Privacy Policy

Effective date: 1 September 2026

Version: 1.0

Last updated: 1 September 2026

This Policy is published in English, Bahasa Indonesia and Simplified Chinese. In the event of any inconsistency, the English version prevails, save where mandatory local law requires otherwise (see clause 20).

1. What is the scope of this Policy?

1.1 This Privacy Policy ("Policy") explains how the Bliink group of companies ("Bliink", "we", "us", "our") collects, uses, discloses, transfers, stores and otherwise processes personal data.

1.2 This Policy applies to personal data processed in connection with:

(a) our websites, including bliink.id and bliink.sg and any subdomain (the "Website");

(b) the Bliink platform, web application and mobile applications (the "Platform");

(c) our AI corporate concierge service delivered through the Platform, email, WhatsApp, or any other messaging or voice channel we make available (the "Concierge");

(d) the arrangement, booking, servicing, amendment and cancellation of travel and travel-related products (the "Travel Services");

(e) our corporate customers' administration of their travel programmes, including policy configuration, approvals, reporting and payment; and

(f) our marketing, events, recruitment, supplier management and general business operations,

(together, the "Services").

1.3 Who this Policy is about. This Policy addresses the personal data of: (a) travellers and travel arrangers of our corporate customers; (b) individual representatives of our corporate customers, suppliers and partners; (c) visitors to the Website; (d) job applicants; and (e) any other individual whose personal data we process in connection with the Services.

1.4 What this Policy is not. This Policy is a transparency notice. It does not form part of any contract between Bliink and a corporate customer, and does not vary the Master Services Agreement or any Data Processing Addendum agreed with that customer. Where a Data Processing Addendum is in place and conflicts with this Policy in respect of personal data processed on that customer's instructions, the Data Processing Addendum prevails.

1.5 Our privacy practices vary as they must between the countries in which we operate, in order to reflect local legal requirements. Country-specific provisions are set out in the Annexes, which form part of this Policy.

2. Who is responsible for your personal data?

2.1 The Bliink entity responsible for your personal data ("controller", or "pengendali data pribadi" under Indonesian law) depends on which entity you contract with or which entity's Services you use:

2.2 Where we act for our corporate customers. For much of what we do, your employer or the organisation arranging your travel (the "Customer") determines why and how your personal data is processed. In those circumstances the Customer is the controller and Bliink acts as a data intermediary (Singapore) or data processor ("prosesor data pribadi", Indonesia). This includes processing travel policy configuration, approval workflows, booking records held in the Customer's account, spend and compliance reporting, and personalisation of recommendations within the Customer's account.

2.3 Where we act on our own account. Bliink acts as controller in respect of: account registration and authentication; billing, credit assessment and collections; fraud prevention and platform security; supplier relationship management; our own marketing to business contacts; product analytics on de-identified and aggregated data; recruitment; and compliance with our own legal obligations.

2.4 If you are unsure which entity or which role applies, contact us using the details in clause 18 and we will tell you.

3. What personal data does Bliink collect?

3.1 We collect the following categories of personal data. Not every category applies to every individual.

(a) Identity and contact data. Full name as it appears on travel documents, preferred name, salutation, gender where required by a supplier, date of birth, nationality, work and (where you provide it) personal email address, work and mobile telephone number, work address, and emergency contact details.

(b) Employment and organisational data. Employer, job title, department, cost centre, employee or staff number, internal approval hierarchy, entitlements under your employer's travel policy, and reporting-line information provided by the Customer.

(c) Travel document data. Passport number, place and date of issue and expiry, issuing country, passport image where you upload one, visa and permit details, national identity card details where a supplier or destination requires them, and known-traveller, redress or border-clearance identifiers.

(d) Booking and itinerary data. Origin and destination, dates and times of travel, flight, rail, ferry, hotel, car and transfer bookings, passenger name record (PNR) and booking reference, seat, class and cabin, fare basis and rules, ancillary purchases, hotel room type and rate, check-in and check-out dates, loyalty programme numbers and tier, and trip purpose and cost allocation.

