Last Updated: April 30, 2026

   Thank you for choosing to be part of our community provided and operated by PT Indodax Nasional Indonesia (“Indodax” or “We”), located in Indonesia. We are committed to protecting your Personal Data and fulfilling your rights as a Data Subject when you visit our website (https://indodax.com), use the applications we provide (“Applications”), and access the services we offer (“Services”). We appreciate the trust you place in us by knowingly providing your Personal Data and information to us.

   This Privacy Notice is prepared as part of Indodax’s commitment and compliance with applicable laws and regulations, and to provide you with clarity regarding the data we collect, how we use that data, and your rights. We encourage you to take the time to read this Privacy Notice carefully. If you do not agree with any provision of this Privacy Notice, you may discontinue using our Services. However, your rights as a Consumer will remain protected under applicable laws.

   This Privacy Notice applies to all Data collected through Indodax Services, including sales activities, marketing, and related events. This policy does not apply to Data you provide to third-party websites or applications that may be linked to our Website or Applications. We do not control and are not responsible for the privacy practices of such third parties, and we encourage you to review and understand their privacy notice before providing any Personal Data.

1.  APPLICABILITY

By using our Services, you acknowledge that you have read, are aware of, understand, and agree to the entire contents of this Privacy Notice, and that you are a legitimate and authorized party in providing all information and Personal Data submitted to us.

We may amend, remove, and/or update this Privacy Notice from time to time as necessary. Where such amendments, removals, and/or updates involve changes that are required to be notified to Users under Applicable Laws, we will use reasonable efforts to notify Users in advance through our official communication channels.

We encourage Users to read this Privacy Notice together with our General Terms and Conditions, as these documents may contain specific information regarding how we process your Personal Data in relation to certain Services.

The version of this Privacy Notice displayed on our website/application/electronic system constitutes the most updated version and supersedes all previous versions. Therefore, we encourage Users to review this Privacy Notice periodically.

This Privacy Notice forms an integral and inseparable part of Indodax’s General Terms and Conditions (“GTC”). In the event of any inconsistency between the GTC and this Privacy Notice, the provisions of the GTC shall prevail, provided that such provisions do not reduce the standards of Personal Data Protection as required under applicable laws and regulations.

2. NOTICE OF PERSONAL DATA PROTECTION 

• Subject to Law Number 27 of 2022 concerning Personal Data Protection (“UU PDP”), Indodax will use reasonable efforts to safeguard and protect your Personal Data.

• Personal Data is data about individuals that can be identified on its own or combined with other Data either directly or indirectly through electronic systems or non-electronic. 

• Indodax applies every step of security and strives to ensure Indodax’s system protects your Personal Data. Your Personal Data is behind a safety net and can be accessed by small employees with special access rights to such systems. However, no absolute security can be guaranteed. 

• Indodax may save Personal Data according to the Law of Personal Data and/or other regulations that occur; Indodax will delete or anonymize your Personal Data if Indodax reasonably determines that (i) the purpose of Personal Data that has been collected will no longer be fulfilled by retaining such Personal Data; (ii) the storage is no longer needed for legal or business purposes, and (iii) there is no warrant to legitimize making withdrawals of such Personal Data even further. If you stopped using the Indodax platform, or your authorization to use the Platform has been terminated or withdrawn, Indodax will keep, use, and or disclose your Personal Data according to the Privacy Notice and Indodax obligations based on the Act of Personal Data and any other related regulations. Complying with applicable laws, Indodax can securely delete your Personal Data without any previous notice.

