Privacy Notice – Intelligence Suite

1. Introduction

This Privacy Notice describes the policy of Intelligence Suite: AI Token Marketplace (“AI Token Marketplace” or “We”), which is managed and operated by PT Indosat Tbk (“IOH”), in handling the information and Personal Data of Users.

AI Token Marketplace is a business-to-business (B2B) platform that allows Corporate Customers to purchase and use AI model tokens across multiple AI Models through a single API Key, with budget controls that allows for pay-as-you-go pricing.

We respect and protects the personal data (“Personal Data”) and information of users of the platform and related services in accordance with the applicable laws and regulation in Indonesia.

This Privacy Notice sets out the basis and terms applicable to Personal Data processing activities, including the collection, use, storage, transfer, rectification, and deletion of Personal Data that is provided to AI Token Marketplace or collected by AI Token Marketplace when an Account is created for You, when You log in to the Platform, manage Team Members, API Keys, and budgets, or send requests to AI Models through the API (hereinafter referred to as the “Services”).

This Privacy Notice applies to all Users and prospective Users whose Personal Data is processed by AI Token Marketplace in connection with the use of the Platform and Services.

The commercial relationship between IOH and the Corporate Customer is governed by the agreement signed with the Corporate Customer. This Privacy Notice supplements those documents.

2. Definitions

In this Privacy Notice, unless otherwise stated in a separate section, the following terms shall have the following meanings:

“Account” means the registered profile of an Admin or Team Member used to access the Platform.
“Admin” means the individual appointed by the Corporate Customer and registered by IOH to manage the Corporate Customer’s Organisation on the Platform.
“AI Model” means an artificial intelligence model made available through the Platform, whether hosted by IOH or provided by a third-party AI model provider.
“API Key” means a secret key issued through the Platform that allows the Corporate Customer’s applications to send requests to AI Models.
“Corporate Customer” means a business entity that has signed an agreement with IOH to use AI Token Marketplace.
“Organisation” means the Corporate Customer’s account on the Platform, containing its Admin, Team Members, API Keys, and budgets.
“Personal Data Controller” means a party that determines the purpose and control of the processing of Personal Data. IOH acts as the Personal Data Controller for Personal Data processed under this Privacy Notice, unless expressly stated otherwise.
“Personal Data Processing” means one or a series of actions performed upon Personal Data, including collection, recording, storage, utilization, disclosure, and deletion.
“Personal Data Processor” means a party that processes Personal Data on behalf of and under the instructions of the Personal Data Controller.
“Personal Data” means any data concerning an identified or identifiable individual, either separately or in combination with other information, whether directly or indirectly through electronic and/or non-electronic systems.
“Platform” means the AI Token Marketplace website with all related services.
“Prompt Content” means the text, files, or other input sent to an AI Model through the API, and the response returned by the AI Model.
“Specific Personal Data” means certain Personal Data that requires greater protection, in accordance with the applicable laws and regulations (including but not limited to health data, biometric data, genetic data, criminal records, children’s data, certain financial data, and/or other data as determined by regulation).
“Team Member” means an individual invited by the Admin to access the Corporate Customer’s Organisation on the Platform.
“Usage Data” means records of Your use of the Services, such as the API Key used, the AI Model used, the number of tokens, the cost, and the time of the request.
“User” or “You” means an Admin or a Team Member.

3. Legal Basis for Personal Data Processing

AI Token Marketplace processes Your Personal Data based on one or more of the following legal bases:

Performance of the agreement between IOH and the Corporate Customer, including the AI Token Marketplace Terms and Conditions. This includes:
- Creating and managing the Corporate Customer’s Organisation and the Accounts of its Admin and Team Members;
- Authenticating Users and controlling access based on their role;
- Managing API Keys and applying budgets and limits;
- Processing requests sent to AI Models and returning responses;
- Recording Usage Data and issuing invoices to the Corporate Customer.
Compliance with IOH’s legal obligations under the applicable laws and regulations, including tax and financial record-keeping, and responding to court orders or other lawful legal processes.
Your valid and/or explicit consent, where required by the applicable laws and regulations.

IOH is the Personal Data Controller for all Personal Data collected and processed through the Platform.

If You have questions about or require further information regarding the legal basis for Us to collect and use Your Personal Data for any specific processing activity, please contact Us using the contact details provided in the “Contact Us” section below.