(e) Preference data. Airline, hotel, cabin, seat, room, amenity, meal and ground-transport preferences; preferred departure windows; historical selections used to improve recommendations; and preferences your Customer has configured on your behalf.

(f) Payment and financial data. Payment card details (in tokenised form where processed by our payment providers), virtual card and lodged card identifiers, billing address, invoice and settlement records, credit limits and credit history relating to the Customer, and refund and chargeback records.

(g) Communications data. The content of and metadata about your interactions with the Concierge, including messages exchanged by chat, WhatsApp, email or in-app messaging; call recordings and transcripts where we tell you a call is recorded; support tickets; and feedback and survey responses.

(h) Technical and usage data. IP address, device identifiers, device and browser type and settings, operating system, language settings, referring and exit URLs, pages and features viewed, session duration, clickstream, crash logs, and cookie and similar identifiers (see clause 14 and our Cookie Policy).

(i) Location data. Approximate location derived from IP address; the itinerary-derived location used for traveller-tracking and duty-of-care purposes; and, only where you have separately enabled it on your device, more precise device location.

(j) Sensitive personal data. We process the following only where necessary and subject to clause 3.2:

• health, mobility, accessibility and assistance requirements, where you or your Customer tell us in order that we can arrange suitable travel;

• dietary requirements, which may reveal religious or philosophical belief or health information;

• data relating to a disability, where required to arrange assistance;

• in limited cases required by a destination or supplier, vaccination or medical clearance information;

• biometric data contained in a passport image where you upload one; and

• financial data, which is treated as specific personal data under Indonesian law.

3.2 How we treat sensitive personal data. We collect sensitive personal data only where (a) you have given us explicit consent; (b) it is necessary to perform the travel arrangements you or your Customer have requested; (c) it is necessary to protect your vital interests or those of another person; or (d) applicable law otherwise permits or requires it. Under Indonesian law, the categories at clause 3.1(j) constitute "specific personal data" (data pribadi yang bersifat spesifik) and attract heightened protection under Article 4(2) of Law No. 27 of 2022. Please do not give us sensitive personal data we have not asked for.

3.3 Personal data about others. If you give us personal data about another person — for example a travelling colleague, an emergency contact, or a guest — you confirm that you are authorised to do so and that you have brought this Policy to that person's attention.

3.4 Children. The Services are designed for corporate travel and are not directed at children. We do not knowingly collect personal data from individuals under 18 years of age other than where a Customer books travel for a minor accompanying a business traveller, in which case we process the minimum data necessary and rely on the consent of the parent or legal guardian, as required by Article 25 of Law No. 27 of 2022. If you believe we hold a child's personal data without an appropriate basis, contact us under clause 18 and we will delete it.

4. How does Bliink collect personal data?

4.1 Directly from you — when you register, complete or update a traveller profile, make or request a booking, interact with the Concierge, upload a document, respond to a survey, attend an event, apply for a role, or otherwise communicate with us.

4.2 From your Customer — most commonly, your employer provides your profile, employment and policy data when it onboards its travel programme, and updates it thereafter. Your employer is responsible for having a lawful basis for that disclosure and for notifying you of it.

4.3 From suppliers and industry sources — airlines, hotels, car rental companies, ground transport providers, global distribution systems, consolidators, aggregators, bed banks, destination management companies and loyalty programme operators, in the course of making and servicing bookings.

4.4 From payment and financial service providers — payment gateways, card networks, virtual card issuers, banks and credit reference agencies, in connection with payment processing and credit assessment.

4.5 Automatically — through cookies, SDKs, log files, pixels and similar technologies when you use the Website or Platform. See clause 14 and our Cookie Policy.

4.6 From public and third-party sources — publicly available business directories, professional networking sites, business information providers, sanctions and politically-exposed-person screening databases, and government travel advisories, for the purposes described in clause 5.

5. How does Bliink use personal data, and on what legal basis?

5.1 We use personal data for the purposes set out below. The right-hand columns state the legal basis on which we rely under the Singapore Personal Data Protection Act 2012 ("PDPA") and Indonesian Law No. 27 of 2022 on Personal Data Protection ("UU PDP") respectively.

