This notice applies to consumers (“You”) who access and use the website of PT Aroma Tobacco International (“We” or “Us”).

We highly value and respect that your personal data belongs to you. Therefore, we process all information—regardless of its source or form—with the utmost care by the laws and regulations of the Republic of Indonesia. Through this Privacy Policy, we explain how we collect, use, disclose, process, and protect your personal data when you interact as a consumer on our website.

We encourage you to read this Privacy Policy carefully to understand your rights in accessing, updating, or exercising choices regarding the use of your personal data.

We will continue to review this Privacy Policy and make updates or amendments when necessary. Any updates to this Privacy Policy will be communicated to you through appropriate methods, including but not limited to email notifications or banners on the website.

This Privacy Policy is drafted in the Indonesian language. Any translation into another language is provided solely for convenience. In the event of any inconsistency or discrepancy between the Indonesian version and its translation, the Indonesian version shall prevail.

A. INFORMATION WE COLLECT ABOUT YOU

When you access and use our website, we may collect, store, and process your personal data in the following ways:

• You may provide us with personally identifiable or contact information, such as full name, place and date of birth, gender, nationality, complete address, email address, and telephone number;

• We may automatically collect technical data such as Internet Protocol (IP) address, device type, operating system, browser type, Uniform Resource Locator (URL) and accessed pages, approximate geographic location data, access time, cookies, and other information related to your use of devices and browsers;

(collectively referred to as “Personal Data”).

We are not responsible for any loss that may arise from the submission of incomplete, inaccurate, false, or misleading Personal Data.

This website is used for our branding and corporate presence purposes. It is intended solely for adults aged twenty-one (21) years or older.

B. USE AND DISCLOSURE OF YOUR INFORMATION

We respect your privacy and acknowledge that your Personal Data is confidential and private. Therefore, we will protect your Personal Data and process it responsibly and in compliance with applicable laws and regulations.

Your Personal Data will be used solely for the specific services that we have designated. Your Personal Data may, on a limited basis, be shared with affiliates or third-party service providers who cooperate with us, but only for the purposes already specified, and subject to our data protection requirements and applicable laws.

We may also use or disclose your Personal Data where necessary to comply with legal obligations, such as asserting or defending legal claims, complying with court orders, official requests, or warrants issued by competent authorities, investigating suspected fraud or other violations, fulfilling regulatory obligations, protecting our legitimate interests, and safeguarding the rights, property, or safety of us, other users, or third parties, as well as any disclosures permitted or required by law.

C. LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

We process your Personal Data following this Privacy Policy and applicable Indonesian laws. The legal bases for processing are as follows:

• Consent: Your Personal Data will only be processed upon your consent.

• Legitimate Interests: Your Personal Data may be processed for our legitimate interests and/or those of third parties, provided such processing does not infringe upon your rights.

• Legal Obligations: Your Personal Data may be processed to comply with legal obligations or requests from competent authorities.

D. TRANSFER OF YOUR PERSONAL DATA

We may transfer your Personal Data to other countries outside the Republic of Indonesia for purposes described in this Privacy Policy. We will ensure that recipients of your Personal Data protect and process such data in accordance with applicable laws, maintaining its confidentiality and security.

E. COOKIE POLICY

Cookies are small text data that we send to your server through a web server when you visit our website, which are then stored on your device. Cookies enable us to recognize you when you return to our website, ensure the proper functioning of the site, and improve our user services.

When you access our website, you will be notified regarding the use of cookies. You may refuse or block cookies via your browser settings. However, disabling cookies may cause certain features of our website to function improperly or become unavailable.

F. YOUR RIGHTS AS A DATA SUBJECT

As a Personal Data subject, you are entitled to rights guaranteed under the prevailing laws and regulations of the Republic of Indonesia.

G. COMPLAINT MECHANISM

If you believe that your rights in relation to the processing of your Personal Data have been violated, you have the right to file a complaint with us.

To submit a complaint, please contact us through the “CONTACT US” feature below. We will address and resolve your complaint fairly and transparently.

However, please note that the exercise of certain rights is not absolute. Such requests such as deletion/destruction or withdrawal of consent, may be denied if they conflict with:

• national defense and security interests;

• law enforcement interests;

• public interest in state administration;

• financial, monetary, payment system supervision, or financial stability in the interest of state administration; or

• statistical or scientific research interests.

H. SECURITY OF YOUR PERSONAL DATA

We will endeavor to protect your Personal Data through measures consistent with personal data protection regulations and industry standards and practices.

You are also responsible for maintaining the confidentiality of the Personal Data you have provided to us and ensuring the security of the devices used to access our services.

I.RETENTION OF PERSONAL DATA

We will only retain and process your Personal Data for as long as necessary to provide services to you, fulfill legal obligations, or for other purposes permitted by applicable regulations.

Once such data is no longer required or mandated by law, we will delete it.

J. CHANGES TO THIS PRIVACY POLICY

We may update the manner in which we handle your Personal Data in accordance with policies and/or applicable laws. You are encouraged to periodically review this Privacy Policy for updates or changes.

K. GOVERNING LAW

The provisions outlined in this Privacy Policy are governed by the laws of the Republic of Indonesia.

L. CONTACT US

For inquiries and/or comments regarding this Privacy Policy, or to submit complaints regarding our compliance with applicable laws, you may contact us via email at info@aromatobacco.co.id or through the link provided here.