Privacy Statement
This statement explains how we collect, use, share and protect your Personal Data, and the rights you have over it.
The key points
| Who we are | HLB Hadori Sugiarto Adi & Rekan, the Personal Data Controller for the data described here. |
| What we collect | Mainly the details you give us, such as your name, organisation and contact details, plus basic technical data when you visit our website. |
| Why we use it | To answer your enquiries, deliver our services, meet our legal and professional obligations, and, with your consent, keep you informed. |
| Who we share it with | Only those who need it: the HLB International network, trusted service providers, and authorities where the law requires. We never sell your data. |
| How long we keep it | Only as long as we need it, or as long as the law and professional standards require |
| Your rights | You can access, correct, delete, restrict or withdraw consent for your data at any time, subject to the law. |
| How to reach us | privacy@hlbindonesia.id |
The sections below give the full details. This statement has been prepared in accordance with Law No. 27 of 2022 on Personal Data Protection (the “PDP Law”) and its implementing regulations.
01Who is responsible for your Personal Data?
HLB Hadori Sugiarto Adi & Rekan (“HLB Indonesia”, “we”, “us”) is a registered public accounting firm and business adviser with offices in Jakarta, Surabaya, Yogyakarta and Semarang, and a member of HLB International.¹
In most of our activities we act as the Personal Data Controller, which means we decide why and how your Personal Data is processed. When we handle data solely on a client’s instructions, for example in payroll services, we act as a Personal Data Processor, and our role is set out in the engagement letter with that client.
This statement applies whenever we obtain Personal Data through www.hlbindonesia.id, email and other correspondence, our forms and events, recruitment, office visits, and our work with clients and suppliers.
02What Personal Data do we collect?
The data we hold depends on how you interact with us. Most of it comes directly from you.
| If you are… | We may collect |
|---|---|
| A website visitor | Details you enter in our contact form (name, company, email, city, country, and your message), and technical data such as your IP address, browser type and pages viewed. |
| A newsletter subscriber or event participant | Your email address. For events, we also collect the name, organisation and contact details you provide when registering. |
| A client contact, director or shareholder | Name, position, organisation, contact details, signature, correspondence, and the identification details we need for customer due diligence. |
| Someone whose data appears in a client’s records | Information contained in the documents and systems we examine during an engagement, such as payroll, receivables, payables or transaction data. |
| A party we contact for confirmations | Name, position, contact details and your confirmation response. |
| A job applicant | Your curriculum vitae (CV), education and work history, contact details, interview notes, and supporting documents you provide. |
| A supplier or business partner | Name, position, organisation, contact details, tax number and payment details. |
| An office visitor | Name, organisation, telephone number, and time of entry and exit. |
Data collected automatically
When you browse our website or open our emails, some information is recorded automatically:
- IP address and log data, used to keep our website secure, fix technical issues and understand overall traffic trends;
- Cookies, which are explained in section 08;
- Analytics, using Google Analytics 4 delivered through Google Tag Manager, which gives us aggregated statistics on how our website is used;
- Email engagement, such as whether a newsletter was opened or a link was clicked, recorded by our email marketing platform, so that we can make our communications more relevant; and
- Live chat, provided by Brevo. If you start a chat we record the messages you send and any contact details you choose to give us;
- Browser notifications, provided by WonderPush, if you have allowed our website to send them. You can withdraw that permission in your browser at any time; and
- Bot protection, through Cloudflare Turnstile on our contact form, which checks that a form is submitted by a person rather than an automated script.
Specific Personal Data
The PDP Law gives extra protection to health, biometric and genetic data, criminal records, children’s data and personal financial data. We do not ask for these through our website. If such data is needed, for example personal financial data in an individual tax engagement, or appears in client documents we examine, we process only what is necessary and apply additional safeguards.
Children and persons with disabilities
Our website is not intended for anyone under 18. Where a child’s data must be processed as part of our services, such as dependants in a tax return, we do so with the consent of a parent or guardian or on another lawful ground. For persons with disabilities, we use appropriate means of communication and, where required, obtain the consent of a guardian.