4. How Does AI Token Marketplace Collect Your Personal Data?

AI Token Marketplace does not offer self-registration. Your Personal Data is collected in the following ways:

Direct from the Corporate Customer, when the Corporate Customer signs an agreement with IOH and provides the details of its Admin and its billing information, which IOH enters into the Platform;
From the Admin, when the Admin invites You as a Team Member by entering Your name and email address;
From You, when You accept the email invitation, set Your password, update Your profile, or contact Our customer support;

Where Your Personal Data is provided by the Corporate Customer or the Admin, the Corporate Customer is responsible for ensuring that it has a lawful basis to provide that data to Us.

The Platform may use cookies, web beacons, or similar technologies to enhance user experience, analytics, security, as well as personalized marketing, in accordance with Your preferences and the applicable laws and regulations. Users may manage cookie preferences through browser/device settings.

5. What Personal Data Does AI Token Marketplace Collect?

The types of Personal Data collected by AI Token Marketplace include, but are not limited to:

Identity and Contact Information: Name and email address of the Admin and Team Members.
Account Credentials: Email address (login ID) and password, which You set through the email invitation and which is stored in hashed form.
Access Information: Your role (Admin or Team Member), the Organisation You belong to, and Your Account status.
API Key Information: API Key (stored in hashed form), key name, expiry date, and the budget and AI Model access assigned to it.
Usage Data: The API Key and User associated with each request, the AI Model used, the number of tokens, the cost, and the time of the request.

AI Token Marketplace does not require any Specific Personal Data to use the Services.

Prompt Content. Prompt Content is determined by the Corporate Customer and its applications. It is passed to the selected AI Model in real time to generate a response and is not stored by AI Token Marketplace. The Corporate Customer should not include Personal Data, and in particular Specific Personal Data, in Prompt Content unless it has a lawful basis to do so.

6. How Does AI Token Marketplace Use Your Personal Data?

6.1 To Provide the Services

To create and manage the Corporate Customer’s Organisation and the Accounts of its Admin and Team Members
To send email invitations and allow You to set Your password and activate Your Account
To authenticate You and control access based on Your role
To create, manage, and revoke API Keys, and to apply budgets and limits
To route requests to the selected AI Model and return the response
To show usage and cost to the Admin and Team Members
To provide customer support and resolve issues

6.2 To Communicate With You

To send service messages, such as invitations, account changes, API Key expiry, and budget notifications
To inform You of changes to the Services or this Privacy Notice

6.3 For Business Operations

To provide Usage Data to issue invoices to the Corporate Customer
To conduct internal audit, accounting, and reporting
To detect and prevent fraud, misuse of API Keys, and unauthorized access
To comply with legal and regulatory obligations

6.4 For Service Improvement

To use aggregated Usage Data to monitor service quality, capacity, and AI Model performance

AI Token Marketplace does not use Your Personal Data or Prompt Content for marketing profiling, and does not use Prompt Content to train AI Models.

Where permitted and where there is a lawful basis for processing, We share information about You with, among others:

The Admin of Your Organisation, who can see the name, email, and usage of Team Members in the same Organisation.
IOH internal functions, such as Finance, for invoicing, and customer support, for resolving Your requests.
AI model providers, only for Prompt Content sent to their AI Models (see Section 11).
Law enforcement authorities, government bodies, or regulatory agencies where required by law.
Other third parties with Your explicit consent.

AI Token Marketplace does not sell Your Personal Data and does not share it with third parties for their own marketing.

8. Law Enforcement, Fraud, and Security

AI Token Marketplace may disclose Personal Data where necessary to:

Protect AI Token Marketplace from fraud, misuse of API Keys, or unauthorized access;
Defend IOH’s rights and assets;
Fulfill obligations relating to national security or lawful requests from competent authorities.

Disclosure will only be made based on a compliance assessment and to the extent required or permitted by law.

9. Corporate Actions (Merger, Sale, or Restructuring)

In the event of a corporate action (including but not limited to merger, acquisition, business transfer, or restructuring) involving IOH, Personal Data may be transferred as part of such transaction in accordance with the applicable laws and regulations. We will ensure that such transfer is carried out in accordance with the applicable legal provisions and, where necessary, notify Users.

10. Third Parties Cooperating with IOH

Where IOH engages service providers or contractors to support the operation of the Platform or to provide services on Our behalf, and they may have access to Your Personal Data, We do not permit them to use or disclose Your Personal Data except in connection with the provision of their services to Us.

