Privacy policy.

01Who we are

Bangun & Partners (“we”, “us”) is an Indonesian law firm with its office at Plaza 5 Pondok Indah A-8, Jl. Margaguna Raya, Jakarta 12140, Indonesia. For the personal data described in this policy, we act as the personal data controller (Pengendali Data Pribadi) within the meaning of the PDP Law.

02Scope of this policy

This policy covers visitors to this website and people who contact us through it, including prospective clients.

Once we are engaged, the personal data we handle in the course of a matter is also governed by our terms of engagement and by our duty of professional confidentiality as advocates under Law No. 18 of 2003 on Advocates. Where those terms or that duty give you stronger protection than this policy, they prevail.

03Personal data we collect

Data you give us

When you use our enquiry form, we collect your name, email address and message. You may also give us your company or organisation, a phone or WhatsApp number, and the area of law you are interested in. We may receive the same kinds of data if you write to us or call us directly.

Please do not send us specific personal data (data pribadi yang bersifat spesifik) through the website. Under Article 4 of the PDP Law this includes health, biometric and genetic data, criminal records, children’s data and personal financial data. Please also leave out confidential or privileged information about your matter. We will ask for what we need once a conflict check is cleared and terms of engagement are agreed.

Data collected automatically

Like most websites, our hosting provider’s servers keep standard technical logs when you visit. These include your IP address, browser and device type, the pages you request, and the date and time. We use these logs only to run, secure and troubleshoot the website. We do not use them to build profiles of visitors.

04How we use it, and on what basis

Article 20 of the PDP Law requires a lawful basis for every use of personal data. We rely on the following:

• Your consent — to read and respond to your enquiry. You give this consent when you tick the box on our enquiry form. You can withdraw it at any time.
• Steps before and during an engagement — to run conflict checks, prepare a proposal or engagement letter, and then act for you.
• Legal obligations — to comply with laws that apply to us, including the customer due diligence (Prinsip Mengenali Pengguna Jasa) and reporting duties that apply to advocates under Indonesia’s anti-money-laundering rules, and to respond to lawful requests from competent authorities.
• Legitimate interests — to keep this website secure, to prevent spam and abuse of our forms, and to establish or defend legal claims. We weigh these interests against your rights.

We do not sell personal data. We do not use it for advertising or for automated decisions that significantly affect you.

05Cookies and third-party resources

This website does not use cookies or similar technologies for analytics, advertising or tracking.

To display the site properly, your browser loads fonts from Google Fonts (Google LLC). When it does, Google receives your IP address and basic browser information, which it handles under its own privacy policy. If we ever add analytics or other cookies, we will update this policy first and, where the law requires it, ask for your consent.

06Who we share it with

We share personal data only where necessary, and only with:

• Service providers that host this website and handle our email. They act on our instructions as data processors (Prosesor Data Pribadi) and must protect the data.
• Co-counsel, experts and other advisers — for example, foreign counsel on a cross-border matter. We do this only in connection with your matter and with your agreement.
• Courts, regulators and law enforcement — where Indonesian law requires it, subject to our duty of confidentiality as advocates.
• A successor — if all or part of our practice is reorganised or transferred. In that case we will notify you as required by Article 48 of the PDP Law.

07Transfers outside Indonesia

Some of our service providers, and some co-counsel on cross-border matters, store or process data outside Indonesia. Where personal data leaves Indonesia, we follow Article 56 of the PDP Law. We make sure that the recipient’s country gives protection equal to or higher than the PDP Law, or that adequate and binding safeguards are in place. Where neither applies, we transfer the data only with your consent.

08How long we keep it

We keep personal data only for as long as we need it for the purposes in this policy:

• Enquiries that do not lead to an engagement — kept for up to two years so we can follow up and keep a record for conflict checks, then deleted.
• Client and matter records — kept for as long as our engagement terms, our professional obligations and statutory record-keeping periods require.
• Server logs — kept for the short period set by our hosting provider, then overwritten automatically.

When a retention period ends, we delete or destroy the data, or anonymise it so it can no longer identify you, as Articles 43 to 46 of the PDP Law require.

09Security

This website is served over an encrypted connection (HTTPS). Access to enquiries and client data is limited to the people at the firm who need it, and they are bound by professional confidentiality. No system is completely secure, however. If a failure of personal data protection affects you, we will notify you and the competent authority in writing within 3 x 24 hours of becoming aware of it, as Article 46 of the PDP Law requires.

10Your rights

As a personal data subject under Articles 5 to 13 of the PDP Law, you have the right to:

• be told who is processing your data, why, and on what legal basis;
• complete, update or correct inaccurate data;
• access your data and obtain a copy;
• ask us to stop processing, or to delete or destroy your data;
• withdraw your consent at any time, without affecting processing that took place before you withdrew it;
• object to decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you;
• ask us to delay or restrict processing, in proportion to its purpose;
• receive your data in a commonly used, machine-readable format and have it sent to another controller, where technically possible; and
• sue for and receive compensation for any breach of the law in the processing of your data.

To exercise any of these rights, contact us through our contact page. We may need to verify your identity first. We will respond within the time limits set by the PDP Law. Some rights may be limited by the exceptions in Article 15 of the PDP Law, by our legal obligations, or by our duty of confidentiality to clients. If so, we will tell you why.

11Children

This website and our services are intended for businesses and adults. We do not knowingly collect personal data from children. If we learn that we have, without the consent of a parent or guardian as Article 25 of the PDP Law requires, we will delete it.

12Third-party websites

This website links to other websites, such as announcements of matters we have worked on. We are not responsible for how those websites handle personal data. Please read their own privacy policies.

13Changes to this policy

We may update this policy to reflect changes in the law, in our practice or in this website. The date at the top of the page shows when it was last changed. If a change significantly affects how we use data we already hold, we will tell you, and we will ask for your consent where the law requires it.

14Governing law and complaints

This policy is governed by the laws of the Republic of Indonesia. If you have a concern, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the personal data protection authority established under the PDP Law, or with the Ministry of Communication and Digital Affairs.