Privacy policy
How we process your personal data, written to follow Law No. 27 of 2022 on Personal Data Protection (the PDP Law) and Government Regulation No. 33 of 2026.
Version 1.0, effective 23 October 2026
In short: we use your data only to respond to your request and to carry out legal work. No cookies, analytics or advertising. Requests that do not go ahead are deleted within 90 days, and you can ask for access or deletion at any time.
1. Who we are
The controller of personal data for this site is Bahori Ahoen & Partners, with offices at Menara Aksara, Lantai 9, Jl. H.R. Rasuna Said Kav. B-0, Jakarta Selatan 12920 and business ID (NIB) 0000000000000 (sample).
2. Data protection contact
For questions or requests about your personal data, contact our data protection contact at office@bahoriahoenpartners.com or call +62 21 1234 5678 during office hours. If we appoint a data protection officer, their name will be listed here.
3. Data we process
- Meeting form: name, email, company name and phone number if given, the service chosen, summary of the issue, meeting preference, and the time and version of your consent.
- Correspondence: the content of emails, WhatsApp messages or call notes you send us.
- Clients: identity data, case documents and billing data needed to act under a power of attorney or legal services agreement.
- Technical logs: IP address, browser type and access time recorded by our hosting provider for site security.
- AI assistant: the questions you type into the information assistant. See the AI assistant section.
Please do not send specific personal data, such as health data, children’s data or criminal records, through the form. If it is genuinely needed, we will ask for it through a secure channel after the consultation.
4. Purposes and legal bases
| Purpose | Legal basis (Article 20, PDP Law) |
|---|---|
| Responding to consultation requests and running conflict checks | Your consent |
| Acting under a power of attorney or legal services agreement | Performance of a contract |
| Meeting legal obligations, including customer due diligence rules that apply to advocates | Legal obligation |
| Keeping the site secure and preventing abuse | Legitimate interest |
We do not sell personal data, use it for advertising or make automated decisions about you.
5. How long we keep data
- Consultation requests that do not go ahead: deleted 90 days after receipt.
- Client files: for the life of the matter and 5 years after it closes, unless the law requires longer, such as 10 years for bookkeeping records.
- Technical logs: 30 days at most.
6. Other parties that process data
We use data processors bound by confidentiality and data protection agreements. Provider names below are samples for this prototype.
| Processor | Role | Data location |
|---|---|---|
| Hosting and CDN provider (sample) | Serving the site and forwarding forms | Singapore |
| Office email provider (sample) | Receiving and storing correspondence | Singapore |
| WhatsApp (Meta) | Messages you send via WhatsApp | Outside Indonesia, under WhatsApp’s policies |
| Google (Gemini API) | Answering questions in the AI assistant | Outside Indonesia, under Google’s terms |
For transfers outside Indonesia, we make sure the destination country or processor offers equal or higher protection, or we put adequate and binding safeguards in place, as Article 56 of the PDP Law requires.
7. Your rights
As a data subject, you have the right to:
- be informed about how your data is processed;
- access and obtain a copy of your data;
- correct or complete inaccurate data;
- ask for deletion or for processing to stop;
- withdraw consent at any time;
- delay or restrict processing; and
- object or bring a claim as the law allows.
Send requests to office@bahoriahoenpartners.com. We respond within 3×24 hours of receiving a request and may first ask you to verify your identity. Withdrawing consent does not affect earlier processing, and some data may be kept where the law or an advocate’s duty of confidentiality requires it.
8. Security and incidents
This site is served over HTTPS only. Form submissions go to an access-restricted mailbox, accounts use two-step verification, and the whole team is bound by confidentiality. If a data protection failure affects your data, we will notify you and the data protection authority within 3×24 hours, as Article 46 of the PDP Law requires.
9. AI assistant
The information assistant on this site uses Google’s Gemini AI model. It only explains our services and how to book a meeting, based on the content of this site; its answers are not legal advice and do not create an advocate–client relationship.
- Your question and the recent conversation are sent to Google to be answered. We do not store conversations on our servers.
- This trial version uses Gemini’s free service, whose terms allow Google to use conversation content to improve its products. Please do not type personal data, client data or case details into the assistant.
- The conversation is kept in your browser (sessionStorage) and is cleared when you close the tab or start a new conversation.
For confidential matters, please use the meeting form or contact us directly.
11. Changes to this policy
This is version 1.0 of the policy, effective 23 October 2026. Material changes will be announced on this page with a new version number. Each consent given through the form records the policy version in force when you sent it.
We are here to help
Tell us briefly about the business or legal issue. The 60-minute preliminary meeting is free of charge with written limits, and we reply within one working day.