We collect and combine information to monitor the use of Your products and services, and those of Our other Users, and to help Us improve the quality of Our Services.

11. Third-Party AI Models Accessed Through the Platform

The Platform provides access to AI Models from two sources:

AI Models hosted by IOH, which process Prompt Content on IOH infrastructure in Indonesia.
AI Models provided by third-party AI model providers, which process Prompt Content on the provider’s infrastructure.

When a request is sent to an AI Model provided by a third-party AI model provider, the Prompt Content is transferred to that provider in real time so that the AI Model can generate a response. AI Token Marketplace does not store the Prompt Content. Third-party AI model providers process Prompt Content only to generate the response, in accordance with their agreements with IOH.

The Platform and its database are self-hosted and operated by IOH. Account information, Organisation and billing information, API Key information, and Usage Data are not shared with AI model providers.

12. Transfer of Personal Data Outside Indonesia

Account information, Organisation and billing information, API Key information, and Usage Data are stored on the Platform’s database, which is hosted and operated by IOH in a data centre in Indonesia.

Prompt Content sent to AI Models provided by third-party AI model providers may be processed outside Indonesia, depending on the provider’s infrastructure. For some providers, requests are routed to the location with available capacity, so the processing location may not be fixed.

Where AI Token Marketplace transfers Your information outside the jurisdiction of Indonesia, We will ensure that Your information is properly protected. We will always ensure that the country where the third party is based has a level of Personal Data protection that is equivalent to or higher than that of Indonesia, or that the third party receiving Your Personal Data has adequate and binding Personal Data protection standards, or at least obtain Your consent to transfer Your Personal Data.

13. Personal Data Security

AI Token Marketplace implements reasonable technical and organizational security measures to protect Your Personal Data.

AI Token Marketplace shall not be responsible for unauthorized access to or loss of Personal Data occurring due to circumstances beyond Our reasonable control, provided that We have implemented adequate security measures.

You are responsible for keeping Your password and API Keys confidential and not sharing them with others. The Admin is responsible for revoking API Keys and deactivating Team Members who no longer need access.

14. Automated Decision-Making and Profiling

AI Token Marketplace does not carry out profiling or automated decision-making that produces legal or similarly significant effects on You.

An automated decision is a decision concerning You that is made by a computer system without human review, where that decision has a legal or similarly significant effect on You.

The Platform automatically rejects requests when a budget or limit set by the Corporate Customer or the Admin has been reached. This is a spending control applied to the Organisation, Team Member, or API Key, and is not a decision about You as an individual.

15. Children

AI Token Marketplace is a business service provided to Corporate Customers and is not intended for individuals under 18 (eighteen) years of age. The Corporate Customer must not register or invite any person under 18 years of age as an Admin or Team Member. If We become aware that an Account belongs to a person under 18, We will take steps to deactivate the Account and delete the related Personal Data.

16. Retention of Personal Data

Such Personal Data may be stored in hard copy form or electronic format.

We may store Your data in data centers or warehouses managed either by Us or by service providers on Our behalf. All Our facilities, systems, and products have been equipped with the necessary security controls to ensure the protection of Personal Data.

The retention period may vary significantly based on the type of information and how it is used and Our retention period is based on criteria including legally required retention periods, pending or potential litigation, Our intellectual property or ownership rights, requirements under agreements/contracts, operational directives or needs, and historical archiving. When Personal Data is deleted from Our systems, such data will be erased or destroyed using appropriate security protocols so that it cannot be reconstructed or read.

IOH will retain Personal Data in accordance with the principle of storage limitation, namely only for as long as necessary for the processing purposes, or as required by the applicable laws and regulations, after which it will be securely deleted or destroyed.

17. Your Rights as a Data Subject

Below We explain details on how You may exercise Your rights. If You have questions or cannot find the answer, please contact Our customer service team.

We reserve the right to refuse Your request to access, rectify and/or delete, in whole or in part, Your Personal Data if permitted or required under the applicable laws and regulations, particularly if the request may:

endangering Your safety, physical or mental health and/or that of others; and/or
impacting the disclosure of another person’s Personal Data; and/or
conflicting with the interests of national defense and security; and/or
the grounds for the request are not relevant to You and/or to the Personal Data processing activities that We carry out.

