Privacy Policy

At Fortitu, operated by PT Fortitu Valuta Utama (a licensed non-bank currency exchange provider registered with Bank Indonesia), we are committed to protecting your personal and financial data. This Privacy Policy details how we collect, use, store, and safeguard customer information in accordance with Indonesian Laws and Bank Indonesia regulations.

1. Information We Collect

To deliver foreign currency exchange services and fulfill statutory Anti-Money Laundering (AML) and Know Your Customer (KYC) mandates, we collect:

• Identity Information: Full name, national identity card (KTP) or passport details, nationality, date of birth, and tax identification number (NPWP).
• Contact Information: Phone number, email address, physical residence, and office address.
• Transaction Records: Exchange currency pairs, amounts, bank account details for digital transfers, transaction dates, and reservation history.
• Compliance Data: Source of funds declarations, occupation, and purpose of currency transaction for transactions exceeding regulatory thresholds.

2. How We Use Your Information

We process your personal information strictly for legitimate operational and compliance purposes:

• Processing over-the-counter currency exchange orders and online currency reservations.
• Verifying customer identity and performing mandatory AML/CFT screening against official sanction lists.
• Issuing official transaction receipts and tax invoices.
• Communicating reservation status and rate confirmations via SMS, WhatsApp, or Email.
• Complying with statutory reporting requirements to Bank Indonesia and the Indonesian Financial Transaction Reports and Analysis Centre (PPATK).

3. Data Retention & Protection

We maintain strict physical, technical, and administrative safeguards to prevent unauthorized access, disclosure, or alteration of customer records:

• All digital data transmissions are encrypted using SSL/TLS 1.3 standards.
• Physical identity copies collected during transactions are securely archived in access-controlled storage.
• In compliance with Indonesian financial regulations, transaction logs and customer identity records are retained for a minimum statutory period of 5 (five) years following transaction completion.

4. Disclosure to Third Parties

Fortitu does not sell, rent, or trade customer personal data to commercial third parties. Disclosures are strictly limited to:

• Lawful requests from government and regulatory authorities (Bank Indonesia, PPATK, OJK, Tax Directorate, or judicial law enforcement).
• Authorized banking and payment gateway partners required to settle electronic payments or bank transfers.

5. Your Rights & Contact Details

You have the right to request access to or correction of your personal information stored with us, subject to statutory identity verification. For privacy inquiries or data rights requests, contact our Data Protection Officer at:

PT Fortitu Valuta Utama — Legal & Compliance Dept.
Ruko Plaza 5 Blok C3, Jakarta Selatan, Indonesia
Email: legal@fortitu.id | Phone: +62 21 7200 1234