3. DATA COLLECTION

In order to provide, implement, and enhance our Services, we collect your Personal Data through lawful means in accordance with applicable laws and regulations. The Personal Data we collect may be classified as follows:

A. Data You Provide to Us

We collect Personal Data that you provide directly to us for the purpose of using Indodax Services. The data we collect includes, but is not limited to

a. Identity Data, such as name, gender, profile picture, marital status, and date of birth;

b. Biometric Data, which relates to physical, physiological, or behavioral characteristics that enable the unique identification of an individual, such as facial images or fingerprint data. Biometric Data also reflects the unique characteristics of an individual that must be properly safeguarded, including but not limited to fingerprints, retinal data, and/or facial recognition data;

c. Contact Data, such as mailing address, email address, and telephone number;

d. Account Data, such as bank account details and payment information;

e. Transaction Data, such as order details, crypto asset purchase information, and your transaction history when using the Indodax platform;

f. Technical Data, such as Internet Protocol (IP) address, login data, browser type and version, time zone settings, browser plug-in types and versions, operating system and platform, device identifiers, and other information related to the device used to access the Indodax platform;

g. Profile Data, such as username and password, purchases, orders, preferences, and responses to feedback and surveys;

h. Usage Data, such as information about how you use the Indodax platform, products, and Services;

i. Location Data, which may be collected when you choose to share your location with Indodax, for example through photos or videos uploaded to the platform;

j. Liveness Detection, which is an Artificial Intelligence (AI)-based technology used for biometric verification and authentication (such as fingerprints, iris recognition, or facial structure). The results of Liveness Detection are used solely for verification and authentication purposes and, in its implementation, may involve limited third-party service providers to support biometric authentication functions, under the control and instruction of Indodax and in accordance with applicable laws and regulations;

k. Marketing and Communication Data, relating to your preferences in receiving marketing communications from Indodax and third parties, as well as your communication preferences.

Note: You are required to provide accurate and up-to-date Data to Indodax. Indodax reserves the right to request additional documentation to verify the Data you have provided.

B. Data We Collect Automatically When You Interact with Us

When you access or use our website or conduct business transactions with us, we automatically collect certain Data, including:

a. Transaction Data

When you conduct purchase or sale activities, we collect information related to such transactions, including product details, purchase prices, and transaction date and location;

b. Device and Usage Data

Information about the device and network you use, such as hardware model, operating system version, mobile network, IP address, unique device identifiers, browser type, and application version. We also collect information about your activity, such as access times, pages viewed, links clicked, and referring pages prior to accessing our Website or Application. This data is not used for profiling without your consent;

c. Location Data

Subject to your device permissions, we may collect your device location data. You may disable location data collection at any time through your device settings. Disabling location access will not affect access to core services but may limit certain features that require location data;

d. Data Collected via Cookies and Similar Tracking Technologies

We (and our service providers) use cookies and similar technologies to enhance our Services, understand usage patterns, and measure the number of visits. Cookies do not directly store Personal Data but may be associated with other Data that can identify you. Therefore, we treat such data in accordance with Personal Data protection standards. You may manage your cookie preferences through your browser or device settings, including rejecting certain cookies.

C. Data We Collect from Other Sources

In certain circumstances, we may obtain Data from third-party service providers that support specific functions, including but not limited to infrastructure services, analytics, system security, and identity verification support functions such as biometric authentication (liveness detection).

4. HOW DO WE COLLECT YOUR DATA?

We collect Personal Data lawfully when you:

a. Register for an account online through the system we provide.

b. Use, access, and interact with the services we provide.

c. Enter into any form of agreement with us.

d. Grant permission on your device to provide information to us through the application.

e. Contact us via telephone, face-to-face meetings, social media platforms, email, or other communication channels;

f. Voluntarily complete customer surveys or provide feedback through our message forums or via email; 

g. Use or access our website through your browser cookies;

h. Obtain data about you from legitimate third-party sources, including but not limited to service providers that are used on a limited basis to support the security and reliability of identity verification processes, as well as data analytics providers. 

5.  BASIS FOR PERSONAL DATA PROCESSING 

We will only process Personal Data by fulfilling one or more of the bases for processing as mandated by Law Number 27 of 2022 concerning Personal Data Protection, as follows: 

a. Your explicit and valid consent;

b. Fulfilling the obligations of the agreement between us and You;

c. To fulfill legal obligations under applicable laws and regulations;

d. To fulfill your vital interests;

e. To carry out the fulfillment of public interests or our authority based on laws and regulations;

f. To fulfill other legitimate interests while still considering the objectives, needs, and balance between us and You.