5.2 Where we rely on consent, you may withdraw it at any time under clause 16. Withdrawal does not affect the lawfulness of processing before withdrawal, and may mean we can no longer provide part or all of the Services to you.

5.3 Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights. You may request a summary of that assessment under clause 18.

6. How does Bliink use artificial intelligence, and what does it mean for you?

This clause is central to how the Concierge works and we set it out plainly.

6.1 What the Concierge does. The Concierge uses machine learning and large language models to interpret travel requests, understand trip intent, apply your Customer's travel policy, rank options, draft communications, and prepare bookings for confirmation.

6.2 Personalisation is confined to your Customer's account. We personalise recommendations for you using data held within your Customer's own account — your profile, your preferences, your Customer's policy, and your Customer's booking history. We do not use one Customer's personal data to personalise, train or improve the Service for any other Customer.

6.3 We do not train foundation models on your personal data. We do not use your personal data to train, fine-tune or otherwise develop general-purpose or foundation AI models, whether ours or a third party's.

6.3.1 Which AI providers we use. The Concierge is served by the enterprise application programming interfaces of Google (Gemini) and OpenAI. We use these providers under commercial terms that prohibit them from using our inputs or outputs to train or improve their models, and that limit retention to the period necessary to return a response and to meet the provider's own abuse-monitoring obligations. We use paid enterprise interfaces only; personal data is never submitted to a consumer or free-tier AI service.

6.3.2 Models we do not send your personal data to. We evaluate and use other models — including open-weight and third-country models — for internal engineering, testing and workloads that involve no personal data. Personal data is not sent to any AI provider other than those named in clause 6.3.1. In particular, we do not transmit personal data to AI services operated from the People's Republic of China.

6.3.3 If we add or change a named AI provider, we will update this clause and, where the change is material, give notice in accordance with clause 17.

6.4 Platform improvement uses de-identified and aggregated data only. We improve the Platform using data that has been de-identified or aggregated so that it no longer identifies you or your Customer, and we do not attempt to re-identify it. Under UU PDP, anonymised data falls outside the definition of personal data; under the PDPA, we apply the PDPC's anonymisation guidance.

6.5 Automated decision-making. The Concierge produces recommendations, applies policy rules, and flags out-of-policy requests. Bookings that are out of policy, exceed a threshold set by your Customer, or require approval are routed to a human approver at your Customer. We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. Where automated processing materially informs an outcome that affects you, you may request human review and an explanation under clause 16.

6.6 Accuracy. AI-generated output can be wrong. Confirmations, fare rules, visa requirements and supplier terms are authoritative only when confirmed by the relevant supplier or by a Bliink consultant. Always check your travel documents on receipt.

6.7 Human access. Bliink personnel may review Concierge conversations for quality assurance, troubleshooting, training of our own staff, and safety. Access is role-based, logged, and limited to what is necessary.

7. Who does Bliink disclose personal data to, and why?

7.1 We disclose personal data to the following categories of recipient:

(a) Bliink group companies — our affiliates listed in clause 2.1 and any future affiliate, for the purposes in clause 5, under intra-group data transfer arrangements;

(b) Your Customer — your employer or the organisation arranging your travel receives your booking, itinerary, spend, policy-compliance and exception data. If you book travel through your employer's programme, assume your employer can see it;

(c) Travel suppliers — airlines, hotels, rail and ferry operators, car rental and ground transport companies, cruise lines, tour and activity operators, and destination management companies, in order to make and service your booking;

(d) Travel distribution intermediaries — global distribution systems, aggregators, consolidators, bed banks, wholesalers, mid-office and quality-control providers, and ticketing agents;

(e) Payment and financial providers — payment gateways, card acquirers and networks, virtual card issuers, banks, credit reference and credit insurance providers, and collections agents;

(f) Technology and operational service providers — cloud hosting, AI and machine learning service providers, communications and messaging platforms (including WhatsApp Business), customer relationship management, ticketing and support tools, analytics, security, identity and access management, email delivery and e-signature providers. A description by category is at Annex D;

