KVKK / GDPR / UU PDP Privacy and Data Protection Agreement

Version 1.0

1. Parties and Definitions

1.1 Data Controller (Pengendali Data Pribadi): PT Balivizem Balikeys Group ("Balivizem" or the "Company"), a foreign-capital (PT PMA) company established under the laws of the Republic of Indonesia.

Address: Jalan Gunung Soputan No. 1A, Pemecutan Kelod, Denpasar Barat, Kota Denpasar, Bali 80119, Indonesia

NIB: 0403260107415

• AHU: AHU-0018660.AH.01.01.Tahun 2026
• Tax No. (NPWP): 1000000008553076
• E-mail / data protection contact: [email protected]
• Telephone / WhatsApp: +62 851-9053-8501 (Global), +90 850 346 81 13 (TR)

1.2 Definitions:

• User: Any natural person using the Balivizem website, application or store.

• Customer: A person who purchases or applies for visa, KITAS, company setup or other services.

• Consultant: An employee or contracted person managing applications on behalf of Balivizem.

• Partner: The lawyer, notary, sponsor or agency carrying out the official procedures of the application.

• Reseller: A business partner reselling Balivizem services to its own customers at its own price.

• B2B Account: A corporate buyer account activated with admin approval.

• Panel User: The collective name for Consultant, Partner, Reseller, B2B and Store administrator accounts.

• Personal Data: Any information relating to an identified or identifiable natural person.

• Special Category / Specific Data: Health, biometric, criminal record, children's and personal financial data (UU PDP Art. 4, KVKK Art. 6, GDPR Art. 9–10).

2. Scope and Applicable Legislation

This text covers all personal data collected on balivizem.com, the Balivizem application (web and mobile), the store, e-mail, WhatsApp and at the office.

UU PDP – Indonesian Personal Data Protection Law No. 27/2022 — Always; the law to which the company is principally subject

KVKK – Law No. 6698 on the Protection of Personal Data — When the data of persons located in Turkey is processed

GDPR – EU General Data Protection Regulation 2016/679 — When services are offered to persons located in the EU

Where there is a difference between the legislations, the provision that provides more protection to the data subject applies.

3. Personal Data Processed

Identity — Full name, date and place of birth, nationality, gender, marital status — Customer, reseller, B2B

Passport and travel — Passport information and copy, passport-style photograph, entry-exit stamps, flight ticket — Customer

Visa and residence — Type of visa/KITAS/KITAP, application and approval numbers, validity dates, Indonesian address — Customer, official institutions

Contact — Telephone, e-mail, WhatsApp, address — All users

Professional and corporate — Company information, shareholding ratios, position, diploma, CV, job offer — Customer, B2B

Sponsor and family — Spouse and child information, marriage and birth certificates, sponsor information — Customer

Financial — Invoice information, payment record, bank account statement (proof of balance), tax number — Customer, reseller, B2B

Transaction and customer relationship — Application status, missing document notes, quotations, correspondence, complaints — System, consultant

Digital — Account information, IP, device and browser information, session and consent logs, cookies — System

Marketing — Campaign preferences, advertising interactions (Meta, etc.) — With the user's permission

Special category / specific data is processed only when the service applied for requires it and there is explicit consent or a legal obligation:

• • Criminal record (SKCK or country-of-origin criminal record)
• • Health insurance and, where necessary, a medical report

• Biometric photograph (the taking of biometric data such as fingerprints is carried out not by Balivizem but directly by immigration)

• • Data of children under 18 (provided only by a parent or guardian)
• • Personal financial data (bank statement, proof of income)

When the User uploads data belonging to another person (spouse, child, sponsor, employee), they accept that they have informed that person and obtained the necessary permission.

