Mekar Funder Portal Peer-to-Peer Lending Marketplace
Menu

Privacy Policy

This Privacy Policy applies to Personal Data information, which includes any data about an individual, whether identified and/or identifiable individually or combined with other information, either directly or indirectly through electronic and/or non-electronic systems and/or other data and/or information that can be defined as or considered personal data (“Personal Data”), as regulated under Financial Services Authority Regulation Number 40 of 2024 on Information Technology-Based Joint Funding Services (“POJK 40/2024”), Law No. 27 of 2022 on Personal Data Protection (“UU 27/2022”), and applicable laws, obtained in connection with the use of the Mekar Platform including the Platform, Portal, website, applications, and other services provided by Mekar ("Services").

This Privacy Policy applies to the use of the Mekar Platform, including websites, applications, dashboards, and other means or services provided or used by Mekar.

This Privacy Policy is prepared by taking into account the provisions of applicable laws and regulations, including provisions regarding Personal Data protection and the implementation of Information Technology-Based Joint Funding Services (LPBBTI).

 

Who is Mekar?

Mekar is the brand name of PT Mekar Investama Teknologi, which is an operator of Information Technology-Based Joint Funding Services (LPBBTI) or Peer to Peer Lending (P2P). Mekar provides a Platform that connects Lenders with Borrowers to support funding activities in accordance with applicable laws and regulations.

In carrying out its Services, Mekar may process Personal Data belonging to Users, including but not limited to Lenders, Borrowers, prospective Users, management or representatives of business entities, as well as other parties whose Personal Data is lawfully provided to Mekar.

 

Control of Personal Data

In carrying out the Personal Data processing activities described in this Privacy Policy, PT Mekar Investama Teknologi acts as the Personal Data Controller, to the extent so determined based on the purposes and methods of Personal Data processing carried out.

Under certain conditions, other parties cooperating with Mekar may act as Personal Data Controllers or Personal Data Processors in accordance with their respective roles, legal relationships, and processing purposes.

 

Personal Data Subjects That May Be Processed

Personal Data processed by Mekar may originate from various parties interacting with Mekar, including:

  1. Lenders;
  2. Borrowers;
  3. Prospective Lenders and prospective Borrowers;
  4. Platform users;
  5. Representatives or management of business entities;
  6. Parties authorized to represent a business entity;
  7. Contacts or related parties in verification, funding, collection, or customer service processes; and
  8. Other parties whose Personal Data is lawfully obtained and required in the execution of Mekar's activities.

 

Information on Personal Data Processing Based on Consent

In accordance with the provisions of Article 21 of UU 27/2022, where your Personal Data is processed based on consent, Mekar as the Personal Data Controller is required to convey information to you regarding:

  1. Legality of Personal Data processing.
    The processing of your Personal Data by Mekar is based on your consent, and/or other legal bases as further elaborated in the 'Legal Basis for Processing Personal Data' section below. Consent to the processing of Personal Data as referred to above is given by you during the Account registration process on the Platform, where you state that you have read, understood, and agreed to all provisions in this Privacy Policy.

  2. Purpose of Personal Data Processing.
    The purpose of processing your Personal Data is as set forth in the section “What is Mekar’s Purpose in Processing Your Personal Data?”

  3. Types and Relevance of Personal Data Processed.
    The Types and Relevance of Personal Data Processed are as set forth in the section “Types of Personal Data Processed”.

  4. Retention Period for Documents Containing Personal Data.
    Mekar retains documents containing your Personal Data for 10 (ten) years starting from the end of your relationship with Mekar and/or the Platform, unless otherwise required by applicable laws and regulations.

  5. Details Regarding Information Collected.
    In more detail, the information collected by Mekar includes data provided directly by you during registration and use of the Platform (as described in point c above).

  6. Period of Personal Data Processing.
    Your Personal Data is processed by Mekar as long as you are registered and/or actively using the Platform as a Lender and/or Borrower, and such processing may continue after the termination of your relationship with Mekar to the extent necessary to fulfill the retention period described in point d above.

  7. Rights of Personal Data Subjects.
    Your rights as a Personal Data Subject are further detailed in the “Your Rights as a Personal Data Subject” section below.