03Why do we use your data, and on what legal ground?
We use Personal Data only for clear and legitimate purposes, and each purpose is backed by a lawful ground under Article 20 of the PDP Law.
| Purpose | What this involves | Legal ground |
|---|---|---|
| Answering your enquiries | Replying to messages and sending information you ask for | Your request; legitimate interests |
| Accepting new clients | Integrity checks and customer due diligence before we accept an engagement | Legal obligation |
| Delivering our services | Audit, review and assurance, tax, accounting, advisory, due diligence and forensic engagements, and related documentation | Contract; legal obligation |
| Quality control and inspections | Quality reviews by the HLB International network and inspections by regulators and professional bodies | Legal obligation; legitimate interests |
| Keeping you informed | Newsletters, HLB Insights publications and event invitations | Consent |
| Recruitment and employment | Selecting candidates and managing employment | Consent; contract |
| Running our office and systems | Procurement, visitor registration, access control and information technology (IT) security | Contract; legitimate interests |
| Protecting our rights | Invoicing, collections and handling disputes or complaints | Contract; legitimate interests |
In summary, the six lawful grounds available under the PDP Law are:
| Legal ground | What it means |
|---|---|
| Consent | You have given explicit consent for a specific purpose, and you may withdraw it at any time. |
| Contract | We need the data to perform a contract with you, or to act on your request before entering into one. |
| Legal obligation | The law requires it, including rules on public accountants, taxation and anti-money laundering. |
| Vital interests | The processing is needed to protect your vital interests. |
| Public interest | The processing is needed for a task in the public interest, where relevant. |
| Legitimate interests | It serves our legitimate business interests, such as securing our systems or improving our website, and does not override your rights. |
We will not use your data for an unrelated purpose without your consent unless the law allows it.
04Who can see your data?
We do not sell Personal Data, and we do not share it with anyone for their own marketing. We share it only where there is a clear need:
- Our people, who are authorised and only to the extent their role requires;
- HLB International and its member firms, for cross-border engagements, conflict checks and quality reviews, with access limited to authorised personnel;
- Trusted service providers, such as providers of email, cloud storage, audit software, website hosting and IT support, who act as our Personal Data Processors under data processing agreements;
- Regulators and authorities, including the Ministry of Finance, the Financial Services Authority (OJK), the Directorate General of Taxes, the Indonesian Institute of Certified Public Accountants (IAPI) and the Indonesian Financial Transaction Reports and Analysis Centre (PPATK), where required by law and after we have verified the request;
- Our legal advisers and auditors, where needed to protect our rights; and
- Other parties, with your consent or on the lawful instructions of our client. If we are involved in a merger or reorganisation, we will notify you as required by the PDP Law.
Transfers outside Indonesia
Some of our service providers store data in data centres outside Indonesia, including in the United States and the European Union, being the locations of Google, Cloudflare and Brevo. We transfer data abroad only if the destination offers protection at least equal to the PDP Law, or if binding safeguards such as a data protection agreement are in place, or, where neither applies, with your consent (Article 56 of the PDP Law).
05How long do we keep your data?
We keep Personal Data only as long as we need it, or as long as the law and professional standards require, whichever is longer.
| Type of data | How long we keep it |
|---|---|
| Audit and assurance engagement documentation | As required by law and professional standards |
| Tax documents | As required by applicable tax regulations |
| Contact details for our communications | Until you withdraw consent, or up to 24 months after your last interaction with us |
| Unsuccessful job applications | 12 months after the selection decision, unless you agree to a longer period |
| Office visitor log | 12 months |
| Website logs and cookies | According to each cookie’s lifespan, the longest being the Google Analytics cookies (_ga and _ga_*), which expire after 2 years |
When the period ends, we securely delete, destroy or anonymise the data so it can no longer identify you.
06How do we keep your data safe?