4. Purposes of Processing and Legal Bases

Balivizem processes personal data only for the following purposes and on the legal basis stated for each purpose. (Purpose — UU PDP Art. 20 — KVKK Art. 5–6 — GDPR Art. 6–9)

Preparation of visa, KITAS, company setup applications and submission to official institutions — Performance of the contract — Conclusion and performance of a contract (Art. 5/2-c) — Art. 6/1-b

Processing of special data such as criminal record, health, children's data — Explicit consent / legal obligation — Explicit consent or establishment of a right (Art. 6/3) — Art. 9/2-a and Art. 10

Account opening, identity verification, panel access — Performance of the contract — Art. 5/2-c — Art. 6/1-b

Invoicing, payment, accounting, tax records — Legal obligation — Legal obligation (Art. 5/2-ç) — Art. 6/1-c

Reconciliation with reseller, B2B and partner, commission and entitlement calculation — Performance of the contract — Art. 5/2-c — Art. 6/1-b

Application status, missing documents, visa expiry reminders — Performance of the contract — Art. 5/2-c — Art. 6/1-b

Keeping consent and transaction logs, evidence in disputes — Legitimate interest — Establishment and protection of a right (Art. 5/2-e), legitimate interest (Art. 5/2-f) — Art. 6/1-f

Fraud and forged document prevention, system security — Legitimate interest — Art. 5/2-f — Art. 6/1-f

Official institution requests and legal notifications — Legal obligation — Art. 5/2-ç — Art. 6/1-c

Quotations, campaigns, newsletters, retargeting advertising — Explicit consent — Explicit consent (Art. 5/1) — Art. 6/1-a

Service quality and satisfaction analysis — Legitimate interest — Art. 5/2-f — Art. 6/1-f

Marketing permission is not a precondition of any service; refusing it does not affect obtaining the service.

5. Transfer of Data

Balivizem does not sell or rent personal data; it shares only as much as is necessary for performing the service with the following recipients. (Recipient — Why — Status)

Direktorat Jenderal Imigrasi, Kemenkumham/AHU, OSS-BKPM, tax administration and other official institutions — Submission of the application, legal notification — Independent public authority

Partner lawyer, notary, sponsor company — Carrying out the official procedure — Data processor or independent data controller (with professional secrecy)

Reseller and B2B account — Following the application status of the customer they brought — Data processor

Consultants — Management of the application — Person authorized on behalf of Balivizem

Cloud, application and e-mail infrastructure (Bubble.io, AWS, Google Workspace, etc.) — Hosting, sending notifications — Data processor

Payment institutions and banks — Collection and refund — Independent data controller

Financial advisors and legal advisors — Accounting, audit, disputes — Bound by professional secrecy

Advertising platforms (Meta, etc.) — Only if there is marketing permission — Data processor or joint controller

Transfer abroad. Data is processed in Indonesia and the servers of service providers may be located in the USA, EU or Singapore.

• KVKK Art. 9: Transfer from Turkey to Indonesia and other countries is made on the basis of the standard contracts announced by the Board or the conditions for discretionary transfer (such as being necessary for the application). When a standard contract is signed, it is notified to the Board within 5 business days.

• GDPR: For data collected directly from the EU, Standard Contractual Clauses (SCC) or the Art. 49 derogations are used.

• UU PDP Art. 56: For transfers outside Indonesia, an equivalent level of protection in the recipient country is required, failing that adequate safeguards, failing that the data subject's consent.

6. Retention and Destruction Periods

Data is retained until the purpose of processing ends and the statutory retention period expires; it is then deleted, destroyed or anonymized. (Data — Period — Basis)

Invoice, payment, accounting records — 10 years — Indonesian tax procedures law (UU KUP), Turkish Commercial Code

Service contract, consent and transaction logs — 10 years from the end of the contract — Limitation period, need for evidence

Passport, visa, sponsor and family documents — Validity of visa/KITAS + 2 years — Renewal and possible official inquiry

Criminal record and health documents — 1 year after the application is concluded — Data minimization

Rejected or incomplete applications — 2 years from the last transaction — Possibility of dispute

Marketing permissions and lists — Until the permission is withdrawn — Explicit consent

• System and security logs — 2 years — Security, legitimate interest
• Inactive accounts — 3 years from the last login — Closing of the account

Balivizem carries out destruction operations periodically every 6 months and records them. While a dispute or official investigation is ongoing, the relevant data is retained until it is concluded.

