account, we remind Users not to disclose their password or PIN to anyone. Our employees or officers will never request Users' passwords via unsolicited phone calls or emails. Users are advised not to store their login information (e.g., user ID and password) on shared or public computers.

FFI is responsible for the Personal Data that FFI collects from Users, but Users are also responsible for maintaining the confidentiality of their Personal Data by not allowing third parties to access their Personal Data without Users' consent and knowledge. In this regard, FFI is not responsible for the misuse of passwords and/or PINs that Users create and use to access their Personal Data, wherever Users store their Personal Data, including passwords and/or PINs to access or log in to Online Services. Users must notify FFI if there is any misuse of their password and/or PIN by third parties.

F. THIRD-PARTY SERVICES AND WEBSITES

Online Services may provide links to other websites and services (including applications operated by third parties) for Users' convenience and information. These services and websites may operate independently of us and may have their own privacy notices or policies. We encourage Users to read them before engaging in any activities or using these website services.

For websites not owned or controlled by us, we are not responsible for their content, privacy practices, or service quality.

G. CHANGES TO THE PRIVACY POLICY

We reserve the exclusive right to modify, add, or revise this Privacy Policy from time to time.

1. This Personal Data regulation is subject to, governed by, and enforced under the laws of the Republic of Indonesia.
2. In case of disputes regarding the interpretation and implementation of this Privacy Policy, Users and FFI agree to resolve them through mutual deliberation. If the dispute cannot be resolved through such deliberation, it must be settled at the South Jakarta District Court.
3. This Privacy Policy is made in both Indonesian and English. In case of discrepancies between the English version and the Indonesian version, the Indonesian version shall prevail.
4. We do not guarantee the security of our database and do not guarantee that the data Users provide will not be interrupted while being transmitted to us. Any transmission of information by Users to us is at their own risk. Users should not disclose their passwords to anyone. No matter how effective a technology is, no security system is impenetrable.

H. OTHER PROVISIONS

1. This Personal Data regulation is subject to, governed by, and enforced under the laws of the Republic of Indonesia.
2. In case of disputes regarding the interpretation and implementation of this Privacy Policy, Users and FFI agree to resolve them through mutual deliberation. If the dispute cannot be resolved through such deliberation, it must be settled at the South Jakarta District Court.
3. This Privacy Policy is made in both Indonesian and English. In case of discrepancies between the English version and the Indonesian version, the Indonesian version shall prevail.
4. We do not guarantee the security of our database and do not guarantee that the data Users provide will not be interrupted while being transmitted to us. Any transmission of information by Users to us is at their own risk. Users should not disclose their passwords to anyone. No matter how effective a technology is, no security system is impenetrable.

I. DECLARATION

By using the Online Services, Users acknowledge that they have read and understood this Privacy Policy and agree to the use, processing, and transfer of Personal Data as set out in this Privacy Policy.

J. FURTHER INFORMATION

Regarding Users' rights as set forth in this Privacy Policy, to access or correct their Personal Data, to "opt-out," or if Users wish to ask questions or submit complaints, please contact Customer Service at:

PT Fast Food Indonesia Tbk

Address: Jl. MT Haryono Kav 7 Jakarta Selatan 12810, Indonesia

• Operating hours:

• Weekday: 08.00 - 20.00

• Weekend: 10.00 - 19.00

Telephone: 14022

E-mail: info@kfcindonesia.com