(g) Insurers, assistance and medical providers — where travel insurance, medical assistance or emergency evacuation is arranged;

(h) Professional advisers — lawyers, auditors, accountants, insurers and consultants, under duties of confidentiality;

(i) Government, regulatory and law-enforcement authorities — including immigration and border-control agencies (which may require Advance Passenger Information and Passenger Name Record data as a condition of entry), tax authorities, tourism regulators, the Personal Data Protection Commission of Singapore, and the Indonesian data protection authority once established, where required or permitted by law;

(j) Acquirers and investors — in connection with an actual or proposed merger, acquisition, financing, reorganisation or sale of assets, subject to confidentiality; and

(k) Any other recipient — with your consent or at your direction.

7.2 We do not sell personal data. We do not sell personal data, and we do not disclose personal data to third parties for their own independent marketing purposes.

7.3 Supplier terms apply. Once your personal data is passed to a travel supplier in order to fulfil a booking, that supplier processes it as a controller under its own privacy notice and the laws of the country in which it operates. We are not responsible for a supplier's handling of your personal data, and we cannot ensure that an overseas supplier will observe Singapore or Indonesian data protection standards.

8. Does Bliink transfer personal data across borders?

8.1 Yes — necessarily. Arranging international travel requires disclosing personal data to suppliers, authorities and service providers in the countries you travel to and through, and in countries where our service providers operate. Those countries may not provide a level of protection comparable to Singapore or Indonesia.

8.2 Where we host data. The Platform and its primary data stores are hosted in Singapore, in the SGP1 region of DigitalOcean. Backups and disaster-recovery copies are held in the same Singapore region — personal data does not leave Singapore at rest. Bliink does not commit to storing personal data within Indonesia, and Indonesian personal data is therefore transferred to and processed in Singapore, and disclosed to the recipients described in clause 7 and Annex D.

8.3 Safeguards we apply. Before transferring personal data outside Singapore or Indonesia, we take reasonable steps to ensure the recipient is bound to a standard of protection comparable to that required by the PDPA and UU PDP. Depending on the recipient this may be achieved by:

(a) a written contract imposing data protection obligations, including our standard data processing terms;

(b) binding corporate rules or an intra-group data transfer agreement;

(c) reliance on the recipient's certification or an applicable adequacy determination;

(d) a specification in a legally binding instrument; or

(e) your consent, after we have informed you of the risks, where no other basis is available.

8.4 Where safeguards do not apply. Under Singapore law, the transfer limitation obligation does not apply where the transfer is necessary for the performance of a contract with you, is necessary in your vital interests, or falls within another exception in the Personal Data Protection Regulations 2021. Under Indonesian law, we apply the tiered mechanism in Article 56 of UU PDP: adequacy, then appropriate and binding safeguards, then consent.

8.5 Immigration and border control. Where a government requires your data as a condition of entry, exit or carriage, that transfer is a legal requirement of travel and we cannot control how the receiving authority uses it.

9. How does Bliink store and protect personal data?

9.1 We maintain technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS 1.2 or above) and at rest; role-based access control and least-privilege provisioning; multi-factor authentication for administrative access; network segmentation; logging and monitoring; vulnerability management and patching; secure software development practices; periodic penetration testing; backup and disaster recovery; vendor security assessment; personnel confidentiality undertakings and privacy training; and a documented incident response process.

9.2 A current description of our security measures is available to customers in the Data Processing Addendum, and on request by emailing security@bliink.sg.

9.3 No absolute guarantee. No system is completely secure and no transmission over the internet can be guaranteed secure. You are responsible for keeping your credentials confidential and for using the Services on a device you control. Please do not send us passport images, payment card details or other sensitive information by unsecured email or unencrypted messaging.

