Privacy Policy
This policy explains how BMD & Partners collects, uses, shares and protects personal data through this website and in the course of our work, and the rights you have over that data.
Prepared with reference to Law No. 27 of 2022 on Personal Data Protection and Government Regulation No. 33 of 2026 implementing it, Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions, and Regulation of the Minister of Communication and Informatics No. 20 of 2016 on Personal Data Protection in Electronic Systems, to the extent still in force.
1. Who we are
BMD & Partners, Gedung Lina, 2nd Floor, Suite 212, Jl. H.R. Rasuna Said Kav. B7, Kuningan, Jakarta 12910, is the personal data controller for the data described in this policy. Our data protection officer is the Managing Partner. Questions can be sent to enquiries@bachroem.net (subject: “Personal Data”), attention of the Managing Partner.
2. Personal data we collect
- Identity and contact data: name, job title, company, email address, telephone number.
- Enquiry data: what you write to us through the contact form, by email or by telephone.
- Matter data: information provided for a legal matter, which may include specific personal data such as financial, health or criminal records data, only where the matter requires it.
- Technical data: IP address, browser type, device, pages visited and time of access, collected automatically when you use the website.
We collect data directly from you, from your organisation or advisers, and from public sources such as company registers and court records. Where we receive data about you from others, we will inform you as required by law.
3. Legal bases
We process personal data on one or more of the bases recognised by Law No. 27 of 2022: your explicit consent; performance of an engagement with you or steps you request before it; compliance with our legal obligations; and our legitimate interests, assessed against your rights.
4. How we use it
- to respond to enquiries and assess whether we can act, including conflict checks;
- to provide legal services and manage our relationship with clients;
- to meet legal, regulatory and professional obligations;
- to send regulatory updates and insights you have asked to receive (you can unsubscribe at any time);
- to operate, secure and improve this website.
We do not sell personal data or use it for automated decision-making that has legal effects on you.
5. Cookies
The website uses cookies that are necessary for it to work, such as remembering your language choice. Analytics cookies, if used, are set only with your consent and can be refused or withdrawn through the cookie banner or your browser settings.
6. Who we share it with
Only where necessary: with service providers acting on our instructions (such as website, email and IT hosting), bound by confidentiality and data processing terms; with other advisers, counterparties or courts as a matter requires; and with authorities where required by law. Each recipient receives only the data needed for its purpose.
7. Transfers outside Indonesia
Some of our service providers may store data on servers outside Indonesia. Where data is transferred abroad, we ensure an adequate level of protection or appropriate safeguards, such as contractual clauses, as required by Law No. 27 of 2022 and its implementing regulations.
8. How long we keep it
We keep personal data only for as long as needed for the purposes above and for the periods required by law and professional rules. Enquiries that do not lead to an engagement are deleted after 12 months. When the retention period ends, data is deleted or anonymised.
9. Security and confidentiality
We apply technical and organisational measures, including access controls, encryption in transit and staff confidentiality obligations, to protect personal data against loss, misuse and unauthorised access. Client information is also protected by advocates’ professional confidentiality under Law No. 18 of 2003 on Advocates.
10. Your rights
Subject to the law, you have the right to:
- obtain information on why and how your data is processed;
- access and obtain a copy of your data;
- correct or update inaccurate or incomplete data;
- request deletion, or end or restrict processing;
- withdraw consent at any time, without affecting earlier processing;
- object to decisions based solely on automated processing;
- receive your data in a commonly used format and have it transferred; and
- claim compensation for violations, in accordance with the law.
Send requests to enquiries@bachroem.net. We will verify your identity and respond within 3 × 24 hours of receiving a complete request, or as otherwise required by law. Some rights may be limited, for example where data is protected by professional confidentiality or needed for legal proceedings.
11. Data breaches
If a failure of personal data protection occurs, we will notify affected individuals and the competent authority in writing within 3 × 24 hours, describing the data involved, when and how it happened, and the steps taken to handle and recover from it.
12. Children
This website is not directed at children. We process children’s personal data only with the consent of a parent or guardian, or as otherwise permitted by law.
13. Changes to this policy
We may update this policy. The current version is always published on this page with its date; material changes will be highlighted on the website.
14. Contact and complaints
For questions or complaints, contact the Managing Partner at enquiries@bachroem.net or +62 (0)21 5254518. If you are not satisfied with our response, you may complain to the authority responsible for personal data protection, currently the Ministry of Communication and Digital Affairs pending establishment of the personal data protection agency.