In the event of changes to the information mentioned above, Mekar must notify you as the Personal Data Subject of such changes before they take effect, and must obtain your consent for said changes. Notification of changes may be delivered through Information within the Services or via electronic mail (email) to each User.

 

Legal Basis for Processing Personal Data

Mekar processes Personal Data based on one or more allowable processing bases under the provisions of laws and regulations, including:

  1. Valid consent from the Personal Data Subject;
  2. Performance of a contract or necessary actions taken to fulfill a request from the Personal Data Subject;
  3. Compliance with Mekar's legal obligations;
  4. Execution of tasks in the public interest or the exercise of official authority based on laws and regulations; and/or
  5. Other legitimate interests in accordance with applicable regulations.

 

What is Mekar’s Purpose in Processing Your Personal Data?

Mekar reserves the right to request, obtain, collect, process, store, use, and/or disclose User Personal Data in framework of or related to the following purposes:

  1. Providing access to Users and organizing as well as facilitating the use of the Mekar Platform and services;
  2. Assessment, analysis, verification, execution of Know Your Customer (KYC) provisions, validation or checks regarding:
    • User profile;
    • Requests or applications for obtaining funding and/or Borrowers;
    • Risk assessment and credit assessment processes;
    • Other information needed in providing services.
  3. Fulfillment of Mekar's rights and obligations under legal provisions and regulations, Funding Agreements, and/or other applicable agreements;
  4. Execution, management, monitoring, and supervision of funding activities and contractual relationships with Users;
  5. Execution of collection activities, settlement of obligations, dispute resolution, and/or defense of Mekar's rights;
  6. Anti-money laundering and counter-terrorism financing checks in the financial services sector;
  7. Conducting surveys, research, analysis, evaluations, development, and improvement of Mekar's products and/or services;
  8. Fulfillment of internal and external audit, monitoring, reporting, and oversight requirements;
  9. Notifying users about changes to the Platform and Services;
  10. Law enforcement and Mekar's compliance with legal provisions and regulations.

To achieve these purposes, Personal Data may be processed, provided, or disclosed to parties related to the provision of Mekar services and/or authorized parties, provided it is conducted based on lawful processing purposes and bases, including:

  1. Bank and non-bank financial institutions, credit bureaus, collection agencies, and/or third-party service providers with an interest, as long as they are bound by confidentiality obligations regarding User Personal Data;
  2. Representatives, any Party related to or part of Danamas and under confidentiality obligations regarding User Personal Data for specific purposes; and/or
  3. Financial Services Authority (OJK), courts, prosecution offices, police, and other government institutions, either upon Danamas' initiative or as required by provisions of law, regulations, directives, instructions, or policies of government institutions or government officials.

 

Types of Personal Data Processed

The types of Personal Data processed may differ depending on the relationship and services used. Such data may include but is not limited to:

  1. Identity Data:
    • Full name;
    • Identification number;
    • Place and date of birth;
    • Gender;
    • Nationality;
    • Photo or identity documents;
    • Signature specimen; and
    • Other identity information required for the verification process.
  2. Contact Data:
    • Residential or correspondence address;
    • Telephone number;
    • Electronic mail (email) address;
    • Emergency contact or related contact information; and
    • Other communication information.
  3. Financial and Transaction Data:
    • Account information;
    • Income and financial condition information;
    • Funding information;
    • Payment and transaction information;
    • Information related to funding obligations;
    • Information on risk assessment results or funding eligibility; and
    • Other financial information required in service provision.
  4. Business Data:
    Where related to business activities, Personal Data may include:
    • Company or business entity information;
    • Documents or information related to business activities;
    • Information regarding beneficial owners or authorized parties; and
    • Other information required for verification processes and service provision.
  5. Device and Technical Data:
    • IP (Internet Protocol) address;
    • Device information;
    • Operating system;
    • Browser;
    • Platform usage information;
    • Pages or features accessed;
    • Activity logs; and
    • Other technical information generated when using the Platform.
  6. Location Data. 
    Under certain conditions, Mekar may process location information if required for service provision and obtained in accordance with permissions, device settings, and applicable regulations.
  7. Specific/Sensitive Data:
    Under certain conditions, Mekar may process Personal Data that falls into specific categories under laws and regulations, provided it is necessary and has a lawful processing basis.

