Business Conduct

This Business Conduct Policy sets out the principles of integrity, professionalism, fairness, responsibility, security, and ethical conduct expected in Suova's operations and relationships with clients, employees, partners, suppliers, and other stakeholders.

1. Purpose

PT Suova Technology Indonesia (“Suova”, “we”, “us”, or “our”) is committed to conducting business responsibly, ethically, professionally, and in compliance with applicable law.

This Business Conduct Policy (“Policy”) describes the principles that guide how we make decisions, work with clients and partners, manage information, develop technology, interact with each other, and represent Suova.

Our goal is not only to comply with legal requirements, but also to build long-term trust through integrity, accountability, respect, transparency, and responsible business practices.

2. Scope

This Policy is intended to guide:

• directors and management;
• employees;
• interns;
• contractors;
• freelancers;
• consultants;
• representatives; and
• other individuals acting on behalf of Suova.

We also expect suppliers, vendors, subcontractors, business partners, and other third parties working with Suova to conduct themselves consistently with the principles described in this Policy where relevant to their engagement.

Specific obligations may also be established through employment agreements, service agreements, supplier agreements, non-disclosure agreements, project contracts, internal policies, or applicable law.

3. Our Core Principles

Our business conduct is guided by the following principles:

Integrity

We act honestly and do not intentionally mislead clients, partners, colleagues, authorities, or other stakeholders.

Accountability

We take responsibility for our decisions, actions, commitments, and the quality of work we deliver.

Respect

We treat people professionally, fairly, and respectfully regardless of their role, background, or relationship with Suova.

Transparency

We communicate material information clearly and avoid intentionally concealing information where disclosure is reasonably required.

Professionalism

We seek to maintain appropriate standards of competence, communication, confidentiality, security, and professional judgment.

Responsibility

We consider the potential impact of our technology, services, decisions, and business activities on clients, users, employees, partners, and society.

4. Compliance With Laws and Regulations

Everyone acting on behalf of Suova is expected to comply with applicable laws, regulations, contractual obligations, and legitimate regulatory requirements.

Depending on the activity involved, this may include requirements concerning:

• corporate and commercial activities;
• taxation and accounting;
• employment;
• intellectual property;
• electronic systems and transactions;
• personal data protection;
• cybersecurity;
• consumer protection;
• competition;
• anti-corruption;
• procurement; and
• other applicable areas of law.

Where local law establishes a stricter requirement than this Policy, the applicable legal requirement must be followed.

Questions regarding uncertain legal or compliance obligations should be escalated through appropriate management or legal channels.

5. Honest and Ethical Business Practices

We expect business decisions and communications to be made honestly and in good faith.

We must not knowingly:

• misrepresent our capabilities;
• falsify qualifications or experience;
• fabricate project results;
• provide intentionally misleading quotations;
• misrepresent project status;
• conceal material problems that should reasonably be disclosed;
• falsify records;
• manipulate information for improper advantage; or
• engage in deceptive business practices.

Sales, marketing, proposals, portfolios, case studies, and other business communications should present Suova's capabilities and experience accurately.

6. Anti-Bribery and Anti-Corruption

Suova does not tolerate bribery, corruption, kickbacks, extortion, or improper payments.

No person acting for or on behalf of Suova may directly or indirectly offer, promise, authorize, request, accept, or provide anything of value for the purpose of improperly influencing a decision or obtaining an unfair business advantage.

This applies to interactions involving:

• government officials;
• public-sector organizations;
• private companies;
• clients;
• prospective clients;
• vendors;
• suppliers;
• intermediaries; and
• other third parties.

Prohibited conduct includes:

• cash bribes;
• kickbacks;
• secret commissions;
• improper referral payments;
• disguised personal benefits;
• unauthorized facilitation payments; and
• gifts or hospitality intended to improperly influence a decision.

Payments made through agents, consultants, contractors, or other intermediaries must not be used to circumvent these requirements.

7. Gifts, Meals, Entertainment, and Hospitality

Reasonable gifts, meals, or hospitality may sometimes be appropriate in legitimate business relationships.

However, they must never be used to influence a business decision improperly or create an inappropriate sense of obligation.

Gifts or hospitality should:

• be lawful;
• have a legitimate business purpose;
• be reasonable and proportionate;
• not be excessively frequent or extravagant;
• not be intended to influence procurement or commercial decisions;
• not involve cash or cash equivalents except where specifically authorized for a legitimate purpose; and
• not create an actual or apparent conflict of interest.

