PRIVACY POLICY

1 General Provisions

SonaMart ("We", "the Platform") is a marketplace service operated by PT Wibi Digital Technology. We recognize the importance of personal data and other information belonging to our service users ("User" or "You"), so that you can trust that SonaMart is transparent and accountable in the collection, use, and disclosure of your personal data in accordance with Law Number 27 of 2022 on Personal Data Protection ("PDP Law") and other related laws and regulations of Indonesia.

This Privacy Policy ("Policy") is drafted to give you a detailed picture of how We collect, use, store, manage, transfer, disclose, and/or protect your personal data (collectively, "Process") when you access and/or use the services, website, application, features, technology, content, and products We offer — including but not limited to SonaMart and its AI-powered chat feature (Sona AI) (collectively referred to as the "Service").

This Privacy Policy forms an integral part of SonaMart's Terms of Service and applies to all Users — whether as buyers or sellers — including but not limited to SonaMart's service providers, vendors, agents, partners, and contractors, unless otherwise governed by a different privacy policy. Please read this Policy carefully so you understand our approach and methods for collecting and using your personal data.

By visiting, registering for, accessing, and/or using the SonaMart Service, you represent and warrant that you — or your parent, guardian, and/or legal custodian if you are a minor under applicable law — have read, understood, and agreed to the approach and methods described in this Privacy Policy. You are under no obligation to provide us with any particular data; however, if you decline or withdraw consent for such data, we may be unable to provide certain features of SonaMart to you.

This Policy may be translated into foreign languages, including but not limited to English, to help you understand it. Where there is any inconsistency in meaning between the Indonesian-language version and any foreign-language version, the Indonesian-language version shall prevail and be legally binding.

2 Information We Collect

For clarity, We group the personal data We collect into three broad categories: (a) data you provide directly, (b) data automatically recorded when you use the Service, and (c) data We obtain from other sources. Please note that not all SonaMart Features collect all of the data listed below — the type of data requested will depend on the Feature you use.

a. Data You Provide Directly

• Account data: name, email address, phone/WhatsApp number, password (encrypted), profile photo, gender, and date of birth that you enter when registering or updating your Account profile.
• Transaction data: shipping address, shopping cart contents, vouchers used, notes/instructions to the seller, and other details you enter when placing an order.
• Payment data: proof of transfer and the payment method you select at checkout. SonaMart never stores your full payment card number — card data is processed directly by a licensed payment gateway provider (e.g. Xendit) that complies with industry security standards (PCI-DSS).
• Communication data: the content of conversations you send via a shop's WhatsApp chat, the AI-powered chat feature (Sona AI), or other SonaMart support channels — including any photo/document attachments you upload in those conversations.
• Return/refund evidence: photos or videos of the product you received, the reason for return, and other information you attach when filing a return, refund, or order complaint claim.
• Seller-specific data: shop name, shop description, bank account information for fund disbursement, business documents/licenses (where required for verification), and product data (name, photos, price, stock, description) that you upload.
• Third-party data you enter: for example, the name and address of a package recipient who is different from the Account holder. By entering such data, you warrant that you have obtained the consent of the individual concerned to share their data with Us.

b. Data Automatically Recorded

• Device technical data: IP address, device/browser type and version, operating system, and device identifiers used to access SonaMart.
• Activity data: login times, search history and product pages you view, and your interactions with SonaMart features (e.g. wishlisted products).
• Cookies and server log data: further explained in Section 9.
• Data synced from shop integrations: if, as a seller, you connect SonaMart to a third-party marketplace platform (e.g. Shopee, TikTok Shop), your product data and order status may be automatically synced both ways.

c. Data We Obtain from Other Sources

• Data from business partners or service providers that work with SonaMart, provided you have consented to that data being shared with Us.
• Data resulting from interactions with other users (buyers/sellers) as described in Section 4.
• Other data disclosed to you at the time it is obtained, to the extent relevant to the purposes set out in this Policy.

