Personal Data Management Structure

Introduction

PT Ardindo (hereinafter referred to as "We") has prepared this Personal Data Management Structure document as a supplement to the Privacy Policy, to provide Users with transparency regarding the governance framework, organisational roles, processing flows, and access controls over Personal Data processed on the ardindo.com procurement platform.

This document is prepared in accordance with Law Number 27 of 2022 on Personal Data Protection, Government Regulation No. 71 of 2019 on the Organisation of Electronic Systems and Transactions, and LKPP Regulations applicable to the organisation of government procurement of goods/services electronically.

This structure applies to two service channels operated by the Platform:

• B2G — Government Procurement Channel: transactions between government institutions/agencies and verified Providers.
• B2B — Partner-to-Partner Channel: transactions between Partners/Providers on the procurement marketplace.

Article 1 — Definitions

• "Personal Data Controller"
  refers to PT Ardindo as the party that determines the purposes and means of processing Personal Data on the Platform.
• "Personal Data Processor"
  refers to a third party that processes Personal Data on behalf of and under the instructions of PT Ardindo.
• "Personal Data Protection Officer (DPO)"
  refers to the official appointed by PT Ardindo to oversee the Platform's compliance with the Personal Data Protection Law.
• "Data Subject"
  refers to an individual whose Personal Data is processed, including procurement officials (PPK, PP, KPA, Pokja), institutional representatives, and representatives of Providers/Partners.
• "B2G Channel"
  refers to the procurement transaction flow from government institutions to Providers through the Platform.
• "B2B Channel"
  refers to the transaction flow between two Partners/Providers on the Platform outside the context of institutional procurement.

Article 2 — Personal Data Protection Organisational Structure

PT Ardindo has established a multi-layered governance structure that ensures accountability in Personal Data processing at all levels of Platform operations:

Article 3 — Roles and Responsibilities (RACI Matrix)

The matrix below illustrates the division of roles in Personal Data processing activities on the Ardindo Platform:

Article 4 — Personal Data Classification

PT Ardindo classifies Personal Data in accordance with Article 4 of Law No. 27 of 2022, which distinguishes between General Personal Data and Specific Personal Data:

Article 5 — Data Management Flow: B2G Channel (Government Procurement)

Personal Data processing on the government institutional procurement channel follows the seven-stage flow below:

• 1
  Institutional & Official Registration

  Institutions register accounts providing: institution name, institutional tax number, appointment decree for PPK/PP/KPA, NIP, and official institutional email (government @*.go.id preferred).

  Processor: Verification & Onboarding Team · Legal basis: Consent + Contract Performance
• 2
  Official Identity Verification

  Verification of decree validity, NIP-to-position matching, and institutional email validation via email confirmation mechanism. Verification results are recorded in the audit log.
• 3
  General Procurement Plan (RUP) & Negotiation

  Procurement officials prepare the General Procurement Plan (RUP), select Providers, and conduct price negotiation through the encrypted chat feature. All negotiation conversations are stored for audit purposes.
• 4
  Checkout & Purchase Order Issuance

  The user completes the transaction, the system issues an electronic Purchase Order and assigns the vendor. Shipping data is shared on a limited basis with logistics partners.
• 5
  Payment

  Payment processing is conducted through certified banking partners (Bank BRI, Bank BJB, QRIS/VA partners). Account data is submitted directly to the bank and is not stored in the Platform's database.
• 6
  Handover Report (BAST) & Electronic Signature (TTE)

  After goods/services are received, the system issues a Handover Report (BAST) signed electronically through a certified TTE provider (BSrE/PrivyID).
• 7
  Reporting, Archiving & Audit

  All transaction documents are archived for a minimum of 10 (ten) years to comply with archiving and tax regulations. Archive access is restricted to auditors and relevant institutions.

Article 6 — Data Management Flow: B2B Channel (Partner-to-Partner)

On the B2B channel, the Platform facilitates transactions between Partners/Providers without involvement of government institutions. The data processing flow differs from the B2G channel in terms of verification and retention:

Article 7 — List of Personal Data Processors (Third Parties)

The list of Data Processor partners we use, along with the purposes and types of data processed:

Article 8 — Data Access Matrix (Role-Based Access Control)

Access to Personal Data is governed by the principles of least privilege and need-to-know:

Article 9 — Personal Data Lifecycle

Each piece of Personal Data follows a documented lifecycle from collection to destruction:

Article 10 — Monitoring and Audit

To ensure the effective implementation of this structure, PT Ardindo conducts:

• Quarterly internal audits by the DPO on access logs and team compliance.
• Annual external audits by certified independent auditors.
• Data Protection Impact Assessments (DPIA) for every new feature that may process Personal Data at scale.
• Penetration tests at least once per year by a third party.
• Management reviews by the Board of Directors on compliance reports each semester.

Article 11 — Training and Awareness

All personnel handling Personal Data are required to complete:

• Basic Personal Data Protection Law training during onboarding of new personnel.
• Annual refresher training on information security and data ethics.
• Incident response simulations at least twice a year.
• Signing of a Non-Disclosure Agreement as a condition of production access.

Article 12 — Review and Update of Structure

This document is reviewed at least once every 12 (twelve) months, or at any time when:

• Significant changes occur in relevant laws and regulations;
• New types of Platform services or features are added;
• A security incident requires changes to governance;
• Changes to the organisational structure of PT Ardindo occur.

Article 13 — Contact Us

For questions, clarifications, or reports regarding this Personal Data governance structure, please contact: