PRIVACY POLICY

Effective Date: [16.09.2026]
Last Updated: [16.09.2026]
This Privacy Policy (“Privacy Policy”) explains how PT Aruna Global Trading, an Indonesian company established under the laws of the Republic of Indonesia (“Company”, “we”, “us”, or “our”), processes Personal Data collected through our website and in the course of our business-to-business activities.
Our website https://arunatrade.com is primarily intended to provide information about our Company and services and to enable business representatives and other interested persons to contact us and submit business enquiries.
This Privacy Policy is intended to comply with applicable Indonesian data protection laws, including Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (Undang-Undang No. 27 Tahun 2022 tentang Pelindungan Data Pribadi) (“PDP Law”), to the extent applicable to our processing activities.
1. PERSONAL DATA CONTROLLER
For the purposes of the PDP Law, PT Aruna Global Trading acts as the Personal Data Controller (Pengendali Data Pribadi) in respect of Personal Data processed for the purposes described in this Privacy Policy.
2. PERSONAL DATA WE COLLECT
Depending on your interaction with us, we may collect:
Contact Information

• name;
• business email address;
• telephone or mobile number;
• company name;
• job title or position;
• business address; and
• other contact information that you voluntarily provide when contacting us.

Business and Enquiry Information

• information concerning your business requirements, products or services, target markets, expected volumes, timing, specifications, and documents;
• commercial and transaction-related information provided by you or the business entity you represent; and
• other information that you voluntarily provide in connection with a business enquiry, proposed transaction, or engagement.

Communications
We may collect information contained in correspondence or communications that you send to us, including inquiries, requests, proposals, documents, and other business communications.
Technical Information
When you visit our website, we may automatically collect limited technical information, such as:

• IP address;
• browser type and version;
• operating system;
• device information;
• date and time of access;
• pages visited;
• referring website; and
• other technical information necessary to operate, secure, and maintain the website.

3. SOURCES OF PERSONAL DATA
We may obtain Personal Data:

• directly from you;
• from your employer or the business entity you represent;
• from customers, suppliers, distributors, business partners, counterparties, or service providers;
• from publicly available business sources; and
• automatically through your use of our website.

4. PURPOSES OF PROCESSING
We may process Personal Data for legitimate business and operational purposes, including:

1. responding to inquiries and requests submitted through our website or other communication channels;
2. communicating with representatives of existing or prospective customers, suppliers, business partners, and counterparties;
3. evaluating and managing potential and existing business relationships;
4. providing information about our services and solutions;
5. assessing and coordinating business requirements in connection with wholesale trading, commercial intermediation, sourcing, and business consulting activities;
6. negotiating, entering into, administering, and performing business agreements and transactions;
7. coordinating communications, commercial information, documents, orders, deliveries, and other milestones among relevant parties and service providers;
8. conducting reasonable counterparty verification and internal review where necessary in connection with a proposed or existing business relationship;
9. operating, maintaining, securing, and improving our website and IT systems;
10. maintaining business, transaction, accounting, and corporate records;
11. complying with applicable laws, regulations, legal processes, and lawful requests from governmental or regulatory authorities; and
12. establishing, exercising, or defending legal claims and protecting our legitimate business interests.

We will not process Personal Data for purposes that are incompatible with the purposes for which it was collected, unless otherwise permitted or required by applicable law.
5. LEGAL BASIS FOR PROCESSING
Depending on the circumstances, we may process Personal Data on the basis of one or more lawful grounds recognized under applicable Indonesian law, including:

• your consent, where consent is required;
• taking steps at your request prior to entering into a contract;
• performance of a contract;
• compliance with a legal obligation;
• protection of vital interests;
• performance of a task in the public interest or exercise of lawful authority, where applicable; and
• our other legitimate interests, taking into account the purposes and necessity of the processing and the appropriate balance between our interests and the rights of the Personal Data Subject.

