XL Axiata Privacy Policy

Privacy & Your Information

XL’s business brings technology to businesses, consumers and, society in a way that makes amazing experiences possible but doesn’t come at the expense of your privacy. We believe in innovation and performance that supports your privacy rights and in technology designed with those rights in mind.

This Privacy Policy describes how we use your personal information and respect your privacy rights.

This Privacy Policy explains how our products, services and, technologies use your personal information. It applies to our use of personal information across our websites, products, online services, software, apps, tools, and other services and functionality we provide, both online and offline (collectively referred to as “XL Services”), unless a separate, or supplementary, privacy policy is offered.

What kinds of Information do we collect?

XL collects information as part of its business operations, to provide services, to respond to requests and offer customer support, to fulfil legal and contractual obligations and to build its innovative products. You provide some of this data directly, such as when you order XL product, contact customer support, or register for an XL event or publication. We also collect information through your interaction with XL Services and our website, for example, using embedded product technologies and cookies. We also obtain data from third parties.


Information that you provide to XL Axiata voluntarily

When you subscribe a phone number, create account in our application, make purchase or request information from XL, we will ask for things like contact, billing, and communication information, payment card or financial account data, and national identification, biometric, conversation including voice & chat, or credentials in order to fulfil your request. If you visit one of our stores or locations, attend a trade show or event, or otherwise contact us, you may also voluntarily provide similar information.

Interactive features in some XL Services may allow you to invite friends, follow others, comment on or make unique posts, or share photos, video or other personal content. When you affirmatively share this content, we may collect and use it in accordance with this Policy. Additionally, by way of your social engagement, we may receive information about you from another user, such as when your friend posts content that includes you.

From time to time we engage in research, analysis, historical and scientific studies either alone or with partners. As part of such efforts we invite individuals to participate and voluntarily share information through an informed consent process. When we receive personal information from a third party for the purpose of such research, we undertake processes to validate that the personal information has been collected in a responsible and lawful manner.

If you submit any personal information about other people to us or to our service providers, you are responsible for making sure that you have the authority to do so and to allow us to use their personal information in accordance with this Privacy Policy (for example, by your asking for their consent).


Device & Product Operation

If you download and use certain XL Service like telephony, SMS, value added service, Internet of Things (IoT), wireline/wireless connectivity, broadband internet access software or an app, we may track and collect usage data, such as when the software or app accesses our servers, what information and files have been downloaded over the use of the software or app, how you interact with the software and app during use or communicate with others. Some of this data may be protected as personal information under applicable data protection laws. We collect this information to understand how you interact with XL Services and provide you the best experiences. We may also use this information for security purposes. We may associate the information we collect from more than one device that you use with other information that we have collected about you or your other devices.

In addition, most computing devices include embedded technology like processing chips that collect information about how the device is operating. This information may include:

  • Type and version of operating system, hardware version, device settings, software types, battery and signal strength, screen resolution, device manufacturer and model, language, and Internet browser type and version. The name and version of any XL Services (such as the app) you are using is also collected.
  • Geographic locations, such as through Base Station, GPS, Bluetooth, or Wi-Fi signals.
  • Connection information such as the name of your mobile operator when overseas or ISP, browser type, language and time zone, mobile phone number and IP address.
  • Access to this information by other applications and transmission of this information from the device to XL or other service providers may be controlled by the operating system or other software running on the device.
  • In some instance XL technology is used within a product or device that may collect personal information, which is not shared with XL. This information may be collected by the manufacturer of the product or device and you will need to read the privacy policy, or related terms published by that manufacturer to understand how they use your information.
  • Some XL Services may allow you to use biometric information for identification or authentication or to take advantage of specific features. Biometric data may include your fingerprint, voice or similar unique physical characteristics.
  • XL Services can also collect geographic location information, such as location inferred from your IP address or GPS, and information about how you engage with and use XL Services, for example where you have chosen to activate location-enabled services on the device with which you access these services.
  • When XL Services use more sensitive categories of your personal information, such as biometrics for identification or authentication, or precise geographic location.
  • We collect information from and about a wide variety of technologies where XL Services are used. The kind of information collected depends on the technology, the use, and the device and personal settings. Examples of these technologies might include computers, phones and tablets, but also interactive wearables, connected technologies in the home or other vehicles.
    Where we provide technology for drones and autonomous vehicles, these may capture audio, video and photographs that unintentionally or incidentally capture people, for example workers in a field or pedestrians crossing a street.
    Where appropriate, we use technical and organizational controls to prevent it from being used improperly, but this information is important to help improve algorithms for product functionality and safety, including features such as mapping topography, obstacles, traffic and the like.