6. PERSONAL DATA WE PROCESS

We process Personal Data that you provide to us as well as Personal Data that we obtain in connection with the provision and operation of Indodax Services.
The Personal Data we process includes the types of Personal Data collected as described in more detail in Section 3 (Data Collection) of this Privacy Notice, to the extent relevant and necessary for the purposes of processing.

In general, the Personal Data we process may include:

• Your identity and profile information; 

• Your contact and communication information; 

• Information related to your activities and transactions when using the services; 

• Technical data, device information, and system usage data; and/or 

• Data used to support verification and authentication processes, including biometric authentication (liveness detection), where necessary. 

In certain circumstances, the processing of Personal Data may involve specific categories of Personal Data, provided that such processing is carried out in a limited and proportionate manner and in accordance with applicable laws and regulations.
We process your Personal Data only to the extent necessary to achieve the purposes of processing as described in this Privacy Notice.

7. PURPOSE OF PERSONAL DATA PROCESSING

By using our Services, you consent to the processing of your Personal Data as described in this Privacy Notice. We process your Personal Data to provide, manage, and improve our Services, as well as to comply with applicable legal and regulatory obligations.

We only process and disclose your Personal Data to the extent necessary for these purposes, including where required by law, based on your consent, or to perform and enforce our contractual obligations.

Any processing of your Personal Data as set out in Section 3 is carried out by us for one or more of the following purposes:

a. To provide, maintain, and improve our products and services;
b. To process transactions and send related information, including confirmations, invoices, and notifications;
c. To verify user identity through Indodax’s internal systems, along with supporting mechanisms necessary to ensure the accuracy and security of the verification process;
d. To execute agreements between you and Indodax;
e. To improve your experience in using our services;
f. To send technical notifications, security alerts, and support messages;
g. To provide services and respond to your inquiries;
h. To communicate with you about products, programs, or events available on Indodax, including providing news and marketing information that we believe will be of interest to you;
i. To monitor and analyze usage trends to maintain service quality;
j. Facilitating contests, promotions, or loyalty programs in a transparent manner;
k. Detecting, investigating, and preventing fraud, illegal activities, or security breaches;
l. Performing system maintenance and fixing errors in our system;
m. Fulfilling applicable legal and regulatory obligations;
n. Other legitimate purposes that are clearly communicated to you at the time of data collection.

8. DATA DISCLOSURE

We may disclose your Personal Data in the following circumstances or as otherwise described in this policy.
In disclosing your Personal Data, we ensure that your Personal Data is not sold, disclosed, transferred, distributed, or lent to any third party without your consent, except in the following circumstances:

• Third-Party Service Providers We may engage third-party service providers to perform certain functions on our behalf, including but not limited to the provision of technology infrastructure, analytics, system security, and functions supporting identity verification such as biometric authentication (liveness detection). Such third parties will only process Personal Data to the extent necessary to perform their functions, under the instruction of Indodax, and are not permitted to use such Personal Data for any other purposes. 

• Operational Partner We may share data that personally identifies you (excluding biometric data) with authorized operational partners (such as banking institutions and payment service providers) solely for the purpose of supporting Indodax Services.
  We will not share your Personal Data with business partners for marketing purposes without your explicit consent.

• Sale, Assignment, or Change of Control We may change our ownership or corporate structure in the course of providing our Services. We may transfer some or all of your Data in connection with, or during negotiations of, any merger, acquisition, sale of assets, business line, change of ownership control, or financing transaction.

  In such circumstances, we will request the acquiring party to adhere to the practices described in this Privacy Notice with respect to previously collected Data. However, we cannot guarantee that the acquiring party or merged entity will have the same privacy practices or treat your Data in the same manner as described in this Privacy Notice.