 

Where Does Mekar Obtain Your Personal Data From?

Mekar may obtain your Personal Data through:

  1. Data provided directly by you;
  2. Data generated when you use the Platform;
  3. Documents or information submitted during registration, verification, funding, payment, or other service processes;
  4. Parties that lawfully provide Personal Data to Mekar;
  5. Service providers or partners assisting with verification, service provision, fraud prevention, or other operational activities;
  6. Legally available information sources for verification purposes or legal compliance; and
  7. Other sources permitted under applicable laws and regulations.

 

Automatically Generated Information

Mekar may automatically process Personal Data, including profiling, as part of operational activities and risk management.

Such automated processing may be used in activities including:

  1. Credit assessment and funding eligibility evaluation;
  2. Risk assessment and monitoring;
  3. Fraud prevention and detection;
  4. Implementation of AML (Anti-Money Laundering) and CFT (Countering the Financing of Terrorism) programs;
  5. Identification and checking of PEPs (Politically Exposed Persons);
  6. Monitoring of risky transactions and activities; and
  7. Other purposes required for security and compliance.

Processing may utilize information obtained from the Personal Data Subject, transaction information, verification results, and other lawfully obtained information

Under certain conditions, the results of automated processing or profiling may serve as one of the factors used in decision-making regarding Mekar's services.

Mekar applies appropriate controls over such processing while continuing to honor the rights of Personal Data Subjects in accordance with applicable regulations.

 

Your Rights as a Personal Data Subject

In accordance with the provisions set forth in Law No. 27 of 2022, as a Personal Data Subject, you have the right to:

  1. Obtain clear information regarding the identity, legal basis of interest, purpose of request, and use of your Personal Data, as well as the accountability of the party requesting your Personal Data;
  2. Complete, update, and/or correct errors and/or inaccuracies in your Personal Data in accordance with the processing purpose;
  3. Obtain access to and receive copies of your Personal Data in accordance with applicable laws and regulations;
  4. Terminate processing, erase, and/or destroy your Personal Data in accordance with applicable laws and regulations;
  5. Withdraw consent to Personal Data processing that you previously provided to Mekar;
  6. Object to decision-making actions based solely on automated processing, including profiling, which produces legal effects or significantly affects you;
  7. Delay or restrict the processing of your Personal Data proportionally in accordance with the processing purpose;
  8. Sue and receive compensation for violations in the processing of your Personal Data in accordance with applicable laws and regulations; and
  9. Obtain and/or use your Personal Data from Mekar in a format commonly used or readable by electronic systems, including the right to transmit such Personal Data to another personal data controller.

You may exercise the above rights by contacting Mekar via email at support@mekar.id as described in the section “Reviewing and Correcting Your Personal Information”.

 

Disclosure of Personal Data to Third Parties

Mekar may disclose or provide access to Personal Data to other parties to the extent necessary for legitimate purposes and in accordance with applicable regulations. Such parties may include, but are not limited to:

  1. Directors, commissioners, employees, or agents of Mekar;
  2. Supporting service providers for Mekar's activities, including:
    • Electronic signature service providers;
    • Technology and infrastructure service providers;
    • Cloud service providers;
    • Verification and identification service providers;
    • Payment or banking service providers;
    • Collection service providers;
    • Consultants, auditors, or professional service providers;
  3. Financial Services Authority (OJK), Indonesian Joint Funding Fintech Association (AFPI), and other authorities or institutions; and
  4. Other parties to the extent necessary based on contractual relationships, legal obligations, or other lawful processing bases.

Mekar establishes necessary arrangements with third parties processing Personal Data for and on behalf of Mekar according to their respective roles and responsibilities.

 

Transfer of Personal Data Outside the Territory of Indonesia

Under certain conditions, Personal Data may be transferred, stored, or processed outside the territory of the Republic of Indonesia through service providers or other parties collaborating with Mekar.