Information from 3rd Parties

We obtain information through partners, vendors, suppliers and other third parties. The parties from whom we obtain information are typically corporate enterprises (although some may also be educational or public enterprises) and they may be in any of the locations where our services presence. These enterprises largely fall into the following categories:

  • Advertising and marketing companies
  • Data set and information vendors
  • Public database providers
  • Social media platforms, partners, providers of products or services
  • Hosts or vendors at events or trade shows
  • Research partners
  • Enterprises that deploy the XL Services or third-party offerings that include XL Services
  • Financial institutions

We take steps to confirm that information we receive from these third parties has been collected with your consent or that these parties are otherwise legally permitted to disclose your personal information to us. We might also obtain information through a partner, or co-create datasets with a partner, as part of our business operations. This kind of data is used for work like improving algorithms and data models, product testing and improvement, enhancing existing products and developing new capabilities and features. In some cases, we combine personal information about individuals that we receive from multiple sources, including directly collected from you or through your use of the XL Services.


Through XL Axiata Website & Services

We collect information about how you interact with our website and some XL Services using cookies and similar technologies.

How we use information

We use information that we collect for lawful purposes associated with the growth, maintenance and management of our business while also respecting your privacy. These uses include our internal operations and administration, communicating with you and fulfilling your requests for the XL Services, for advertising and marketing, to monitor and maintain functionality and security of XL Services and to improve, develop, enhance and otherwise provide the XL Services.


To Communicate

We use contact information to send messages; to offer products and process payments; to respond to customer service requests; to provide alerts such as security updates or changes in our policies or about subscriptions that are ending; and to send marketing or informational materials like newsletters or white papers, in accordance with your communication preferences. We occasionally conduct surveys, offer contests or sweepstakes or do focused research or studies which may require you to voluntarily share personal information in order to participate. These activities typically have additional notices that provide more information about the use of your personal information and to which you may be asked to consent. Some XL Services may allow you to send messages to a “friend” or other contacts you provide or to “like” or post on social media.


For Business Operations

We use information to operate our business; for example, to perform accounting, auditing, billing, reconciliation, and collection activities. Other business purposes that depend on use of your personal information include crime or fraud monitoring and prevention, protecting our legal rights, and performing contractual obligations. We also use personal information to contact you to advertise, market and sell XL Services in accordance with your communications preferences.


For Functionality, Development & Improvement

As part of the service of providing internet session management and for security purposes, we may collect and manage some of your information to provide, offer, personalize and improve XL Services. Some information, like your Phone Number or IP address, is used to communicate with your device to provide network connectivity, measure usage levels of XL Services, diagnose server problems and provide security features. Other business purposes that depend on use of your information include data analysis related to testing, modifying, improving or developing new products, services and technologies and to identify trends. We may collect the physical location of a connected device using satellite, telecommunications tower, and Wi-Fi signals to provide you with personalized location-based XL Services and content if you are using location-enabled XL Services. We may also use information collected from cookies or other similar technologies to improve our websites, make recommendations, and complete transactions you request. You may configure and personalize your current browser to refuse, reject or delete such cookies.


For Product Updating & Reporting

The XL Services may use information to provide software updates and reports and to check that they are working properly. Update functions may automatically check your system to see whether files need to be refreshed, updated, or modernized in order to provide you with the up to date security, versions, features, options and controls associated with your systems or devices. We rely on information to analyse performance and improve and maintain XL Services.


For Advertising & Marketing

We may use your device’s physical location, combined with information about what advertisements you viewed and other information we collect, to enable us to provide personalized content and to study the effectiveness of advertising and marketing campaigns. You may choose whether to allow or deny uses or sharing of your device’s location by changing your device settings, but if you choose to deny such uses or sharing, we may not be able to provide you with certain personalized XL Services and content.


Automated Decision-Making

In some instances, our use of your personal information may result in automated decisions being taken (including profiling) that legally affect you or similarly significantly affect you.

