Additional information about customer personal data
PT Sun Life Financial Indonesia
(Last Updated: August 2026)
PT Sun Life Financial Indonesia, together with its affiliates, subsidiaries, and associated companies (collectively referred to as the Sun Life Financial group of companies or “we”, “us”, or “our”), is committed to protecting your “Personal Data”. Personal Data means any data relating to an identified or identifiable individual, whether on its own or in combination with other information, directly or indirectly, through electronic or non-electronic systems, as referred to in Law No. 27 of 2022 on Personal Data Protection (“PDP Law”) and its other applicable implementing regulations, as amended from time to time.
This Privacy Notice applies to all parties who are prospective or existing customers, policyholders, participants, insured persons, or beneficiaries, including agents, vendors, suppliers, partners, relevant government institutions, and other parties who use and/or provide products and/or services from or to us, including the processing of Personal Data by parties located outside Indonesia, where relevant to our Personal Data processing activities (collectively referred to as “you” or “your”).
This Privacy Notice applies whenever you interact with us, whether electronically or non-electronically. We also provide more detailed information regarding your interactions with us when you visit our official websites, mobile applications, and other electronic platforms (collectively, our “Digital Properties”).
About Sun Life Indonesia
PT Sun Life Financial Indonesia is a legal entity established under the laws of Indonesia and is licensed and supervised by the Financial Services Authority of Indonesia (Otoritas Jasa Keuangan or “OJK”). We are a financial services provider offering a range of insurance protection and financial planning solutions to help customers meet their financial needs at every stage of life.
As part of our commitment to comprehensive Personal Data protection, we also apply Personal Data protection requirements equivalent to those set out in this Privacy Notice to all of our directors, commissioners, and employees, including, but not limited to, staff, management, outsourced personnel, and marketing representatives.
When processing your Personal Data, we act as a Personal Data Controller. We determine the purposes and means of processing your Personal Data in accordance with applicable Personal Data protection principles.
In certain circumstances, we may also act as a Personal Data Processor, where applicable. In such capacity, we remain fully subject to and guided by the requirements of the PDP Law.
We have appointed a Data Protection Officer as our official representative in accordance with applicable laws and regulations to oversee compliance with Personal Data protection policies. Any questions regarding Personal Data protection may be submitted through our official communication channels listed in the “Contact Us” section below.
Personal Data We Obtain and Collect
We may obtain and collect your Personal Data directly when you apply for and use our products and/or services. We may also receive your Personal Data from third parties that cooperate with us or from other sources. We ensure that Personal Data obtained from these sources has undergone verification and has been collected based on valid consent and in accordance with applicable laws and regulations. Where relevant, the Personal Data we collect and process may include information and documents relating to:
- Identity, including your name, contact details, National Identity Card (KTP), and other information or documents relating to your identity and/or the identity of a beneficiary that are issued by the government;
- Financial and health information, including medical history and bank account details;
- Biometric information, including voiceprints, fingerprints, photographs, or facial features;
- Demographic information, including age, profession, marital status, and nationality;
- Administrative information required for us to provide services to you, including wills, powers of attorney, and documents required for identity verification;
- Interaction and digital data, including IP address, device information, and approximate location; and/or
- Other supporting Personal Data, as relevant for fulfilling the purposes of Personal Data processing.
Processing Your Personal Data
“Personal Data Processing”, “process”, or “processed” means any operation or activity performed on Personal Data, including obtaining and collecting, processing and analysing, storing, correcting and updating, displaying, publishing, transferring, disseminating, disclosing, deleting, and destroying Personal Data, as regulated under the PDP Law.
We collect and process your Personal Data in a limited, specific, lawful, and transparent manner for the following purposes:
1. Providing Products and/or Services
Managing your Personal Data, including, but not limited to, understanding your needs, assessing the suitability of products and/or services, processing applications, transactions, risk assessments, claims, and investments, providing administrative support, and providing information relating to our products and/or services.
2. Enhancing Your Experience
Understanding your preferences and needs, improving your experience when using our Digital Properties, providing personalised services and communications, and conducting marketing activities, including, but not limited to, promotions, product offers, surveys, and other related programmes, in accordance with applicable laws and regulations.
3. Conducting Business Operations
Supporting our business operations and administration, including analysing and improving internal processes, developing products and services, measuring marketing effectiveness, and fulfilling actuarial, accounting, reporting, and other business requirements.
