Introduction

Hiswara Bunjamin & Tandjung (“HBT”, “we”, “our” or “us”) is an Indonesian legal practice. It has an association with the international legal practice of Herbert Smith Freehills Kramer (“HSF Kramer”) See this HBT website and www.hsfkramer.com/legal-and-regulatory for further details about our structure and association.We are committed to ensuring that when we collect and use personal data provided to us or personal data about visitors to our websites (as described below) we do so in accordance with applicable Indonesian data privacy laws.This Privacy Policy explains how we may use personal data that we obtain about you. For further information, please contact [email protected]. Your use of our online services or your provision of personal data to us constitutes your acknowledgment of the terms of this Privacy Policy. Please do not send us any of your personal data if you do not want it to be used in the ways described in this Privacy Policy

Scope of privacy policy

This Privacy Policy applies when we receive any personal data from you, our clients or other third-parties, including in the following circumstances:

  • when you request personal data from us or provide personal data to us;•when you or the organisation you work for engages our legal and other services;
  • when you or the organisation you work for are a counterparty, or provide services to a counterparty, of one or more of our clients;
  • as a result of your relationship with one or more of our clients, including when you or the organisation you work for is a regulator, government agency, court, tribunal or other law enforcement agency;
  • when you apply for a role or work placement opportunity, open day or recruitment event with us;
  • when you complete application forms on our Websites;
  • when you attend our seminars or other hosted events;
  • when we conduct open source searches on you in connection with our business acceptance or business development processes;
  • when you visit our Websites and online services (including our mobile apps);
  • if you are an alumni of the firm; and
  • when you are entered onto our mailing lists to receive publications and other marketing emails.

Personal data collection

General

We will collect personal data directly from you, from clients, from authorised representatives or from any other publicly available resources. We may also collect personal data from third parties such as regulatory authorities, your employer, other organisations with whom you have dealings, government agencies, credit reporting agencies, recruitment agencies, personal data or serviceproviders, publicly available records and the third parties described in the ‘Disclosure of your personal data’ section below. If we collect personal data from third parties, we will conduct verification of such personal data based on different sources of personal data which are legally recognized in Indonesia.

We will handle any unsolicited personal data in accordance with Indonesian law, including destroying or de-identifying such personal data where we are required to do so by a relevant law.

We may collect current and historical personal data including your name (including name prefix or title), contact details (such as your postal address, email address and phone number(s)), nationality, identification, gender, organisation, business interests, employment, positions held, special categories of data (such as race and ethnicity, trade union membership, personal data about health or personal data, political opinions or religious beliefs), billing and financial personal data (such as billing address, bank account and payment personal data) and enquiry/complaint details. We may also collect personal data about your other dealings with us and our clients, including any contact we have with you in person, by telephone, email or online.

Online services

When you use our online services, we may collect the following:

  • Personal data you provide by completing forms (this includes personal data you give us when registering for any of our online services, subscribing to our services, submitting material or requesting further services);
  • Personal data you provide to us if you contact us, for example to report a problem with our online services or raise a query or comment; and
  • Details of visits made to our online services including, but not limited to, the volume of trafficreceived, logs (including, where available, the IP address and location of the device connecting to the online services and other technical personal data and identifiers about the device and the nature of the visit) and the resources accessed.

Careers and Recruitment

If you apply for a job or work placement you may need to provide personal data about your education, employment, racial background and state of health. Your application will constitute your express consent to our use of this personal data to assess your application and to allow us to carry out any monitoring activities which may be required of us under applicable law as an employer. We may also carry out screening checks (including reference, background, directorship, financial probity, identity, eligibility to work, vocational suitability and criminal record checks) and consider you for other positions. We may exchange your personal data with academic institutions, recruiters, screening check providers, health service providers, professional and trade associations, law enforcement agencies, referees and your current andprevious employers. Without your personal data we may not be able to progress considering you for positions with us.

Pre-employment screening

As part of Herbert Smith Freehills Kramer's pre-employment screening, a third party will conduct social media checks on the firm's behalf. These checks involve searches of publicly accessible social media profiles.

Alumni

If you are a former employee and wish to join our alumni programme we will collect personal data such as your contact details (including addresses and phone numbers), personal data about your current employment and professional qualifications, basic details of your time with us and personal data about your preferences and engagement with the programme.

CCTV

Our offices are protected by CCTV and you may be recorded when you visit. We use CCTV to help provide a safe and secure environment for our visitors. Further personal data can be found in our CCTV Privacy Policy.

Use of your personal data

We may use your personal data if:

  • it is necessary for the performance of a contract with you or the organisation you work for; or
  • necessary in connection with a legal regulatory or contractual obligation; or
  • you have provided your consent (where necessary) to such use or the organisation that you work for has obtained your consent (where necessary); or
  • we (or a third-party) have a legitimate interest; or
  • we are otherwise required or authorised by law.

We may use your personal data to:

  • provide and improve our services and products to you or the organisation you work for (including auditing and monitoring use of those services and products);
  • maintain and develop our relationship with you and our clients;
  • monitor and analyse our business;
  • facilitate our internal business operations;
  • fulfil our legal, regulatory (including in relation to anti-money laundering or sanction requirements), accounting, reporting, risk management or professional or contractual obligations;
  • identify services you may be interested in;
  • send you legal updates, publications, marketing and details of events;•protect, establish, exercise or defend legal and contractual rights; and
  • process and respond to requests, enquiries or complaints received from you.

We may not be able to do these things without your personal data.

We will only retain your personal data for as long as is reasonably necessary in the circumstances. Personal data provided in connection with the provision of our legal services will be retained in accordance with the firm's retention policies and applicable data protection and other legislation unless we agree otherwise with you, in writing. Our online services may have different retention periods which you will be notified of separately when you access those services. If you wish to know more about the firm’s retention policies or any of the firm’s different retention periods, please contact [email protected].

Under applicable data protection legislation we have a duty of care to ensure that your personal data is accurate and up to date. Therefore, please advise us of any changes to your personal data at [email protected].

Disclosure of your personal data

We own the database rights in the personal data collected. We do not trade in or rent out this personal data. As a  firm in association with the international legal practice of Herbert Smith Freehills Kramer, we may in providing our services and operating our business, allow our associated firm and our service providers to access your personal data subject to compliance with Indonesian privacy laws.HBT has in place an intra-group transfer agreement to safeguard these personal data transfers. If, in the future, we re-organise or transfer all or part of our business, we may need to transfer your personal data to new entities or third parties through which our business will be carried out, subject to compliance with Indonesia privacy laws.

In addition, subject to compliance with Indonesian privacy laws, we may exchange your personal data with third parties where:•You have provided written consent to us sharing your personal data in this way;

  • We are under a legal, regulatory or professional obligation to do so (for example, in order to comply with anti-money laundering requirements) or in order to enforce or apply our Terms of Business (or other client terms) or to protect the rights and interests, property, or safety of HBT, our clients or others;
  • All, or substantially all the assets of HBT are merged with or acquired by a third party, or we expand or re-organise our business, in which case your personal data may form part of thetransferred or merged assets or we may need to transfer your personal data to new entities or third parties through which our business will be carried out;
  • It is relevant in the circumstances to disclose the personal data to our clients, your employer or place of business, your professional advisers and parties with whom we have co-promotional arrangements (such as jointly sponsored events);
  • We provide anonymous statistical personal data about users of our websites and related usage personal data to reputable third parties, including analytics and search engine providers; or

We may share, transfer or disclose your personal data with third parties including:

  • our clients, your professional advisers and your employers or place of business;
  • third parties involved in the provisions of services to clients including barristers, local counsel and other professional advisers;
  • our professional advisers, auditors and insurers;
  • third party service providers to whom we outsource services, for example archival, auditing, reference checking, professional advisory (including legal, accounting, financial and business consulting), IT support, mailing house, delivery, website, social media, research, banking, payment, client contact, data processing, insurance, forensic, litigation support, data room, marketing and security services;
  • third party technology organisations, including cloud service providers, such as data storage platforms;
  • third parties with whom we have co-promotional arrangements (such as jointly sponsored events);
  • third parties who carry out research and analyses of our services and products on our behalf; or
  • regulatory authorities, courts, tribunals, government agencies, law enforcement agencies and other third parties.

Some of the third parties with whom we share personal data may be located outside your country or the country from which the data were provided (collectively the “jurisdiction of origin”), including in the countries where HSF Kramer has offices (see “HSF Kramer office locations” below) or the countries where a firm with which HSF Kramer has an association or alliance has an office. While such third parties will often be subject to privacy and confidentiality obligations, you accept that where lawful such obligations may differ from and be less stringent than the requirements of the privacy laws of the jurisdiction of origin. In those cases we are not responsible for imposing the laws of the jurisdiction of origin, and you may not be able to seek redress under those laws.

Some of your personal data may be stored with, and managed by a cloud service provider located outside of Indonesia. If you have any questions in relation to the transfer of your personal data, please contact us at [email protected].

Security

The transmission of personal data via the internet is not completely secure. We cannot guarantee the security of your data transmitted to our online services; any transmission is at your own risk. Once we have received your personal data, we will take reasonable steps to use procedures and security features to try to prevent unauthorised access, modification or disclosure. For example, electronic communications through non-secure web platforms including WhatsApp may not be secure, virus- free or successfully delivered. If you communicate with us using a non-secure web platforms, you assume the risks that such communications between us are intercepted, not received, delayed, corrupted or are received by persons other than the intended recipient.

We take reasonable steps to hold personal data securely in electronic or physical form, including the following:

  1. We store personal data in access controlled premises or in electronic databasesrequiring logins and passwords.
  2. We require our third party data storage providers to comply with appropriate personal data security industry standards.
  3.  All partners and staff and third party providers with access to confidential personal data are subject to confidentiality obligations.
  4. All partners and staff with access to confidential personal data receive training on personal data protection under Indonesian privacy laws for the purpose of preventing failure to protect personal data and we require our third party providers with access to confidential personal data to do the same.

Subject to compliance with Indonesian privacy laws, the data that we collect from you may be transferred to, and stored at, a destination outside the jurisdiction of origin. It may also be processed by staff operating outside the jurisdiction of origin who work for us or our associated firm or for one of our or their suppliers.

You can help us to keep your personal data secure; please remember that any user name or password in relation to our websites is personal to you and should not be made available to any other person. You should stop using your username and password and notify us immediately if you suspect that someone else may be using them.

Cookies

Our online services use cookies and other similar technologies, for example, to distinguish you from other users when you browse our websites or use our online services and also to allow us to improve our online services.

Please refer to our Cookie Policy.

Third party sites

Our Websites contain links to other sites which are controlled by third parties.

Visitors should consult these other sites' privacy policies and please be aware that we do not accept responsibility for their use of personal data about you

Your rights

The privacy laws in Indonesia may give you the right to access, amend or erase your personal data or, in some circumstances, to restrict or object to the processing of your personal data.

If you would like to take steps to exercise any of your rights please contact us in writing as set out below. We may refuse to provide access and may charge a fee for access if the relevant legislation allows us to do so, in which case we will provide reasons for our decision as required by law.

In the limited circumstances where you have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the rights to withdraw your consent for that specific processing at any time.

Personal data we hold about you should be up-to -date and accurate. Please advise us in writing of any changes to your personal data using the contact details set out below.

At any time if you would prefer to stop receiving newsletters and updates from us, please use the “unsubscribe” option included in the email or other material.

Status of this policy

Your use of our websites and online services to us constitutes your acceptance of the terms of this Privacy Policy.

Technologies and personal data governance practices are constantly developing. We may therefore need to revise this Privacy Policy in future. You should therefore review this page regularly to ensure that you are aware of any changes to its terms.

Contact and further information

To find out more about HBT and its associated firm HSF Kramer, please visit www.hsfkramer.com/locations

If you have any questions about this Privacy Policy, or want to submit a written complaint about how we handle your personal data, please contact our Privacy Officer via [email protected] or call your HBT contact.

If you make a privacy complaint, we will respond to let you know how your complaint will be handled.We may ask you for further details, consult with other parties and keep records regarding your complaint.

Our associated firm HSF Kramer office locations

HSF Kramer offices and its associated offices are located in Australia, UK, Germany, Belgium, Indonesia, Italy, Spain, USA, South Africa, France, United Arab Emirates, the Kingdom of Saudi Arabia, Thailand, China (including Hong Kong), Singapore and Japan, although its services extend beyond these locations. For the most current list of its offices and other key regions it services, see www.hsfkramer.com/locations.

Last updated: June 2025