Automated decisions mean that a decision concerning you is made automatically based on a computer determination (using software algorithms), without our human review which has legal or other significant effect. We use automated analysis to make predictions such as your level of interest products or services, or automated decision making to prevent theft, fraud or other crime. XL’s artificial intelligence solutions may lead to automated processing of data in a variety of fields. In the event that our automated decision making would have a legal effect or significantly affect you we will implement measures to safeguard your rights, freedoms and interests, including performing privacy impact assessments to identify suitable measures to protect your rights, or obtain your explicit consent as required by applicable laws.


Legal Basis for XL Axiata use

Our legal basis for collecting and using the personal information will depend on the personal information concerned and the specific context in which we collect it.

We need the personal information to perform a contract with you, where we have a legal obligation to do so or where the processing is in our legitimate interests (such as processing for administrative purposes, direct marketing, product development or improvement, preventing fraud or criminal acts and in support of information security) and not overridden by your data protection interests or fundamental rights and freedoms.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the time of collection. We will also tell you whether the requirement for that information is mandatory and explain any consequences to you if you do not provide the information.

Similarly, if we collect and use your personal information based on our legitimate interests (or from any third party), we will take reasonable steps to provide clear notice and describe our legitimate interests.

XL Axiata is the Data Controller of all personal information collected, except where a supplemental privacy notice says otherwise. The contact details for XL Axiata are set out in the “How to Contact Us” section.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information for any specific processing activity, please contact us using the contact details provided under the “How to Contact Us” Section below.

How XL Axiata share information

We work through our affiliates to provide some of the XL Services. We also work with authorized suppliers and business partners. When we share your personal information with these companies, we put in place appropriate measures to limit the use of your information only for legal and authorized purposes that are consistent with this Privacy Policy, as well as appropriate confidentiality and security measures. For example, we rely on affiliates and partners, such as our resellers, to complete a purchase transaction or provide XL Services, such as support, that you have requested.

We also share information with third parties for advertising and marketing; when required by law or to respond to legal process; to protect our customers; to protect lives; to maintain the security of XL Services; and to protect our legal rights.


With Affiliates & Sister Companies

For aligning our business strategy purposes, we also share personal information to our Affiliates and Sister Companies set out in the Data Sharing Policy.


With Suppliers

Our authorized vendors and suppliers may require personal information to provide services we have contracted for, such as product delivery, website hosting, data analysis, IT services, auditing, payment processing or customer service. We use a wide variety of software and tools at XL and we process personal information using these tools as a regular course of business. Our contracts with suppliers and vendors include provisions to protect your information and limit its use.

We also share non-personally identifiable information, such as anonymized or aggregated information, with suppliers for purposes such as analysis, identifying trends in the areas of our products and to help research and develop new XL Services.


With Partners

We occasionally have relationships with third parties that are not suppliers or vendors but are working with us to offer certain opportunities such as sweepstakes, contests, and similar promotions, to enable joint products or research studies, or to facilitate services like message boards, blogs or other shared platforms. In these cases, additional terms or privacy notices may be provided. For third parties or uses not described in this Policy, we share your information only with a lawful basis to do so.


For Advertising & Marketing

We share your information with our third-party company partners to prepare and deliver advertising and marketing content, to provide content services and to enable them to provide you with more personalized ads and to study the effectiveness of our campaigns.

We use third-party companies to communicate regarding goods and services that may be of interest to you, in accordance with your preferences. You may receive this content by a variety of means such as email, phone or when you access and use the XL Services and other websites. Content may be based on information obtained, for example, through prior purchases or transactions, through your device’s physical location, through information about what advertisements and content you have viewed, or through cookies and similar technologies relating to your access to and use of the XL Services and other websites. You can choose whether to allow or deny uses and/or sharing of your device’s location by changing your device settings, but if you choose to deny such uses or sharing, our partners may not be able to provide you with the applicable personalized XL Services and content.


Mergers & Acquisitions

We may disclose personal information as part of a contemplated or actual corporate transaction such as a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).


Research & Services Improvement

We may disclose personal information to collaboration partners to conduct research to improve our technology, or the use of our technology, in various fields of study and to identify new uses or design new products.


Regulator & Law Enforcement institution

If we are obligated or required by the applicable law and regulatory requirement, court order, administrative agency, government, statutory or regulatory bodies or applicable stock exchange, we may disclose your personal information as a compliance with prevailing law, regulation, detection or investigation of crime or fraudulent.

Data Crossborder Transfer

In term of business operations, functionality and development including our cooperation with our partner, supplier, affiliate & sisters company XL may transfer all data are required including personal information through national borderline with constantly put data protection principles.

