Company: NUTR
Filing Date: 2025-03-25
Form Type: CORRESP
Source: 0001641172-25-000449
Chunk: 124

Company: NUSATRIP Inc
Filing Date: 2025-03-25
Form: CORRESP
Chunk 124
---
 commerce may prompt calls for more stringent consumer
protection laws. Platforms must ensure secure payment methods and must provide consumers with protection against fraud. Platforms using
third-party payment gateways (such as credit card providers or online payment systems like GoPay, OVO, etc.) need to ensure compliance
with both Indonesian laws and international data security standards (e.g., PCI-DSS). Online booking platforms must provide mechanisms
for resolving consumer disputes in a fair and efficient manner, including facilitating communication between customers and service providers
(hotels, airlines, etc.).

Additionally, our online platform shall also be subject
to electronic system requirements under Indonesian law. We are registered as an electronic system provider in private sector as required
under Regulation of Minister of Communication and Information-Technology of Republic of Indonesia No. 5 of 2020 on Electronic System Provider
in Private Sector and under Regulation of Minister of Trade No. 31 of 2023 on Business Licensing, Advertising, Guidance, and Supervision
of Business Actors in Trading Through Electronic Systems.

Personal Data Protection and Privacy

In processing data and/or information, the Company
is obligated to apply the principles of personal data protection including fulfilling the aspect of the service users’ consent for
the use of their personal data.

Under the Law of Republic of Indonesia No. 27 of 2022
on Personal Data Protection (“PDP Law”), personal data is classified into two categories, namely general personal data
and specific personal data. General personal data under PDP Law are full name, gender, citizenship, religion, marital status, and/or combined
personal data to identify a person (e.g., cellular phone number and IP address). Whereas, specific personal data under PDP Law are health
data and information, biometric data, genetic data, crime records, children’s data, personal financial data, and/or other data in
accordance with provisions of laws and regulations. In operating the relevant web portal, the Company shall be deemed as a “personal
data controller” under the PDP Law. We have not found any evidence of the Company’s violation to the requirements of personal
data protection under the applicable laws and regulations of Republic of Indonesia.

The PDP Law, which came into effect in October 2022,
imposes strict requirements on businesses that collect and process personal data. Platform must obtain explicit consent from users before
collecting personal data, such as name, email, phone number, payment information, and travel preferences. Our platform must provide users
with a clear