You have the following rights in relation to Your Personal Data:

Right to Information: To know the identity of the Personal Data Controller, the legal basis, and the purpose of processing, as set out in this Privacy Notice.
Right of Access: To view Your profile and usage on the Platform, and to request a copy of the Personal Data that AI Token Marketplace holds about You.
Right to Rectification: To update or correct Your Personal Data. The Admin can edit their own profile and the details of Team Members on the Platform. Team Members may ask their Admin to update their data. Organisation and billing information is updated by IOH at the Customer’s request.
Right to Erasure: To request the deletion of Your Personal Data, subject to the retention period in Section 16 and Our legal obligations.
Right to Restrict Processing: To request that processing be suspended or limited. Deactivation of an Account stops access and the use of its API Keys.
Right to Object: To object to decisions based solely on automated processing that produce legal or similarly significant effects on You. AI Token Marketplace does not carry out such processing
Right to Data Portability: To obtain Your Personal Data in a structured and commonly used format, insofar as technically feasible.
Right to Compensation: To file a claim and receive compensation for violations in the processing of Your Personal Data, in accordance with the applicable laws and regulations.

To exercise these rights, please contact Us using the details in the “Contact Us” section. We will respond within the time periods required by the applicable laws and regulations.

18. Service and Marketing Communications

AI Token Marketplace sends service messages that are necessary to provide the Services, such as account invitations, account changes, API Key expiry, budget notifications, and invoices. These messages are part of the Services and cannot be switched off while Your Account is active.

If You no longer wish to receive marketing information, You may opt out at any time. If You have previously chosen to receive personalized content based on how and where You use Our network, You may also opt out at any time.

The method to opt out of marketing activities is by contacting Our customer service team and through other mechanisms that We provide from time to time.

If You choose to opt out, You may still receive service-related messages.

Please note that You may still receive promotional messages for up to 7 x 24 hours after opting out. This may be due to the time required for Us to update Our database.

You may also have received marketing information even though You are not a User or have never interacted with Us. This is the result of third-party lists that may be obtained by IOH from time to time, which state that You have given permission to be contacted by certain other parties.

If You have registered with Us to opt out of IOH marketing information, You should not receive such communications. If You continue to receive them, We request that You immediately notify Us by contacting Our customer service team. This will only stop marketing information from Us and will not stop third parties from sharing Your data unless You contact them directly.

19. How to Submit a Complaint

If You wish to exercise Your rights or submit a complaint regarding how We use Your Personal Data, please contact customer support through the official channels in the “Contact Us” section.

IOH will follow up on Your request within a reasonable period in accordance with the applicable laws and regulations.

20. Personal Data Protection Incidents

In the event of a Personal Data protection incident, AI Token Marketplace will handle the matter in accordance with IOH’s internal procedures and the applicable laws and regulations, including notifying affected Users, the Customer, and relevant authorities as required.

21. Governing Law

This Privacy Notice is governed by the laws of the Republic of Indonesia.

This Privacy Notice is made in the Indonesian and English languages. In the event of any inconsistency between the two versions, the Indonesian language version shall prevail and the English version shall be deemed amended to conform with the Indonesian language version.

22. Changes to This Privacy Notice

AI Token Marketplace may update this Privacy Notice at any time by publishing the updated version on the Platform.

Users are encouraged to review this Privacy Notice periodically. By continuing to access and use the Platform or Services after the changes are published, You acknowledge the updated Privacy Notice.

23. Acknowledgment

The Customer and the Admin warrant that all Personal Data they provide to AI Token Marketplace, including the Personal Data of Team Members and any Personal Data included in Prompt Content, has been obtained and provided based on a lawful basis in accordance with the applicable laws and regulations. Any consequences arising from the accuracy and validity of such data shall be the responsibility of the Customer.

By activating Your Account and using the Services, You acknowledge that You have read and understood this Privacy Notice and how Your Personal Data will be processed.

24. Contact Us

If You have any questions, concerns, or requests regarding this Privacy Notice or the processing of Your Personal Data, please contact AI Token Marketplace at:

AI Token Marketplace: AI Token Marketplace – PT Indosat Tbk

Email: support@intelligencesuite-ai.ioh.co.id

Website: intelligencesuite-ai.ioh.co.id

Address: Jl. Medan Merdeka Barat No. 21, Central Jakarta, Jakarta 10110, Indonesia.