4. Compliance with Legal and Security Obligations
Verifying identity; maintaining system and information security; preventing and detecting fraud or other unauthorised activities that violate the law; carrying out risk management; complying with applicable legal and regulatory obligations; and implementing Customer Due Diligence (CDD), Anti-Money Laundering and Counter-Terrorist Financing programmes, and measures to prevent the financing of the proliferation of weapons of mass destruction.
We may use social media and digital platforms to display advertisements that are relevant to your needs. For this purpose, we use only demographic data and information that has been modified so that it does not directly identify you. We do not share your Personal Data with those platforms.
We may supplement Personal Data with information from lawful external sources, such as public databases or third-party applications, to provide more relevant services and offers. If such information can identify you, we will use it only with your consent and in accordance with the original purpose for which it was collected.
We also cooperate with marketing representatives or other third parties to market our products and/or services. We may monitor your interaction with marketing content to assess campaign effectiveness, while respecting the preferences you have selected or agreed to.
Legal Bases for Processing Your Personal Data
We are committed to processing your Personal Data in accordance with the Personal Data protection principles under the PDP Law. Any Personal Data we obtain and collect will be processed on a lawful basis, for clear purposes, and in accordance with applicable laws and regulations:
1. Valid Explicit Consent
We process your Personal Data based on explicit consent for one or more specific purposes that we have communicated to you. We will request your consent, as a Personal Data Subject, before processing your Personal Data, in a format provided through our products and/or services or in another format. You may withdraw your consent at any time. However, the withdrawal of consent may have certain consequences for your use of our products and/or services.
2. Performance of Contractual Obligations
We process your Personal Data to perform contractual obligations. We process the Personal Data you provide to carry out agreed obligations, including providing our products and/or services at your request.
3. Compliance with Legal Obligations
We process your Personal Data to comply with obligations under applicable laws and regulations. This includes processing the Personal Data you provide to carry out actions that we are legally required to perform, including, but not limited to, obligations under Personal Data protection regulations.
4. Protection of Vital Interests
This refers to interests relating to the survival of the Personal Data Subject. We process your Personal Data to protect your vital interests.
5. Public Interest and Public Services
We process your Personal Data to perform duties in the public interest, provide public services, or exercise authority under applicable laws and regulations.
6. Other Legitimate Interests
We process your Personal Data to pursue other legitimate interests, while taking into account the purposes, necessity, and balance between our interests and your rights as a Personal Data Subject.
Disclosure of Your Personal Data to Third Parties
We may cooperate with third parties, such as agents, vendors, partners, service providers, affiliates, and reinsurers, to support the fulfilment of the purposes of Personal Data processing. In certain circumstances, these third parties process Personal Data on our behalf within the scope of the products and/or services they provide.
We take reasonable steps to ensure that each third party has the commitment and capability to maintain the confidentiality and security of Personal Data. The use of Personal Data is restricted to the specified purposes, and each engagement is governed by a written agreement requiring compliance with information security standards and applicable legal requirements.
We carefully determine the types of information to be shared and the reasons for sharing it, and we limit the disclosure of Personal Data to what is necessary for the relevant purposes. In certain circumstances, laws and regulations may require us to disclose Personal Data to regulators or authorised government institutions.
Cross-Border Transfer of Personal Data
To provide and improve products and/or services, carry out operational activities, comply with legal and regulatory obligations, and obtain support from affiliates or appointed service providers, we may transfer, store, disclose, or provide access to your Personal Data to parties located outside the territory of the Republic of Indonesia.
Any cross-border transfer of Personal Data will be carried out in accordance with applicable laws and regulations. We will take reasonable steps whether the recipient provides an adequate level of Personal Data protection or implements appropriate safeguards to protect the security, confidentiality, and integrity of your Personal Data. We also ensure that strict Personal Data protection agreements are in place with our overseas affiliates or service providers. Where required by law, we will obtain your explicit consent before transferring your Personal Data.
Security Measures to Protect Your Personal Data
How We Secure Your Personal Data
We implement technical, physical, and organisational safeguards to protect your Personal Data against loss, unauthorised access, or misuse. Access is granted only to parties with a business need, and we do not sell your Personal Data. If a security breach occurs, we will notify you in accordance with the PDP Law. Further information is available on our Security page: https://www.sunlife.com/sl/pslf-indonesia/id/security/.
