MaxAdz Payment Agreement Supplement
Last Updated: September 21, 2026
This Payment Agreement Supplement ("Supplement") supplements the MaxAdz Payment Agreement and applies to the processing of Personal Data in connection with MaxAdz products and services where Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection ("Indonesia PDP Law") applies.
This Supplement should be read together with the MaxAdz Payment Agreement. Unless otherwise stated in this Supplement, capitalized terms have the meanings given to them in the MaxAdz Payment Agreement.
If there is any inconsistency between this Supplement and the MaxAdz Payment Agreement regarding the processing of Personal Data subject to the Indonesia PDP Law, this Supplement will apply to the extent necessary to comply with applicable Indonesian law.
1. Scope
This Supplement applies where the processing of Personal Data by MaxAdz is subject to the Indonesia PDP Law, including where processing activities are carried out in Indonesia or outside Indonesia but have legal consequences within Indonesia or for Indonesian Personal Data Subjects as provided under applicable law.
MaxAdz is legally owned and operated by HK PANSYS LIMITED ("MaxAdz", "we", "us", or "our").
The categories of Personal Data we collect, the purposes for which we use Personal Data, and the general manner in which we process Personal Data are described in the MaxAdz Payment Agreement.
2. Legal Bases for Processing Personal Data
Where required under the Indonesia PDP Law, MaxAdz will process Personal Data only where there is an appropriate legal basis.
Depending on the relevant processing activity, such legal bases may include:
- (a) obtaining valid and explicit consent from the Personal Data Subject;
- (b) processing necessary for the performance of an agreement with the Personal Data Subject or for taking steps at the request of the Personal Data Subject before entering into an agreement;
- (c) compliance with legal obligations applicable to MaxAdz;
- (d) protection of the vital interests of the Personal Data Subject;
- (e) performance of tasks carried out in the public interest or exercise of authority provided by applicable laws and regulations; or
- (f) other legitimate interests, taking into account the purposes, necessity, and balance between MaxAdz's interests and the rights of the Personal Data Subject, as permitted under applicable law.
Where processing is based on consent, MaxAdz will provide the information required by applicable law before obtaining such consent.
3. AI Content and User-Provided Data
As described in the MaxAdz Payment Agreement, users may provide or upload text, prompts, images, audio, video, and other materials when using MaxAdz's artificial intelligence content-generation services.
Such materials may contain Personal Data, including images, voices, or other information relating to identifiable individuals.
MaxAdz will process such Personal Data only for specified, lawful, and transparent purposes and in accordance with the Indonesia PDP Law and the MaxAdz Payment Agreement.
Where required to provide the requested AI service, such data may be processed using MaxAdz's infrastructure or by service providers acting on behalf of or providing services to MaxAdz, including cloud infrastructure providers and AI technology or model service providers.
MaxAdz will take reasonable measures to ensure that third parties involved in the processing of Personal Data are subject to appropriate data protection and security obligations as required by applicable law.
Users must ensure that they have the necessary rights, permissions, or other lawful basis to upload and process Personal Data relating to other individuals through MaxAdz.
4. Rights of Personal Data Subjects in Indonesia
Subject to the conditions, limitations, and exceptions provided under the Indonesia PDP Law, Personal Data Subjects may have the right to:
- (a) obtain information regarding the identity, legal basis, purposes of processing, and accountability of the party requesting Personal Data;
- (b) access their Personal Data and obtain information regarding its processing;
- (c) complete, update, and/or correct inaccurate Personal Data;
- (d) terminate processing, delete, and/or destroy Personal Data in accordance with applicable law;
- (e) withdraw consent previously provided for the processing of Personal Data;
- (f) object to certain decisions based solely on automated processing where such processing produces legal consequences or significantly affects the Personal Data Subject;
- (g) request the suspension or restriction of Personal Data processing;
- (h) obtain and/or use Personal Data concerning them in a structured and commonly used format, where applicable;
- (i) transmit their Personal Data to another Personal Data Controller where permitted and technically feasible; and
- (j) exercise other rights provided under applicable Indonesian data protection law.
Where the Indonesia PDP Law establishes a specific statutory response or processing period for a particular request, MaxAdz will process the request within the period required by applicable law.
5. Withdrawal of Consent
Where MaxAdz relies on consent as the legal basis for processing Personal Data, the Personal Data Subject may withdraw that consent in accordance with applicable law.
Upon receiving a valid withdrawal request, MaxAdz will cease the relevant processing within the period required by the Indonesia PDP Law, unless another lawful basis permits or requires continued processing.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
6. Retention, Deletion, and Destruction of Personal Data
MaxAdz will retain Personal Data only for as long as reasonably necessary for the purposes described in the MaxAdz Payment Agreement, including providing the requested services, maintaining security, resolving disputes, complying with legal obligations, and exercising or defending legal rights.
Where Personal Data is no longer required for the relevant processing purpose, or where deletion or destruction is otherwise required under applicable Indonesian law, MaxAdz will take appropriate measures to delete, destroy, or anonymize such Personal Data.
Where required under the Indonesia PDP Law, MaxAdz will notify the relevant Personal Data Subject of the deletion and/or destruction of their Personal Data.