9.4 Data breach notification. If a data breach occurs, we will assess it promptly and, where the thresholds are met, notify:

(a) in Singapore, the Personal Data Protection Commission within 3 calendar days of determining that the breach is notifiable, and affected individuals as soon as practicable, where the breach results in or is likely to result in significant harm, or is of a significant scale (500 or more individuals);

(b) in Indonesia, affected data subjects and the supervisory authority within 72 hours (3 × 24 hours) in accordance with Article 46 of UU PDP; and

(c) our Customers without undue delay, in accordance with the Data Processing Addendum, so that they can meet their own obligations.

10. How long does Bliink keep personal data?

10.1 We keep personal data only for as long as necessary for the purposes for which it was collected, unless a longer period is required or permitted by law. Indicative periods are set out at Annex C.

10.2 We may retain personal data for longer where necessary to investigate or defend against actual or potential legal claims, to comply with a legal hold, or to meet tax, accounting, licensing or regulatory record-keeping requirements.

10.3 When personal data is no longer required, we delete it or irreversibly anonymise it. Where deletion is not immediately feasible — for example within backup media — we isolate it from further processing and delete it in the ordinary backup cycle.

10.4 Where we act as data intermediary or processor for a Customer, retention is governed by that Customer's instructions and the Data Processing Addendum, and personal data is returned or deleted on termination in accordance with those terms.

11. What about Bliink applications and messaging channels?

11.1 Our mobile applications may request access to device features such as notifications, camera (to scan documents), calendar, contacts or location. You control these permissions in your device settings and may withdraw them at any time, though some features will not work without them.

11.2 WhatsApp and third-party messaging. Where you interact with the Concierge over WhatsApp or another third-party messaging service, that service provider processes your messages and metadata under its own terms and privacy policy, which we do not control. Do not send passport images, payment card details or sensitive personal data over these channels; use the Platform's secure upload instead.

11.3 We may record and transcribe calls for quality, training, dispute resolution and record-keeping. Where we do, we will tell you at the start of the call.

12. What about links to third-party websites and services?

12.1 The Website and Platform link to supplier and third-party sites — airlines, hotels, visa services, payment pages and others. Those sites are not controlled by us, and their privacy notices govern their handling of your personal data. We are not responsible for their content or practices.

13. Does Bliink collect personal data of children?

13.1 See clause 3.4. The Services are not directed at children and we do not knowingly collect personal data from individuals under 18 except as described in clause 3.4.

14. How does Bliink handle "do not track" requests and use cookies?

14.1 We use cookies and similar technologies on the Website and Platform. Full details, including categories, purposes and retention, are in our Cookie Policy at ../cookie-policy/, which forms part of this Policy.

14.2 There is currently no uniform industry standard for responding to browser "do not track" signals, and we do not currently commit to responding to them. You can manage cookies through our consent banner and preference centre, and through your browser settings.

15. Does Bliink send marketing communications?

15.1 We send marketing communications to business contacts where you have consented or where applicable law otherwise permits.

15.2 You may opt out at any time by using the unsubscribe link in any marketing message or by contacting us under clause 18. We will action opt-outs promptly and in any event within the period required by law (30 days in Singapore).

15.3 In Singapore we comply with the Do Not Call Provisions in Part 9 of the PDPA and check the Do Not Call Registry before sending specified messages to Singapore telephone numbers, and with the Spam Control Act 2007. In Indonesia we obtain consent in accordance with UU PDP and the Electronic Information and Transactions Law.

15.4 Opting out of marketing does not stop service messages — booking confirmations, disruption alerts, document expiry reminders and security notices — which are necessary to provide the Services.

16. What are your rights?

16.1 Subject to the conditions and exceptions in applicable law, you have the following rights:

16.2 How to exercise your rights. Submit a request by emailing privacy@bliink.sg. We may ask you to verify your identity before we act. We will respond within 30 days in Singapore and within 3 × 24 hours (acknowledgement) and 30 days (substantive response) in Indonesia, or tell you if we need longer and why. We do not charge for a first request; a reasonable fee may apply to repetitive or manifestly excessive requests, and we will tell you before any fee is incurred.

16.3 Requests about data held for a Customer. Where Bliink processes your personal data as data intermediary or processor for your employer, we will refer your request to that employer and assist them in responding. Your employer is the right first point of contact for data held in its account.