Security of Personal Data Processing by Third Parties
Where certain services are provided by third parties, we will ensure that those parties comply with applicable laws and regulations and implement reasonable safeguards to protect your Personal Data.
Links to Third-Party Websites
Our websites and/or the websites of our affiliates may contain links to third-party websites that are not managed by us and/or our affiliates. We are not responsible for the privacy policies of those third-party websites.
Your Rights as a Personal Data Subject
In accordance with the PDP Law and the manner in which we process your Personal Data, you have the following rights:
- To obtain information about the identity of the party managing your Personal Data, the legal basis and purposes of processing, and the accountability of the party receiving your Personal Data;
- To access and obtain a copy of your Personal Data under our control;
- To complete, update, and/or correct errors and/or inaccuracies in your Personal Data;
- To terminate processing and to delete and/or destroy Personal Data in accordance with applicable laws and regulations;
- To cancel or withdraw the consent you have provided to us;
- To object to automated decision-making, including profiling, that produces legal consequences or has a significant impact on you;
- To restrict or delay processing proportionately and in accordance with the purposes of Personal Data processing;
- To file a claim and receive compensation for violations involving the processing of your Personal Data, subject to applicable legal requirements; and
- To request your Personal Data in a commonly used digital format so that it may be transferred or sent directly to another party, provided that the recipient’s electronic system is demonstrably secure and compatible with our systems.
You are entitled to submit a written request to exercise your rights, including, but not limited to, the right to obtain information about processing, restrict processing, or withdraw consent. We will process such request to the extent that it satisfies the relevant requirements and applicable legal provisions. You must exercise these rights with full awareness that you have considered and accepted any legal or operational consequences that may arise, including the possible suspension, modification, or unavailability of our products and/or services.
Requests to exercise your rights, and requests for further information regarding those rights, may be submitted through our official communication channels listed in the “Contact Us” section below.
The rights described above may be exempted or set aside for the implementation of applicable laws and regulations, particularly where they relate to the following interests:
- National defence and security;
- Law enforcement processes;
- The public interest in the administration of the state;
- Supervision of the financial services sector, monetary matters, payment systems, and financial system stability conducted as part of the administration of the state; or
- Statistics and scientific research.
You may also choose:
i. Not to receive marketing communications or other commercial information;
ii. Your preferred communication method for product and/or service offers, namely telephone, SMS, email, and/or messaging applications; and
iii. Your cookie settings, noting that disabling cookies may limit certain features.
Personal Data Processing Period
1. Retention of Personal Data
We will retain your Personal Data for as long as you continue to use our products and/or services and/or until the purposes of Personal Data processing have been fulfilled. Once your Personal Data is no longer required to fulfil the processing purposes, we will retain it for a specified period in accordance with our document and/or information retention policies and applicable laws and regulations (the “Retention Period”).
2. Personal Data Processing Period
We will process your Personal Data until the purposes of processing have been fulfilled and retain your Personal Data until the Retention Period has expired.
3. Deletion and Destruction of Personal Data
After the Retention Period has expired and the purposes of Personal Data processing have been fulfilled, unless a specific interest requires otherwise, all Personal Data we retain will be deleted and/or destroyed in accordance with our policies and applicable laws and regulations.
Changes or Updates to This Privacy Notice
We may update or modify this Privacy Notice from time to time. If a change is material or may have a significant impact on you, we will provide notice and make the latest version available before the change takes effect. We encourage you to review this Privacy Notice periodically.
Contact Us
If you have any questions, require further clarification, or wish to submit a request to exercise your rights in relation to Personal Data protection, please contact us through one of the official channels below.
By official correspondence or in person at:
Menara Sun Life, Ground Floor
Jl. Dr. Ide Anak Agung Gde Agung, Block 6.3
Mega Kuningan Area
South Jakarta 12950
Indonesia
By telephone:
Call Center: 1500786 or (021) 1500786
To maintain service quality and security, support internal training, and provide evidence of our compliance with our obligations, please be informed that every voice call or other form of communication between you and us may be recorded, stored, and processed in accordance with applicable laws.
Copyright Notice
The content of this website is protected by copyright. The information may be used only for personal, non-commercial purposes. To request permission to reproduce or republish any content, please contact us through contact details and/or email address.
Governing Law
This Privacy Notice is governed by the laws of the Republic of Indonesia.