Where processing is based on consent, you may withdraw your consent at any time, subject to applicable legal limitations.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
6. DISCLOSURE AND INTERNATIONAL TRANSFERS
We may disclose Personal Data where reasonably necessary for the purposes described in this Privacy Policy, including to:

• customers, suppliers, distributors, business partners, counterparties, and other parties involved in a proposed or existing commercial relationship or transaction;
• service providers supporting our website, IT systems, hosting, communications, document management, or other business operations;
• independent logistics, customs, inspection, certification, and other specialist service providers where relevant to an engagement or transaction;
• banks and other regulated financial institutions involved in a relevant commercial transaction;
• legal, accounting, tax, audit, and other professional advisers;
• governmental, regulatory, judicial, or law-enforcement authorities where disclosure is required or permitted by applicable law; and
• a prospective or actual purchaser, successor, or other relevant party in connection with a merger, acquisition, reorganization, transfer of business or assets, or similar corporate transaction, subject to applicable law.

Because our business activities are cross-border in nature, Personal Data may be transferred to recipients located outside the Republic of Indonesia.
Where we transfer Personal Data outside the Republic of Indonesia, we will take the measures required by applicable Indonesian law. These may include ensuring that the recipient jurisdiction provides a level of Personal Data protection that is equal to or higher than that required under the PDP Law, implementing adequate and binding safeguards, or obtaining the consent of the Personal Data Subject where required.
7. DATA SECURITY
We implement reasonable technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, misuse, loss, destruction, or other unlawful processing.
The measures may include access controls, authentication, confidentiality obligations, system security controls, monitoring, and other appropriate safeguards.
8. DATA RETENTION
We retain Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy or as required or permitted by applicable law.
Retention periods may depend on:

• the nature of the business relationship;
• the purpose for which the Personal Data was collected;
• contractual and legal obligations;
• accounting, transaction, and corporate record requirements;
• the establishment, exercise, or defense of legal claims; and
• legitimate business requirements.

When Personal Data is no longer required, we will delete, destroy, anonymize, or otherwise securely dispose of it in accordance with applicable law and our internal procedures.
9. YOUR RIGHTS
Subject to applicable Indonesian law and any applicable limitations, you have rights in relation to your Personal Data, including the right to:

• obtain information about the identity and accountability of the party processing your Personal Data, the applicable legal basis, and the purposes for which your Personal Data is requested and used;
• access your Personal Data and obtain a copy of it;
• complete, update, or correct inaccurate or incomplete Personal Data;
• request the termination of processing and the deletion or destruction of Personal Data where permitted by law;
• withdraw consent where processing is based on consent;
• object to decision-making based solely on automated processing, including profiling, where it produces legal consequences or a significant effect on you;
• request the postponement, restriction, or limitation of processing where permitted by law;
• obtain and use your Personal Data in a commonly used or machine-readable format and transmit it to another Personal Data Controller where applicable; and
• seek compensation or other remedies for violations involving the processing of your Personal Data, as provided by applicable law.

To exercise your rights, please contact us using the details in the Contact Us section below.
We may request reasonable information to verify your identity before processing a request and may apply limitations or exceptions permitted by applicable law.
10. COOKIES
Our website may use cookies and similar technologies that are necessary for website functionality, security, performance, analytics, or other legitimate purposes.
Where required by applicable law, we will obtain appropriate consent before using non-essential cookies or similar technologies.
You may manage or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the website. For further information about cookies used on our website, please refer to our Cookie Policy.
11. PERSONAL DATA INCIDENTS
If a Personal Data Protection incident occurs that is subject to notification requirements under applicable Indonesian law, we will take appropriate steps to investigate, mitigate, and address the incident and provide written notifications to affected Personal Data Subjects, the relevant authority, and/or other parties within the applicable statutory periods where required by law.
12. CONTACT US
If you have any questions regarding this Privacy Policy, our processing of Personal Data, or wish to exercise your applicable rights, please contact us:
PT Aruna Global Trading
Address: Wisma Keiai, 14th Floor, Unit 1410, Jalan Jendral Sudirman, Kav. 3, Karet Tengsin, Tanah Abang, Central Jakarta, DKI Jakarta 10220
Email: info@arunatrade.com
Subject: Personal Data Protection Request
We will handle requests in accordance with applicable Indonesian data protection laws.
13. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our business, website, processing activities, or applicable laws.
The updated version will be published on our website with the revised “Last Updated” date.
Where required by applicable law, we will provide additional notice or obtain consent in connection with material changes.
14. GOVERNING LAW
This Privacy Policy is governed by the laws of the Republic of Indonesia, to the extent applicable to the relevant processing activities.