7. Cross-Border Transfers of Personal Data
Because MaxAdz operates internationally, Personal Data relating to users in Indonesia may be transferred to, stored in, accessed from, or otherwise processed in jurisdictions outside Indonesia.
Such recipients may include MaxAdz affiliates and service providers that provide cloud infrastructure, AI technology or models, security, analytics, payment processing, customer support, or other services necessary for the operation of MaxAdz.
Where Personal Data is transferred outside Indonesia, MaxAdz will implement the requirements applicable to cross-border transfers under the Indonesia PDP Law.
Where required, MaxAdz will take appropriate measures to ensure that:
- (a) the receiving jurisdiction provides a level of Personal Data protection equivalent to or higher than that required under the Indonesia PDP Law; or
- (b) adequate and binding Personal Data protection safeguards are in place.
Where the applicable requirements cannot otherwise be satisfied, MaxAdz will obtain the consent of the Personal Data Subject where required by the Indonesia PDP Law.
8. Personal Data Security
MaxAdz will implement appropriate technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, misuse, loss, destruction, or other unlawful processing.
Such measures may include, where appropriate:
- access controls and authorization management;
- encryption and other technical safeguards;
- security monitoring;
- internal data protection procedures;
- management of service providers involved in Personal Data processing; and
- incident response and recovery procedures.
MaxAdz will take reasonable measures to supervise parties involved in processing Personal Data under MaxAdz's control and require appropriate security and confidentiality safeguards.
9. Personal Data Breach Notification
If a Personal Data protection failure occurs and notification is required under the Indonesia PDP Law, MaxAdz will provide written notification to the affected Personal Data Subjects and the competent authority within the period required by applicable law.
Where applicable, such notification will include at least:
- (a) the Personal Data that has been disclosed or compromised;
- (b) when and how the Personal Data was disclosed or compromised; and
- (c) the measures taken by MaxAdz to address and remediate the incident.
Where required by applicable law, MaxAdz may also provide notification to the public.
Under Article 46 of the Indonesia PDP Law, the applicable notification period is generally no later than 3 x 24 hours following a Personal Data protection failure.
10. Data Protection Impact Assessments
Where MaxAdz's processing of Personal Data is considered high-risk under the Indonesia PDP Law, MaxAdz will conduct a Personal Data Protection Impact Assessment as required by applicable law.
This may apply to processing activities involving circumstances identified as high-risk under the Indonesia PDP Law, including the use of new technologies or other processing activities that create a potentially high risk to Personal Data Subjects.
11. Data Protection Function
Where required under the Indonesia PDP Law, MaxAdz will appoint or designate an officer or function responsible for Personal Data protection in accordance with applicable legal requirements.
The relevant function may advise MaxAdz regarding compliance with applicable Personal Data protection requirements, monitor compliance, provide advice regarding Personal Data Protection Impact Assessments, and act as an appropriate contact point for Personal Data protection matters.
12. Records and Accountability
MaxAdz will maintain records of Personal Data processing activities where required by applicable Indonesian law and will take reasonable measures to demonstrate compliance with the principles and obligations of the Indonesia PDP Law.
MaxAdz will process Personal Data in a limited, specific, lawful, and transparent manner and in accordance with the purposes for which the Personal Data is processed.
13. Children's Personal Data
Where MaxAdz processes Personal Data relating to children and the Indonesia PDP Law applies, MaxAdz will process such Personal Data in accordance with the special requirements applicable to children's Personal Data under Indonesian law, including obtaining the consent of a parent and/or legal guardian where required.
This section supplements the provisions regarding minors contained in the MaxAdz Payment Agreement.
14. Exercising Your Rights
Personal Data Subjects in Indonesia may submit requests relating to their Personal Data, including requests for access, correction, deletion, withdrawal of consent, restriction of processing, or other rights available under applicable Indonesian law.
Requests may be submitted through the privacy or customer-support contact method displayed on the MaxAdz website.
MaxAdz may request information reasonably necessary to verify the identity of the person submitting the request and to protect Personal Data from unauthorized access or disclosure.
MaxAdz will process valid requests within the time period required by applicable Indonesian law.
15. Relationship with the MaxAdz Payment Agreement
This Supplement forms part of and supplements the MaxAdz Payment Agreement.
Except as expressly supplemented or modified by this Supplement, the MaxAdz Payment Agreement continues to apply.
If a provision of this Supplement conflicts with the MaxAdz Payment Agreement in relation to Personal Data processing subject to mandatory Indonesian Personal Data protection law, this Supplement will prevail to the extent of that conflict.
Nothing in this Supplement limits any rights granted to Personal Data Subjects under mandatory provisions of the Indonesia PDP Law.
16. Changes to This Supplement
MaxAdz may update this Supplement from time to time to reflect changes in applicable Indonesian laws and regulations, regulatory guidance, or MaxAdz's Personal Data processing practices.
Where required by applicable law, MaxAdz will provide appropriate notice of material changes.
17. Contact Us
If you have questions about this Supplement or wish to exercise your rights under applicable Indonesian Personal Data protection law, please contact MaxAdz through the privacy or customer-support contact information displayed on the MaxAdz website.
Effective Date: September 21, 2026