3 How We Use Your Information

We may use the Personal Data We have collected for the following purposes, including but not limited to:

• Processing your transactions — matching your order with the correct seller, confirming payment with the payment gateway, and forwarding shipping details to the courier so your package reaches your address.
• Operating the AI-powered chat feature (Sona AI) — understanding your questions, providing automated answers about products/orders, assisting with checkout via chat, and learning from conversation patterns in aggregate (without identifying individuals) to improve response quality over time.
• Verification and fraud prevention — matching the data you provide against suspicious transaction patterns, and reviewing evidence such as product photos, shipping records, and communication history when a return/refund dispute arises, to determine which party is entitled to the claim.
• Customer support — answering questions, following up on complaints, and acting as a mediator when an issue between a buyer and seller cannot be resolved by the two parties themselves.
• Notifications and communications — sending order status updates, promotions, and service updates via email, push notification, SMS, and/or WhatsApp. You may unsubscribe from promotional messages at any time via your Account settings, but transactional notifications (e.g. order confirmations) will continue to be sent while your Account is active, as they are necessary for the Service itself.
• Research and product development — analysing usage patterns in aggregate/anonymised form to identify which features need improvement or further development, including testing new features before a wider release.
• Legal compliance — fulfilling reporting or record-keeping obligations under applicable law, including anti-money laundering and counter-terrorism financing regulations where relevant to certain transaction values.
• Other purposes disclosed to you at the time of data collection, or any other purpose to the extent permitted by Applicable Law.

4 Your Interactions with Other Users

SonaMart is a platform that connects buyers and sellers, which means some of your data will be visible to your counterparty in a transaction. For example: when you buy a product, the seller will see your name, phone number, and shipping address so they can process and ship your order; conversely, as a seller, you can see the data of buyers who transact with your shop. In the product review feature, the name displayed publicly is generally partially masked by the system.

If you obtain another user's personal data through our platform — by any means, including but not limited to via chat, reviews, order history, or the shipping process — you agree to:

• use it solely for the purpose of the related transaction (e.g. packing and shipping goods) and not misuse it for other purposes, such as contacting the buyer/seller outside the context of the transaction or adding them to your own marketing list;
• not share or sell that data to any other party beyond what is needed to complete the relevant transaction;
• allow the user whose data you obtained to request that you delete such data from your records, for instance once the transaction is complete and there is no further business need to retain it; and
• comply with applicable personal data protection laws in respect of that data, including your own obligations as a party that also processes another individual's personal data.

We do not monitor or filter the entire content of conversations between users in real time, so you are responsible for the information you choose to share in chat with other users. Please exercise reasonable judgment before sharing sensitive data (e.g. identity numbers, financial data outside our official checkout system) with other users.

5 Who We Share Your Data With

We do not sell your personal data to any third party. Data is only shared to the extent reasonably necessary for your transaction to be processed, for the Service (including the Sona AI feature) to operate, or where required by law. We bind third parties that receive data to confidentiality and/or data processing agreements, and require them to implement adequate data protection standards. The parties who may receive your Personal Data include, but are not limited to:

Sellers who receive buyer data to process an order must use that data solely for the related transaction and are prohibited from misusing it for any other purpose — this obligation is further explained in Section 4 on interactions between users. We may also disclose aggregate data and statistics (which do not identify you individually) to prospective business partners or for market research purposes, but we will never share data that could personally identify you for such purposes without your consent.

6 Cross-Border Data Transfer

SonaMart currently focuses on serving Users in Indonesia. Nevertheless, for the purposes of providing and operating the Service — including but not limited to the use of cloud infrastructure, AI service providers (for the Sona AI feature), and payment gateway providers — your personal data may be transferred, stored, and/or processed on servers located outside the territory of Indonesia. Where such a cross-border transfer occurs, we will always endeavour to ensure that the recipient country or third party provides a level of data protection that is equivalent to, higher than, or at least adequate compared to that required under applicable Indonesian personal data protection laws.

7 Data Security & Breach Notification

We implement reasonable technical and organisational security measures to protect your Personal Data from unauthorised access, use, alteration, or disclosure, including but not limited to:

• SSL/TLS encryption on all data traffic between your device and SonaMart's servers.
• Storing passwords in hashed form (not plain text), so they cannot be read directly even by Our own personnel.
• Role-based access restrictions — only personnel who genuinely need access to perform their duties may view certain data.
• Regular system monitoring to detect suspicious activity or potential security vulnerabilities.

Nevertheless, no electronic system — whether the SonaMart website (including the mobile) or our official chat channels (shop WhatsApp and Sona AI) — is entirely free of risk. We encourage you to also help keep your data secure in the ways described in Section 11.

In the event of a personal data protection failure (data breach) that is purely within the control of our systems, We will promptly conduct an internal investigation to assess the impact and scope of the breach, take mitigation steps to stop or limit its impact, and provide written notice to you — including but not limited to via email and/or an in-app notification — and/or to the competent authorities, no later than 3x24 (three times twenty-four) hours from when We become aware of the failure, in accordance with applicable personal data protection laws and regulations.