7. Rights of the Data Subject and Application Procedure

Every data subject may exercise the following rights free of charge:

1. To learn whether their personal data is being processed and to request information

2. To learn the purpose of processing and whether it is used in accordance with that purpose

3. To know the third parties to whom the data is transferred

4. To request correction of incomplete or inaccurate data

5. To request deletion or destruction where there is no statutory retention obligation

6. To request that correction and deletion operations be notified to the parties to whom data was transferred

7. To object to an outcome against them resulting from analysis carried out exclusively by automated systems

8. To claim compensation for damage caused by unlawful processing

9. To withdraw explicit consent at any time (withdrawal does not affect the lawfulness of previous processing)

10. To receive and transfer data in a commonly used format (UU PDP Art. 13, GDPR Art. 20)

11. To restrict processing and to object to processing based on legitimate interest (UU PDP Art. 11, GDPR Art. 18–21)

Application: The request is sent in a manner enabling identity verification to [email protected], through the "Profile > Privacy" section of the application, or in writing to the company address. Balivizem responds within 30 days at the latest, and for correction and access requests under UU PDP within the shorter periods set by the law (3 × 24 hours).

Limits: Data subject to a statutory retention obligation, documents submitted to an official institution in an ongoing application, and records required as evidence in a dispute are not deleted before the period expires. A deletion request in an ongoing application may result in the application being left incomplete; in this case the provisions of the Membership Agreement and the Service Agreement apply.

Complaint: The data subject may apply to the Personal Data Protection Agency in Indonesia, to the Personal Data Protection Board in Turkey (on condition of applying to Balivizem first), and to the supervisory authority of their country in the EU.

8. Data Security and Breach Notification

Balivizem protects data against unauthorized access, loss and alteration with reasonable technical and administrative measures.

• Role-based access: Each panel user sees only the data relating to their own work; resellers and B2B see only their own customers, partners see only the applications assigned to them.

• Encryption: TLS/HTTPS in data communication; documents are kept in encrypted storage.

• Account security: Strong passwords and security measures on panel accounts.

• Logging: Document viewing, downloading, export and authorization changes are recorded.

• Confidentiality undertaking: Employees, consultants and partners sign confidentiality agreements.

• Data minimization: Only the documents required by the type of application are requested.

Breach notification: When a data breach is detected, Balivizem makes a notification to:

The affected data subjects and the Indonesian data protection authority within 3 × 24 hours (UU PDP Art. 46)

The Personal Data Protection Board within 72 hours, and the affected persons as soon as possible (KVKK Art. 12/5 and Board decision)

The EU supervisory authority within 72 hours (GDPR Art. 33–34)

in each case within the periods stated above.

Given the nature of the internet, no system is completely secure. Balivizem is not responsible for cyber attacks occurring without its own fault despite having taken the necessary measures, or for damages arising from the user's failure to protect their password, device or e-mail; liabilities that cannot be limited by law are reserved.

9. Changes, Disputes and Entry into Force

9.1 Changes. Balivizem may update this text in line with changes in legislation or services. Material changes are announced at least 15 days before entry into force by e-mail and application notification; renewed consent is obtained for changes requiring explicit consent. Each version is numbered and archived.

9.2 Governing law. This text is subject to the law of the Republic of Indonesia. The mandatory protective provisions in consumers' own countries (KVKK, GDPR, consumer legislation) are reserved.

9.3 Dispute resolution. The parties first seek an amicable solution within 30 days. If it cannot be resolved, the Denpasar District Court (Pengadilan Negeri Denpasar) has jurisdiction. Consumers retain the right to apply to the authorities in their own countries.

9.4 Language. The text is prepared in Turkish, English and Indonesian. In an official dispute in Indonesia, the Indonesian text prevails (Law No. 24/2009 Art. 31).

9.5 Partial invalidity. The invalidity of a provision does not affect the other provisions; the invalid provision is deemed replaced by the valid provision closest to its purpose.

9.6 Entry into force. Version 1.0. Enters into force with the User's electronic consent.