Confidentiality is a professional obligation for us. All our personnel are bound by confidentiality obligations under Law No. 5 of 2011 on Public Accountants and the Code of Ethics for Public Accountants, even after they leave the firm. We support this with the following safeguards:
- role-based access, so people see only what their work requires;
- strong passwords and multi-factor authentication;
- encryption of devices and of documents we exchange;
- physical security for our offices and archives; and
- anti-malware protection and regular backups.
No system can be guaranteed secure. If a Personal Data protection failure occurs, we will notify you and the competent authority in writing within 3 x 24 hours of becoming aware of it, explaining what happened, what data was affected, and what we are doing about it (Article 46 of the PDP Law).
07What are your rights?
Under the PDP Law you have the following rights:
| Your right | What it means | PDP Law |
|---|---|---|
| Be informed | Know who we are, why we process your data and on what legal basis | Article 5 |
| Correct | Complete, update or correct inaccurate data | Art. 6 |
| Access | Obtain access to, and a copy of, your data | Art. 7 |
| Erase | Ask us to stop processing and to delete or destroy your data | Art. 8 |
| Withdraw consent | Withdraw consent you have given, at any time | Art. 9 |
| Object to automated decisions | Object to decisions made solely by automated processing, including profiling | Art. 10 |
| Restrict | Ask us to suspend or limit processing | Art. 11 |
| Claim compensation | Sue and receive compensation for a breach in the processing of your data | Art. 12 |
| Data portability | Receive your data in a commonly used format and have it sent to another controller | Art. 13 |
How to make a request
| 1 Send your request Email privacy@hlbindonesia.id with the subject “Data Subject Rights Request”. | 2 Verify your identity We verify your identity before releasing any data. | 3 Receive our response We respond within 3 x 24 hours of receiving your complete request, free of charge for reasonable requests. |
Please note: much of the data we hold sits in engagement documentation that we are legally required to keep. We cannot delete it before the retention period ends, and we may limit access where it would reveal another person’s data or a client’s confidential information, or where an exemption under Article 15 of the PDP Law applies. We will always explain our reasons.
Your choices
You do not have to give us your Personal Data, although without some details we may not be able to respond to you or provide a service. Where we rely on consent, we ask for it clearly, for example through an unticked checkbox on our forms. You can unsubscribe using the link in any of our emails, or contact us, and we will stop the related processing within 3 x 24 hours.
08How do we use cookies?
Cookies are small files stored on your device that help a website work and remember your preferences. Our cookie banner explains the cookies we use and lets you manage them.
| Type | Purpose | Your choice |
|---|---|---|
| Strictly necessary | Keep the website running and secure | Always on |
| Performance and analytics | Show us how the website is used so we can improve it (Google Analytics 4) | Your consent |
| Functional | Remember preferences such as language and your chat session | Your consent |
| Social media and targeting | Not used. Our website does not load social media tracking or advertising scripts | Not applicable |
You can change your preferences at any time through Change cookie settings at the bottom of every page, or in your browser settings.
09What about other websites?
Our website links to other sites, including HLB International and its member firms, and lets you share content on social media. Those sites and platforms follow their own privacy policies, not this statement, so please review them before sharing any Personal Data.
10Will this statement change?
We review this statement regularly and update it when laws or our practices change. The latest version is always on this page, with the date shown at the top. If we make significant changes, we will let our subscribers know by email or place a clear notice on our website.
11Questions about your Personal Data?
Whatever your question, our Personal Data Protection team is here to help.
HLB Hadori Sugiarto Adi & Rekan
World Capital Tower, Kawasan Mega Kuningan, Jakarta Selatan 12980, Indonesia
Email: privacy@hlbindonesia.id
Phone: +62 21 5091 7957/58/59
¹ HLB International is a worldwide network of independent professional accounting firms and business advisers, each a separate and independent legal entity. HLB International Limited does not provide services to clients, and no member firm can bind HLB International Limited or any other member firm. This statement applies to HLB Indonesia only.