Changes in Personal Data and Service

Withdrawal of Service

Withdrawal may be carried out in XL’s certain services and subject to our approval. By withdrawing your consent to our service, it will result a loss of all or part of the service that you receive; this means that you are unable to receive or enjoy or optimize our service given to you.


Access, Correction to or Deletion of Customer Information

If you would like to correct or update your personal information, or to request access to, you may contact us to make such request by making a written request in one of the ways described in the “How to Contact Us” section below. If you request a change to of your personal information, please note that we may still need to retain certain information for recordkeeping purposes, and/or to complete any transactions that you began prior to requesting such change (e.g., when you make a purchase or enter a promotion, you may not be able to change the personal information provided until after the completion of such purchase or promotion). Some of your information may also remain within our systems and other records where necessary for compliance with applicable law.

At your request and where the law requires us to do so, we will confirm what personal information we hold about you. You may also have a legal right to obtain a copy of your personal information. You can make such a request by making a written request in one of the ways described in the “How to Contact Us” section below. We may charge a processing fee for this service where permitted by law and we will require evidence of your identity before fulfilling your request.

Other Privacy Related Information

Below you will find additional information you may find important such as how we communicate changes to this notice, our data retention practices and information security.



XL Services are designed to provide reasonable and appropriate administrative, technical and organizational security measures to protect your personal information against risks such as temporary or permanent loss, destruction, and unauthorized or unlawful access, alteration, use or disclosure. We require our suppliers and vendors to apply similar protections when they access or use personal information that we share with them. Users of XL Services must also do their part in protecting the data, systems, networks, and service they are utilizing. No technology, data transmission or system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that your password to any XL account has been compromised), please immediately notify us by contacting us using the instructions in the “How to Contact Us” section below.



We retain personal information for the period necessary to: Provide requested XL Services, as needed to comply with legal obligations (e.g. maintaining opt-out lists to fulfil advertising and marketing choices or to comply mandatory record retention or legal hold requirements), as agreed in an individual consent, to resolve disputes, and to otherwise fulfil the purposes, rights and obligations outlined in this Privacy Policy. Retention periods can vary significantly based on the type of information and how it is used and our retention periods are based on criteria that include legally mandated retention periods, pending or potential litigation, our intellectual property or ownership rights, contract requirements, operational directives or needs, and historical archiving. When personal information is removed from our systems, it will be deleted or destroyed using appropriate security protocols so that it cannot be reconstructed or read.


3rd Party Sites & Services

This Privacy Policy does not address, and we are not responsible for, the policies and practices of third parties or other organizations that are not operating on XL’s behalf, including policies and practices related to privacy and security, data collection, processing, use, storage, and disclosure. This includes:

  • any third party operating any site or service to which the XL Services link – the inclusion of a link on the XL Services does not imply endorsement of the linked site or service by us or by our affiliates; or
  • any app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer (such as Facebook, Apple, Google, Microsoft, LinkedIn, etc.) - including any personal information you disclose to other organizations through or in connection with the XL Services or our corporate Social Media Pages.

Changes to this policy

We may change this Privacy Policy from time to time, so it accurately reflects our practices, the XL® Services and legal requirements.

If any change to our Privacy Policy materially affects the use of your personal information, we use reasonable efforts to notify you in advance, such as by sending an email or posting a prominent notice of the changes on our website, and give you a reasonable period of time to object to any changes. In some cases, objecting to changes may affect the availability or functionality of the XL Services available to you. We will treat your continued use of the XL Services after the effective date of any updated Privacy Policy as your acceptance of the changes we have made. However, we will seek your affirmative consent to any material changes in our use of your personal information as described in an updated Privacy Policy if and where this is required by applicable data protection laws.

We encourage you to periodically review this Privacy Policy to stay informed about how we collect, use, and share personal information.

How to Contact Us

If you have questions or concerns about XL’s privacy practices or to exercise any of your rights as described in this policy, you can contact at privacy@xl.co.id.


There's more for You from News & Promo

Diskon hingga Rp300.000 dari Mapemall

Now, shopping for clothes, shoes, and bags becomes more fun with discount of Rp88,000 from Mapemall!

50% Discount with Maximum Discount of Rp40,000

Find the promo only on myXL Postpaid app!

Birthday Deals Spesial 9 Tahun Blibli.com!

Dapatkan paket kuota dengan cashback terbesar untuk smartphone terbaru!