16.4 Limits. We may refuse or partly refuse a request where an exception applies — for example where the data is subject to legal privilege, would reveal another individual's personal data, relates to an ongoing investigation, or where a supplier or authority requires us to retain it. We will tell you our reasons.

17. How are changes to this Policy handled?

17.1 We may revise this Policy from time to time. The "last updated" date at the head of this Policy shows when it was last changed.

17.2 Where a change is material — for example a new purpose, a new category of recipient, or a change in the basis on which we process — we will give you reasonable advance notice by email, in-Platform notice or a Website banner, and where the law requires it we will seek fresh consent.

17.3 Historical versions are available on request at privacy@bliink.sg.

18. How to contact us

18.1 If you are not satisfied with our response, you may complain to:

• Singapore: Personal Data Protection Commission, 10 Pasir Panjang Road, #03-01 Mapletree Business City, Singapore 117438 — www.pdpc.gov.sg

• Indonesia: the supervisory authority established under UU PDP once operational. Pending its establishment, complaints may be directed to the Ministry of Communication and Digital Affairs (Komdigi).

19. Language

19.1 This Policy is published in English, Bahasa Indonesia and Simplified Chinese. The Bahasa Indonesia and Simplified Chinese versions are provided for convenience.

19.2 In the event of inconsistency, the English version prevails, except that where Indonesian law requires the Bahasa Indonesia text to govern — including under Law No. 24 of 2009 on the National Flag, Language, Emblem and Anthem and Presidential Regulation No. 63 of 2019 — the Bahasa Indonesia version governs to the extent of that requirement in respect of Indonesian data subjects and the Indonesian entity.

ANNEX A — SINGAPORE SPECIFIC PROVISIONS

---

A.1 Governing statute. The Personal Data Protection Act 2012 (No. 26 of 2012), as amended, and its subsidiary legislation including the Personal Data Protection Regulations 2021.

A.2 Data Protection Officer. We have designated a DPO as required by section 11(3). Contact details are at clause 18.

A.3 Deemed consent. We rely on deemed consent by conduct (section 15), deemed consent for contractual necessity (section 15A) and deemed consent by notification (section 15B) where applicable. Where we rely on deemed consent by notification — principally for the personalisation described in purpose D — we will have given you notice and a reasonable opt-out period before that processing begins. To opt out, email privacy@bliink.sg.

A.4 Exceptions relied upon. We rely on exceptions in the First Schedule, including vital interests (Part 1), legitimate interests (Part 3), business asset transactions (Part 4), business improvement (Part 5) and research (Part 6), and on the Second Schedule for the collection, use and disclosure of personal data without consent in the circumstances listed there.

A.5 Do Not Call. We comply with Part 9 of the PDPA. We check the Do Not Call Registry before sending specified messages to Singapore telephone numbers unless we have clear and unambiguous consent in evidential form or an ongoing relationship exemption applies.

A.6 Data breach notification. Assessed and notified in accordance with Part 6A of the PDPA and Regulation 3 of the Personal Data Protection (Notification of Data Breaches) Regulations 2021: notification to the PDPC within 3 calendar days of assessing the breach as notifiable, and to affected individuals as soon as practicable.

A.7 Data portability. The data portability obligation in Part 6B is not yet in force. We will comply on commencement.

A.8 Right of private action. Section 48O gives an individual who suffers loss or damage directly as a result of a contravention a right of private action.

A.9 Travel agent licensing. Bliink Private Limited provides the Bliink platform, applications and AI Concierge and contracts for those services. It does not itself carry on the business of a travel agent in Singapore and does not hold a licence under the Travel Agents Act 1975. The arrangement, booking and servicing of travel is performed by PT Bliink Global Travel under its Indonesian tourism business registration (see Annex B.12).

ANNEX B — INDONESIA SPECIFIC PROVISIONS

---

B.1 Governing statute. Law No. 27 of 2022 on Personal Data Protection (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi), fully enforceable from 17 October 2024; Law No. 11 of 2008 on Electronic Information and Transactions as amended (including by Law No. 1 of 2024); Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions; Minister of Communication and Informatics Regulation No. 5 of 2020; Government Regulation No. 80 of 2019 on Trading Through Electronic Systems; and Law No. 8 of 1999 on Consumer Protection.