In conducting such Personal Data transfers, Mekar will fulfill applicable personal data protection requirements and implement necessary measures to ensure a level of Personal Data protection consistent with legal and regulatory provisions.

 

How is Your Personal Data Protected?

Mekar implements necessary technical and organizational measures to protect Personal Data against unauthorized access, use, alteration, disclosure, loss, damage, or processing.

Such measures may include access control, authentication, encryption, activity logging, monitoring, infrastructure security, access rights management, risk management, and other security controls according to needs and risk levels.

Mekar also implements an information security management framework and security controls in accordance with relevant standards and regulations.

No electronic transmission or storage method can be guaranteed to be completely free from security risks. Therefore, Mekar continuously develops and improves the security of Personal Data and the Platform.

 

Storage and Retention of Your Personal Data

Mekar stores Personal Data as long as necessary to fulfill processing purposes, satisfy contractual relationships, comply with legal obligations, resolve disputes, conduct audits, or fulfill other legitimate needs.

For Personal Data related to the operation of LPBBTI, Mekar stores Personal Data for the duration required under applicable laws and regulations.

Unless otherwise specified under applicable provisions, Personal Data may be retained for at least 10 (ten) years from the end of the business relationship or according to another required period under applicable regulations.

After the retention period expires, Personal Data will be erased or destroyed in accordance with applicable policies and procedures, unless there is a legitimate legal basis to retain it.

 

Erasure and Destruction of Your Personal Data

Mekar will erase or destroy Personal Data if:

  1. The retention period has expired;
  2. The processing purpose has been achieved and no legitimate legal basis remains to retain the Personal Data;
  3. There is a request from the Personal Data Subject that must be fulfilled under applicable regulations;
  4. Legal or regulatory provisions require erasure or destruction; or
  5. Based on other reasons permitted under applicable regulations.

The execution of erasure or destruction may consider data retention obligations, legal interests, audit needs, fraud prevention, dispute resolution, and regulatory obligations.

 

Reviewing and Correcting Your Personal Data Information

If you wish to know what information about you Mekar has collected, you may submit a request to receive an overview of your Personal Data by sending an email to support@mekar.id.  Mekar will provide you with written information within 3 (three) Business Days.

If the Personal Data processed about you is inaccurate, incomplete, or unnecessary for the purpose for which it was collected, you may request Mekar to correct, erase, or block such information. Mekar will respond to such requests within 3 (three) Business Days of receiving a request sent to the aforementioned email address.

 

Cookies 

Mekar uses cookies on the Platform for various reasons, which you can read about below. Mekar’s cookies are not used to store personal information other than your IP address, which does not harm your computer. Mekar wants the Platform to be informative, personal, and as easy to use as possible, and cookies help Mekar achieve that goal.

By using the Platform, you consent to the use of cookies and other technologies as set out in this policy. Mekar appreciates that some Users may prefer more individual control over their visits to the Platform and want the ability to adjust their settings. You can read all about this in the section below titled “How to Manage Cookies”. If you do not agree to such usage, you are welcome not to use the Platform.

 

Mekar uses both Persistent Cookies and Session Cookies:

  1. Persistent Cookies are used to allow the Platform to recognize Users when they return to the Platform and to remember certain information about their preferences. These cookies remain on your computer permanently until you manually delete them.
  2. Session Cookies are used to allow Users to carry information across pages of the Platform without having to re-enter it. These cookies automatically delete themselves when you leave the Platform and visit another site, or when you close your browser.

Mekar has also developed relationships with carefully selected and monitored partners to assist in providing a high-quality Platform. Some of these partners may also set cookies during your visit to support tailoring advertisements you might see elsewhere on the Internet, and/or to fulfill contractual obligations with Mekar.

While these cookies do not store any personal information relating to you or your credit card, please note that we do not have access to or control over cookies and similar technologies used by Mekar's partners.

 

Social Media Cookies

To enrich Platform content, Mekar may occasionally embed video content from other social media sites such as LinkedIn, YouTube, or Facebook. Consequently, when visiting a page with embedded content, you may be presented with cookies from those sites. Mekar has no control over or liability for these cookies, so you should check the relevant third-party cookie policy for more information.

