Date: 2025/12/15
This Addendum is intended to inform individuals, including those who are located within the jurisdiction of the Republic of Indonesia, Indonesian citizens located outside Indonesia, as well as any persons whose activities outside Indonesia produce legal consequences within Indonesia (collectively, “Indonesian Residents and Citizens”), regarding the Processing of their Personal Data in accordance with Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) and its implementing regulations as may be amended from time to time (“PDP Regulations”).
This Addendum supplements our Privacy Policy and prevails over any conflicting provisions in the Privacy Policy. Unless otherwise defined or the context otherwise requires, capitalized terms used in this Addendum shall have the meanings as set forth in the Privacy Policy.
1. Controller Identity and Contacts
In addition to Section 2 of the Privacy Policy, please see below our further details:
Controller Name: Sanrio Company, Ltd.
Business Description: E-commerce provider offering online retail services, product shipment, and related services from Japan to customers globally
Contact Information:
(a) address: 1-11-1, Osaki, Shinagawa-Ku, Tokyo 141-8603
(b) Tel: +81-3-3779-8163
(c) Email: sanrio-kojinhogo@sanrio.co.jp
For the avoidance of doubt, any reference in the Privacy Policy to Section 2 for contact information shall be deemed to refer to Section 1 of this Appendix for Indonesian Residents and Citizens.
2. Legal Basis of Processing
Further to our explanation in Sections 5 regarding the purpose of processing, we Process your Personal Data on the following legal grounds under the PDP Law:
· Consent: When you provide explicit consent (e.g., for marketing communications or cookie usage).
· Contract performance: When Processing is necessary to provide you with e-commerce services, shipping, and payment.
· Legal obligation: When required by applicable laws, including tax, accounting, and regulatory reporting.
· Legitimate interest: For fraud prevention, system maintenance, analytics, and protecting our business operations.
Where Processing involves Specific Personal Data (as defined in Article 4(2) of the PDP Law, including children’s data, financial data, etc.), we will ensure enhanced protection and rely on an appropriate legal basis under the PDP Law.
3. Categories and Relevance of Personal Data
We collect the following categories of Personal Data: identity and contact information, payment details, browsing history, IP addresses, account registration, transaction history, and other information necessary for account and service management. This data is relevant to the services we provide, e.g., payment details are necessary to Process your orders, and contact details are needed for shipping and account management.
4. Period of Processing, Retention, and Destruction
We will Process your Personal Data only for as long as necessary to fulfil the stated purposes under Section 5 of the Privacy Policy.
We will retain your Personal Data as detailed in Section 8 of the Privacy Policy. In any case, we will retain your Personal Data for at least 5 years or as otherwise required by Indonesian law.
Once the purpose is achieved or retention period expires, Personal Data will be securely destroyed or anonymized using methods that prevent further use.
5. Security Measures, Storage and Management of Personal Data
We store and manage Personal Data using secure servers located in accordance with our internal data management policies. In addition to the measures described in Section 10 of the Privacy Policy, we implement organizational and technical measures to secure your Personal Data required under Indonesian law, including encryption, access controls, employee training, and regular audits.
6. Consent and Withdrawal
Where Processing is based on your consent, you will be asked to provide clear and explicit consent before we Process your Personal Data. You may withdraw your consent at any time by contacting us at the details in Section 1 of this Addendum. Withdrawal does not affect the lawfulness of Processing carried out before withdrawal.
7. Your Rights under Indonesian Law
In addition to rights stated in Section 9 of the Privacy Policy, you also have the rights under the PDP Law, including to file a claim and receive compensation if there are any violations in how your Personal Data is Processed.
You may exercise your rights by contacting us using the details provided in Section 1 of this Addendum.
You may submit your request by email or postal mail. We may require you to verify your identity before Processing your request. Once a valid request is received, we will confirm receipt, review it, and provide a response or copy of your Personal Data within the period required under the PDP Law.
8. Language
This Privacy Notice, including this Addendum, will be made available in both Indonesian and English. In the event of any inconsistency, the Indonesian version shall prevail to the extent necessary to ensure valid consent under applicable law.