Additional care must be taken when dealing with government officials or public-sector representatives.

Where there is uncertainty, the gift or hospitality should be declined or escalated for review.

8. Conflicts of Interest

A conflict of interest may arise where personal interests interfere, or appear to interfere, with an individual's responsibility to act in Suova's best interests.

Potential conflicts may involve:

• ownership interests in a supplier or competitor;
• personal relationships affecting procurement or hiring decisions;
• outside employment;
• competing business activities;
• personal financial interests;
• accepting inappropriate benefits from clients or suppliers; or
• using confidential business opportunities for personal gain.

Actual, potential, or perceived conflicts of interest should be disclosed promptly to the appropriate person within Suova.

Having a conflict does not necessarily mean wrongdoing has occurred. What matters is that the situation is disclosed and appropriately managed.

9. Fair Competition

Suova supports lawful and fair competition.

We must not participate in arrangements intended to improperly restrict competition, including unlawful agreements concerning:

• pricing;
• bid coordination;
• market allocation;
• customer allocation;
• tender manipulation; or
• other anti-competitive conduct.

We compete based on the quality of our services, expertise, technology, client experience, commercial terms, and ability to deliver value.

Information about competitors should be obtained through legitimate means.

Confidential information belonging to competitors, former employers, clients, or third parties must not be obtained or used improperly.

10. Clients and Professional Services

We seek to build client relationships based on trust, clear communication, and responsible delivery.

When working with clients, we aim to:

• understand requirements before making material commitments;
• communicate scope and assumptions clearly;
• identify significant risks where reasonably possible;
• maintain appropriate confidentiality;
• protect access credentials and client systems;
• avoid intentionally overstating technical capabilities;
• provide reasonable transparency regarding project progress;
• communicate significant issues appropriately; and
• respect contractual commitments.

Project estimates, timelines, and expected outcomes may involve assumptions and uncertainties. They should therefore be communicated responsibly rather than presented as guarantees where they cannot reasonably be guaranteed.

11. Suppliers, Vendors, and Procurement

Suppliers and vendors should be selected using legitimate business considerations such as:

• capability;
• quality;
• reliability;
• security;
• price;
• commercial terms;
• reputation;
• compliance; and
• suitability for the relevant requirement.

Procurement decisions should not be improperly influenced by personal relationships, gifts, kickbacks, undisclosed financial interests, or other inappropriate benefits.

We expect third parties working with Suova to provide accurate information and conduct their business lawfully and responsibly.

12. Financial Integrity and Accurate Records

Business, financial, operational, and accounting records should accurately reflect the relevant transactions and activities.

No person may knowingly:

• create false invoices;
• falsify expense claims;
• record fictitious transactions;
• conceal improper payments;
• maintain unauthorized off-book funds;
• intentionally misclassify transactions; or
• alter records for fraudulent purposes.

Payments and reimbursements should have legitimate business purposes and appropriate supporting information.

Financial records must be maintained in accordance with applicable accounting, taxation, legal, and company requirements.

13. Fraud and Illicit Transactions

Suova does not tolerate fraud, theft, embezzlement, deliberate financial deception, money laundering, or the use of company activities to facilitate unlawful transactions.

Suspicious transactions or activities should be escalated when appropriate.

We may conduct reasonable verification, due diligence, or other checks on clients, suppliers, partners, or transactions where necessary to manage legal, security, financial, or reputational risks.

14. Confidential Information

We respect confidential information belonging to Suova, our clients, employees, partners, suppliers, and other third parties.

Confidential information may include:

• source code;
• credentials;
• API keys;
• architecture;
• security information;
• pricing;
• financial information;
• business plans;
• product roadmaps;
• trade secrets;
• project documentation;
• client information;
• unpublished designs;
• internal communications; and
• other information reasonably understood to be confidential.

Confidential information should only be accessed, used, or disclosed for legitimate and authorized purposes.

Confidentiality obligations may continue after an employment, contractor, project, or business relationship ends.

15. Personal Data and Privacy

Personal data must be handled responsibly and in accordance with applicable data protection requirements and Suova's relevant policies.

We seek to follow principles such as:

• lawful and transparent processing;
• purpose limitation;
• appropriate data minimization;
• reasonable accuracy;
• appropriate retention;
• security;
• confidentiality; and
• accountability.