• Law Enforcement, Legal Process, and Emergency Situations We may use or disclose your Data if required to do so under applicable law or based on a good faith belief that such action is necessary to:

     a) comply with applicable laws or legal processes served on us or our Website;
     b) protect and defend our rights, property, or the Website, or our users;
     c) respond to claims that you have violated third-party intellectual property rights; or
     d) protect the personal safety of us, our users, or the public.

• Public Areas and Interactive Features Please be aware that any Data you share in public areas, including your public profile or social sharing features, becomes publicly accessible and may be used by anyone. Please exercise caution and avoid posting Data that you wish to keep confidential. We do not control who may view Data you post in public areas of the Website or on third-party messaging platforms (such as Discord), and we are not responsible for how third parties, including other users, may use or disclose such Data. If you are under eighteen years of age or are married and a registered user, you may request removal of content or Data you have posted from public display by deleting it yourself or contacting the community manager.

• At Your Direction Our Website and/or Applications may allow you to share certain Data with other users or third parties. By using these features, you authorize us to share your Data. Once shared, we no longer have control over how such third parties use or further disclose your Data.

Note: Except as described in this policy, We do not sell, rent, or trade your Personal Data to any party. Disclosure of Personal Data is carried out only to the extent necessary in accordance with this Privacy Notice and applicable laws and regulations.

9. DISCLAIMERS ABOUT SAFETY AND THIRD-PARTY SITES

In order to provide Services to you, Indodax may select various third-party websites to link to and frame within the Platform. Indodax may also participate in co-branding and other partnerships to offer e-commerce and other services and features to Indodax visitors. All of these linked sites have their own independent privacy policies and security settings. In fact, even if a third party is affiliated with Indodax, Indodax has no control over these linked sites; each has its own privacy and data collection practices that are separate from Indodax. Data collected by Indodax’s co-branding partners or third-party websites (even if offered on or through the Indodax Platform) may not be received by Indodax; 

Indodax does not control and is not responsible for the content, security, or data processing practices of such third-party websites. Any Data collected by co-branded partners or third-party websites (including those accessible through the Indodax platform) may not be received or controlled by Indodax. Accordingly, your access to such third-party websites is at your own risk. However, Indodax strives to maintain the integrity of its platform and welcomes any feedback regarding third-party links, including if any such links are not functioning properly (including, but not limited to, instances where a specific link does not work).

10. MARKETING

You have the right at any time to stop us from contacting you for marketing purposes or providing your data to other members of the Indodax Group. If you no longer wish to be contacted for marketing purposes, please contact us.

11. USER RIGHTS

You have rights as a Personal Data Subject over your respective Personal Data (hereinafter referred to as “Personal Data Subject Rights”) in accordance with the PDP Law and policies that we establish from time to time regarding the legal basis and processing of Personal Data. In this case, you have the right to:

a. Obtain information about the identity, legal interests, purposes of processing, and our responsibilities regarding your Personal Data that we process
b. Complete, update, and/or correct errors and/or inaccuracies in your Personal Data in accordance with the purposes of processing your Personal Data that we process
c. Obtain access to and obtain a copy of your Personal Data that we process in accordance with the provisions of laws and regulations
d. Terminate the processing, delete, and/or destroy your Personal Data in accordance with the provisions of laws and regulations
e. Withdraw your consent to the processing of your Personal Data 
f. Object to automated decision-making based solely on the processing of your Personal Data
g. Suspend or restrict the processing of Personal Data in a manner proportionate to the purposes of processing your Personal Data
h. Seek compensation in the event of a breach
i. Obtain and/or use your Personal Data.

We can accommodate requests to fulfill Personal Data Subject Rights as described above, unless we believe that such fulfillment could potentially violate laws and regulations, violate legal provisions, or cause information to become inaccurate.