Mekar also offers a ‘share page’ feature on several Platform pages, where content can easily be shared on sites like Facebook, Twitter, LinkedIn, and others. These sites may set cookies when you log into their services. Mekar has no control over or liability for these cookies, so you should check the relevant third-party cookie policy for more information.

 

How to Manage Cookies

Mekar will not use cookies to collect personal information about you. However, if you choose to disable, reject, or block our cookies, some parts of the Platform will not function fully, or in some cases, the Platform may not be accessible at all.

For more information on how to adjust your cookie and browser settings, or how to delete cookies on your hardware, please visit www.aboutcookies.org.

 

Third-Party Sites and Services

The Platform may contain links or integrations to sites, applications, or services provided by third parties.

This Privacy Policy does not apply to Personal Data processing practices carried out by third parties that are outside Mekar's control.

Users are advised to read the privacy policies of respective third parties before providing Personal Data or using those services.

 

Mekar Business Transfer

In the event that Mekar grows and develops further (or for other reasons), one or more units or assets of Mekar's business may be transferred or outsourced to a third party, Mekar may be acquired by a third party, or Mekar may merge with a third party. In such cases as well, your personal information will be transferred, and you hereby authorize and delegate Mekar to perform such transfers without any objection. Mekar will notify Personal Data Subjects where required under applicable provisions.

 

Can This Privacy Policy Be Changed?

Mekar may amend or update this Privacy Policy from time to time to adapt to changes in services, technology, business processes, or legal and regulatory provisions.

Changes to the Privacy Policy will be notified through the Platform or other appropriate communication channels.

DISCLAIMERS:
  1. PT Mekar Investama Teknologi is a provider of Information Technology-Based Joint Funding Services (LPBBTI), operating under the electronic system “Mekar”, which connects Lenders and Borrowers on a single platform.
  2. Information Technology-Based Lending Service is a civil agreement between the Lender and the Borrower. Therefore all risks incurred from the agreement shall be borne entirely by the respective parties.
  3. The credit risk or debt default shall be borne entirely by the Borrower. No government body or authority will take responsibility for this default risk.
  4. Mekar, under the consent of the respective users (the Lender and/or the Borrower), accesses, collects, stores, manages, and uses the Users’ personal data (“Data Usage”) on or in the objects, electronic devices (including smartphones or cellphones), hardware or software, electronic documents, applications or electronic systems owned by or under the control of the Users, by informing the objective, boundaries and mechanism of the aforementioned Data Usage to the related Users before making the said agreement.
  5. The Lender with no knowledge and experience concerning funding is advised not to use this service.
  6. The Borrower must take into account the interest rate and other costs incurred corresponding to his/her ability in repayment of the funding.
  7. All fraudulent activities will be digitally recorded and will be accessible to the general public through social media.
  8. The User must read and fully understand this information before deciding to become a Lender or Borrower.
  9. The Government, in this case represented by the Indonesian Financial Services Authority (OJK), shall not be held liable for any violation or non-compliance committed by the Lender or the Borrower (whether it is intended or due to the User’s negligence) against the regulations, the agreement or the bond between the Organizer and the Lender and/or the Borrower.
  10. Every funding transaction and activity or the agreement implementation concerning funding between or those involving Mekar, the Lender and/or the Borrower must be carried out through an escrow account and a virtual account as regulated in the Financial Services Authority Regulation Number 40 of 2024 about Information Technology-Based Joint Funding Services, and any violation and disobedience of the regulation shall be considered as evidence of a violation of law committed by Mekar. Therefore, Mekar must bear any liability suffered by the Users as a direct result of the violation of law as mentioned above without reducing the rights of the Users that have suffered losses as stipulated in the Indonesian Civil Law.
  11. BE CAUTIOUS, THIS TRANSACTION INVOLVES HIGH RISK. YOU MAY EXPERIENCE LOSSES OR LOSE MONEY. DO NOT BORROW IF YOU DO NOT HAVE THE ABILITY TO REPAY. CONSIDER CAREFULLY BEFORE MAKING THE TRANSACTION.

© 2026 Mekar - PT Mekar Investama Teknologi - v2.163.5737