Access to personal data should be limited to persons who legitimately require it.

Personal data obtained through client projects must not be used for unrelated purposes without an appropriate legal basis and authorization.

Further information regarding Suova's processing of personal data is available in our Privacy Policy.

16. Information Security and Cybersecurity

Security is a shared responsibility.

Individuals working with Suova systems or client systems are expected to take reasonable measures to protect:

• accounts;
• passwords;
• credentials;
• devices;
• source code;
• infrastructure;
• databases;
• development environments;
• client information; and
• other digital assets.

Prohibited or inappropriate conduct includes:

• sharing credentials without authorization;
• deliberately bypassing security controls;
• installing unauthorized malicious software;
• intentionally exposing secrets in public repositories;
• accessing data without a legitimate need;
• using client systems beyond authorized scope; and
• concealing known material security incidents.

Known or suspected security incidents should be reported promptly through the appropriate internal channel.

17. Responsible Technology Development

As a technology company, Suova recognizes that software and digital systems can affect businesses, users, and society.

We seek to develop and deliver technology responsibly.

Depending on the project, this may include reasonable consideration of:

• security;
• privacy;
• accessibility;
• reliability;
• maintainability;
• user safety;
• potential misuse;
• data quality;
• appropriate human oversight; and
• applicable legal requirements.

Technology should not knowingly be designed or implemented by Suova for unlawful purposes.

18. Artificial Intelligence and Automation

Where artificial intelligence, machine learning, automation, or similar technologies are used, we seek to apply appropriate professional judgment.

Depending on the context, relevant considerations may include:

• accuracy limitations;
• privacy;
• confidentiality;
• information security;
• intellectual property;
• human review;
• bias and fairness risks;
• transparency; and
• potential impacts on users.

Confidential client information should not be submitted to external AI services without appropriate authorization and consideration of applicable privacy, confidentiality, and security requirements.

AI-generated outputs should be appropriately reviewed when used in work where errors could materially affect clients, users, or business decisions.

19. Intellectual Property

We respect intellectual property rights.

Employees, contractors, and representatives must not knowingly use:

• unauthorized software;
• pirated materials;
• unlicensed commercial assets;
• improperly obtained source code;
• confidential third-party materials; or
• copyrighted content in violation of applicable rights.

Open-source software should be used in accordance with applicable licenses.

Ownership and licensing of intellectual property created for client projects will be determined by the relevant contract or other applicable agreement.

20. Respectful and Professional Workplace

Suova seeks to maintain a professional working environment based on dignity and respect.

Harassment, bullying, intimidation, threats, or other abusive conduct is not acceptable.

Employment and professional decisions should be based on legitimate considerations such as:

• capability;
• qualifications;
• experience;
• performance;
• conduct;
• role requirements; and
• business needs.

We seek to provide fair professional opportunities and prohibit unlawful discrimination in accordance with applicable law.

21. Human Rights and Fair Labor Practices

Suova supports fundamental principles of human dignity and responsible labor practices.

We do not knowingly support:

• forced labor;
• human trafficking;
• unlawful child labor;
• abusive working conditions; or
• exploitation of workers.

We expect suppliers and business partners to comply with applicable labor laws and to respect fundamental human rights in their operations.

22. Health and Safety

We seek to maintain working practices that reasonably protect the health and safety of people performing work for Suova.

Everyone is expected to:

• follow applicable workplace safety requirements;
• avoid conduct that unnecessarily puts others at risk;
• report significant hazards where appropriate; and
• act responsibly when working at client sites, offices, events, or other work environments.

23. Environmental Responsibility

We recognize the importance of responsible use of resources and environmental awareness.

Where reasonably practicable, we seek to:

• reduce unnecessary waste;
• use digital processes efficiently;
• consider energy and infrastructure efficiency;
• responsibly manage electronic equipment; and
• consider environmental impact when making relevant operational decisions.

Our environmental commitments may evolve as Suova's operations grow.

24. Public Communications and Social Media

Only appropriately authorized individuals may make official statements on behalf of Suova where authorization is required.

When representing Suova publicly, individuals should:

• communicate accurately;
• protect confidential information;
• respect intellectual property;
• avoid misleading statements;
• distinguish personal opinions from official company positions where necessary; and
• communicate professionally.