B.2 Roles. PT Bliink Global Travel acts as pengendali data pribadi (data controller) for the processing described in clause 2.3 and as prosesor data pribadi (data processor) for the processing described in clause 2.2.

B.3 Data Protection Officer. We have appointed a pejabat atau petugas pelindungan data pribadi in accordance with Article 53 of UU PDP. Contact details are at clause 18.

B.4 Legal bases. We rely on the bases in Article 20(2) as mapped in clause 5.1. Consent, where relied upon, is obtained explicitly, is informed, is specific to a stated purpose, is not bundled with acceptance of other terms, and is recorded. Pre-ticked boxes are not used.

B.5 Specific personal data. The categories at clause 3.1(j) are data pribadi yang bersifat spesifik under Article 4(2) and are processed only on an explicit consent or other permitted basis, with additional access restrictions.

B.6 Rights. Articles 5 to 15 of UU PDP, as summarised at clause 16.1.

B.7 Breach notification. Written notification to the affected data subject and to the supervisory authority within 3 × 24 hours in accordance with Article 46, stating the personal data disclosed, when and how it occurred, and the handling and recovery efforts undertaken.

B.8 Cross-border transfer. In accordance with Article 56, we transfer personal data outside Indonesia only where the receiving country has an equal or higher level of protection, or where adequate and binding personal data protection safeguards are in place, or, failing both, with your consent. We do not commit to Indonesian data residency; personal data is hosted in Singapore (SGP1) as described in clause 8.2.

B.9 Electronic system registration. Registration as a private electronic system operator (Penyelenggara Sistem Elektronik Lingkup Privat) with the Ministry of Communication and Digital Affairs is in progress. This Annex will be updated with the registration number once issued.

B.10 Supervisory authority. The supervisory authority contemplated by UU PDP had not been formally established as at 1 September 2026. Until it is, complaints may be directed to Komdigi and to our DPO. We will update this Annex once the authority is operational.

B.11 Language. In accordance with Law No. 24 of 2009 and Presidential Regulation No. 63 of 2019, a Bahasa Indonesia version of this Policy is made available. See clause 19.

B.12 Tourism business licensing. PT Bliink Global Travel holds Business Identification Number (Nomor Induk Berusaha) 1607250028313 carrying KBLI 79111 (aktivitas agen perjalanan wisata), and operates in accordance with Law No. 10 of 2009 on Tourism and the risk-based licensing framework under Government Regulation No. 5 of 2021.

ANNEX C — INDICATIVE RETENTION PERIODS

---

These periods are indicative and subject to legal holds. Where Bliink acts as processor, Customer instructions prevail.

ANNEX D — CATEGORIES OF SERVICE PROVIDER

---

D.1 Service providers processing on our behalf. These organisations process personal data on Bliink's instructions and under written data protection terms.

D.2 Travel suppliers and distribution providers — independent recipients, not our service providers. Airlines, hotels, rail and ferry operators, ground transport and car rental companies, cruise lines, tour and activity operators, destination management companies, global distribution systems, aggregators, consolidators and bed banks receive your personal data only to the extent necessary to make and fulfil a booking. Each determines its own purposes for that data and acts as an independent controller under its own privacy notice and the law of the country in which it operates. They are not Bliink's processors, and clause 7.3 applies to them.

D.3 Why these are not named individually. The identity of Bliink's travel supplier and distribution relationships is commercially confidential and is not published. This does not reduce your rights: because those providers are independent controllers, you may exercise your rights directly against the provider holding your data, and on request under clause 16 we will tell you which providers hold personal data relating to a specific booking of yours.

Where we act as processor for a corporate Customer, the sub-processor terms in the Data Processing Addendum apply. The current sub-processor list is available to Customers on request.

---

© 2026 Bliink Private Limited and PT Bliink Global Travel. All rights reserved.