12. DATA ON CHILDREN

Our Services are not intended for children under the age of 17. Indodax does not collect or save Personal Data or non-Personal Data from anyone under the age of 17, and part of the platform or any Indodax services is not aimed at anyone under the age of 17. As for parents or legitimate legal guardians, please do not permit your children to give their Personal Data to Indodax. If Personal Data of a child under the age of 17 is disclosed to Indodax, the parent or legal guardian is deemed to have consented to the processing of such Personal Data and agrees to be bound by this Privacy Notice on behalf of the child. Indodax will close every account that has been used exclusively by the children and close and/ or delete any Personal Data that Indodax believes has been delivered but not been approved by their parents or legitimate legal guardian of those children under 17 years old.

13. HOW WE STORE YOUR DATA

• We store your Personal Data securely, including on third-party systems used by Indodax in accordance with operational needs, including for the purposes of data backup, disaster recovery, and business continuity. We will retain your Personal Data for as long as necessary to fulfill the purposes of processing while you continue to use our Services. After such period has ended, we will delete your Personal Data. To protect your Personal Data, we implement internationally recognized Information Security Management System standards, including ISO 27001:2022, to ensure the confidentiality, integrity, and availability of Personal Data through appropriate controls and mitigation measures.

• Your Personal Data may be stored, transferred, and/or processed by third-party service providers engaged by Indodax. Indodax will use reasonable efforts to ensure that all such third-party service providers implement a level of data protection that is equivalent to or higher than the standards adopted by Indodax under this Privacy Notice. 

• Your Personal Data may be stored and processed outside of Indodax’s home country (Indonesia) or by third-party providers, vendors, suppliers, partners, contractors, or affiliated with Indodax. In such cases, Indodax will ensure that such Personal Data is subject to a level of protection that is equivalent to or higher than that required under applicable laws and regulations.

• Indodax will retain and process Personal Data if your account is active and/or if it is required by applicable laws and regulations.

We are committed to continuously improving the security of your Personal Data by adopting appropriate technologies and complying with applicable laws and regulations. We also treat the protection of your Personal Data as a top priority by applying high security standards.

14. WHAT ARE COOKIES?

Cookies are text files stored on your computer to collect standard Internet log information and visitor behavior information. When you visit our website, we may automatically collect information from you through cookies or similar technologies. For more information, please visit allaboutcookies.org.

15. HOW DO WE USE COOKIES?

Cookies are small text files placed on your device when you visit our site that enable our site's features and functions. Cookies allow us to recognize your device(s) and store certain information about your preferences or previous actions. To run the features of our service as we offer them, we use Functional Cookies, Analytics Cookies, and Advertising Cookies.

a. Functional Cookies: These cookies are necessary for our services to function. They enable core functions such as security, network management, and accessibility. Without these cookies, certain features on our site may not work properly.

b. Analytics Cookies: These cookies help us understand how visitors interact with our site by collecting and reporting visitor behavior on our site. These cookies enable us to measure and improve the performance of our website, ensuring a better user experiencec.

c. Advertisement Cookies: These cookies track your online activity and enable us to provide relevant advertising content based on your interests. These cookies help us measure the effectiveness of our advertising campaigns and limit the number of times you see an ad.

16. COOKIES WE USE

To run our services properly, we use cookies and functions as listed in the following table.

17. YOUR COOKIES SETTINGS

You can set your browser to not accept cookies. However, in some cases, certain features of the services we provide may not function properly as a result.  

18. OTHER WEBSITES PRIVACY NOTICE

This Privacy Notice applies only to websites and applications provided directly by us. If you visit a website outside of these two, you are advised to read and understand the privacy notice again.

19. CHANGES TO THE PRIVACY NOTICE

This Privacy Notice may be updated in accordance with our services, practices, and applicable laws. In the event of changes, We will publish them directly on Our Privacy Notice page and notify you via email and notifications in the Indodax Application. We encourage you to review this Privacy Notice periodically to stay informed about how Indodax protects and processes your Personal Data.

20. CONTACT US

You may contact us if you have any questions or concerns regarding this Privacy Notice and the processing of your Personal Data by contacting us via email at: dpo@indodax.com.