8 Data Storage & Retention

We do not keep your Personal Data for longer than necessary. The retention period depends on the type of data and its purpose, including but not limited to:

• Account data: retained while your Account is active, and will be deleted or anonymised within a certain period after you request Account closure, unless a legal obligation requires longer retention.
• Transaction and payment data: retained in accordance with record-keeping/bookkeeping obligations under applicable law (e.g. tax regulations), even after your Account becomes inactive.
• Return, refund, or dispute evidence (product photos, shipping records, communication history): retained for as long as necessary to resolve the relevant claim, plus a reasonable additional period afterward to address any further objections.
• Communication/chat data (including with Sona AI): retained for as long as necessary for customer support purposes and service quality improvement.

Once such retention periods end and there is no further legal obligation to retain the data, it will be deleted or anonymised so that it can no longer be identified as belonging to you.

9 Cookies and Tracking Technologies

Cookies are small files stored in your browser or on your device to help SonaMart "remember" you on your next visit. We use several types of cookies, including but not limited to:

• Essential cookies: required for core features to work, such as keeping your login session active and remembering your shopping cart contents as you move between pages.
• Preference cookies: store your chosen settings, such as display language or your last-used search filters.
• Internal analytics cookies: help Us understand, in a general way, how the platform is used (e.g. most-visited pages) for the purpose of improving the Service. These cookies are not shared with third-party advertising networks.

The cookies We use are not used to personally identify you to third parties outside SonaMart. You may disable or delete cookies through your browser settings at any time; please note, however, that disabling essential cookies may cause certain SonaMart features (e.g. shopping cart, login status) to stop working properly.

10 Your Rights Over Personal Data

As a personal data subject, you have the following rights under the PDP Law, including but not limited to:

• Right of Access: to request confirmation and a copy of the Personal Data We hold about you, including an explanation of how it is processed.
• Right to Correction: to request correction of data that is inaccurate or outdated. For basic data such as your name or phone number, you can correct it yourself via the My Profile page.
• Right to Restrict Processing: to ask Us to stop or limit the use of your Personal Data for certain purposes, for example to stop receiving marketing notifications.
• Right to Erasure (Right to be Forgotten): to request deletion of your Account and Personal Data, to the extent this does not conflict with a legal obligation to retain data (for example, transaction history that is still subject to an ongoing dispute/mediation, or tax record-keeping obligations).
• Right to Data Portability: to request a copy of your Personal Data in a structured, commonly used format, for your own use or to transfer to another service provider.
• Right to Withdraw Consent: to withdraw consent previously given for the processing of certain Personal Data (e.g. for marketing purposes) at any time, without affecting the lawfulness of processing carried out before such withdrawal.

To exercise the rights above, please contact us using the details in Section 14. For your security, We will first request identity verification before processing such a request, and will endeavour to follow up within a reasonable time. We reserve the right to decline part of a request where there is a valid legal basis for doing so, and will explain our reasons to you.

11 Your Responsibilities

The security of your Personal Data also depends on steps you take yourself. You are responsible, including but not limited to, for:

• Choosing a strong, unique password (not reused from other services), and updating it periodically.
• Not sharing your password, One-Time Password (OTP) code, or account reset link with anyone, including anyone claiming to be SonaMart staff — We will never ask for your OTP or password by phone, chat, or email.
• Keeping secure the device you use to access SonaMart, for example by locking your screen and installing adequate security software.
• Logging out of your Account after you finish using SonaMart, especially on a device or network shared with others.
• Promptly contacting Us via the details in Section 14 if you suspect unauthorised access to your Account.

12 Third-Party Links

Our platform may contain links to third-party websites. If you follow such links, please note that those sites have their own privacy policies, and we are not responsible or liable for those policies. We encourage you to read the privacy policy of each site before providing your personal data.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect developments in the Service, new technology (including the development of the Sona AI feature), or applicable legal requirements. Any changes will be posted on this page along with their update date.

For material changes — for example, changes to the type of data collected, the purpose of use, or the third parties that receive data — We will notify you via email and/or an in-app notification, no later than 30 (thirty) business days before such changes take effect, or such other period as permitted by applicable law. You are encouraged to review such changes during this notice period.

Your continued use of SonaMart after a change takes effect will be deemed as your acceptance of the updated Privacy Policy.

14 Contact Us

If you have any questions, comments, complaints, or wish to exercise your rights over Personal Data as described in Section 10 (including requests for access, correction, or deletion of data), you may contact us at +62 815-8825-003. Please include your name, registered email/Account number, and a brief description of your request so we can follow up quickly after identity verification.