Personal social media activity should not falsely imply that personal opinions are official statements of Suova.

25. Government and Public-Sector Interactions

Interactions with government authorities and public-sector organizations must be conducted lawfully, transparently, and professionally.

No improper payment, benefit, gift, or other advantage may be offered to influence an official decision.

Requests for information from government or regulatory authorities should be handled through appropriate channels and in accordance with applicable law.

26. Political Activities

Individuals may participate in lawful political activities in their personal capacity.

Personal political opinions or activities should not be represented as an official position of Suova unless specifically authorized.

Company funds, assets, systems, or branding should not be used for political purposes without appropriate authorization and compliance with applicable law.

27. Reporting Concerns

We encourage concerns regarding suspected misconduct, unethical behavior, fraud, corruption, security incidents, privacy violations, conflicts of interest, or material violations of this Policy to be raised promptly.

Reports may be made to an appropriate manager or through Suova's official contact channel:

[email protected]

Reports should be made in good faith and contain sufficient information to allow reasonable review where possible.

Knowingly making false allegations or deliberately submitting misleading information is inconsistent with this Policy.

28. No Retaliation

Suova does not support retaliation against individuals who, in good faith:

• raise a legitimate concern;
• report suspected misconduct;
• request guidance;
• cooperate with an investigation; or
• exercise a legal right.

Retaliation itself may constitute a violation of this Policy.

This protection does not prevent appropriate action where a person knowingly makes a false accusation, falsifies evidence, or engages in misconduct.

29. Investigations and Cooperation

Suova may review or investigate suspected violations of this Policy where appropriate.

Individuals involved are expected to cooperate honestly with legitimate internal reviews or investigations.

Investigations should be handled as fairly, objectively, confidentially, and proportionately as reasonably practicable.

Information may be disclosed to authorities, advisers, clients, or other parties where required or appropriate under applicable law or contractual obligations.

30. Violations of This Policy

Violations of this Policy may result in appropriate action depending on the nature and seriousness of the conduct.

For employees or internal personnel, this may include corrective or disciplinary action in accordance with applicable agreements, company policies, and employment law.

For contractors, vendors, suppliers, or partners, consequences may include:

• corrective action requirements;
• suspension of work;
• termination of engagement; or
• other contractual remedies.

Serious matters may also be reported to competent authorities where required or appropriate.

31. Responsibilities of Leaders

Managers and leaders have additional responsibilities to:

• demonstrate ethical conduct;
• communicate expectations clearly;
• avoid encouraging results at the expense of integrity;
• respond appropriately to concerns;
• protect confidentiality;
• address known misconduct; and
• create an environment where employees and collaborators can raise concerns responsibly.

Leadership conduct should reinforce the principles contained in this Policy.

32. Expectations for Business Partners

We seek to work with business partners whose conduct is compatible with responsible and ethical business practices.

Depending on the nature and risk of the relationship, we may expect partners to maintain appropriate standards regarding:

• legal compliance;
• anti-corruption;
• fair competition;
• labor practices;
• confidentiality;
• information security;
• personal data protection;
• intellectual property; and
• responsible business conduct.

We may reconsider a business relationship where serious misconduct creates unacceptable legal, ethical, security, or reputational risk.

33. Questions and Guidance

No policy can address every possible situation.

Where there is uncertainty, individuals should consider:

• Is the action lawful?
• Is it consistent with Suova's values and policies?
• Would I be comfortable if the decision became public?
• Is there an undisclosed conflict of interest?
• Could the action harm a client, colleague, user, or business partner?
• Have I obtained appropriate authorization?
• Should I seek guidance before proceeding?

When in doubt, seek appropriate guidance before taking action.

34. Changes to This Business Conduct Policy

We may update this Policy from time to time to reflect changes in our:

• operations;
• organizational structure;
• services;
• technologies;
• business relationships;
• compliance requirements; or
• applicable laws and regulations.

When material changes are made, we will update the “Last updated” date displayed at the beginning of this Policy.

35. Contact Us

Questions, concerns, or reports relating to this Business Conduct Policy may be directed to:

PT Suova Technology Indonesia
Email: [email protected]
Website: suova.co.id
Phone: +62 851-3485-3769
Address: Jl. Jenderal Gatot Subroto, Times Square Paramount No. 87125, Kabupaten Tangerang, Banten 15810, Indonesia