This policy explains what Lex Aeterna Law Firm does with personal data collected through this website. It covers the website only. Personal data we hold because you are a client is governed by our engagement terms and by professional obligations of confidentiality, which are stricter than anything set out here.
In short
We collect what you type into the enquiry form and basic technical data your browser sends. We use it to answer you and to keep the site working. We do not sell it, we do not run advertising trackers, and we delete enquiry correspondence that does not become a matter.
Who is responsible
Lex Aeterna Law Firm, Jl. Danau Sunter Utara No. 7A, Sunter Agung, Jakarta Utara 14350, Indonesia, is the data controller. Enquiries about this policy go to ask@lexaeternalawfirm.com.
What we collect
- Enquiry form data — the name, organisation, email address, country, subject area and one-line description you submit.
- Correspondence — email and messaging exchanges you initiate.
- Technical data — IP address, browser type, pages requested and timestamps, recorded in standard server logs.
We do not ask for, and ask you not to send, confidential case details, documents or evidence through this website. See our contact page for why.
Why we hold it, and on what basis
| Purpose | Basis under Law No. 27 of 2022 |
|---|---|
| Responding to your enquiry | Explicit consent — Art. 20(2)(a); and steps taken at your request before any engagement — Art. 20(2)(b) |
| Conflict checking before we reply | Other legitimate interests of the controller — Art. 20(2)(f) |
| Keeping the site secure and available | Other legitimate interests of the controller — Art. 20(2)(f) |
| Meeting professional and statutory record-keeping duties | Legal obligation — Art. 20(2)(c) |
The technical detail of these obligations is set out in Government Regulation No. 33 of 2026, the implementing regulation of Law No. 27 of 2022, enacted on 16 July 2026 and taking full effect on 16 January 2027.
How long we keep it
- Enquiries that do not become a matter — deleted within 12 months.
- Enquiries declined for conflict — a minimal record of names and the date is retained so that future conflict checks work. Nothing describing the substance is kept.
- Server logs — retained for the period set by our hosting provider for security and diagnostics.
- Client files — retained for the period required by professional obligations, under the engagement terms rather than this policy.
Who else sees it
Our hosting provider processes data on our behalf as a necessary part of operating the site. Where a matter requires co-counsel, foreign counsel or an expert, we obtain your instructions before sharing anything. We disclose personal data to a public authority only where the law requires it, and we do not sell or rent personal data to anyone.
Sending data outside Indonesia
Our hosting is operated from servers outside Indonesia, and a matter may require us to instruct foreign counsel. Article 56 of Law No. 27 of 2022 permits personal data to leave Indonesian territory only where the receiving country affords protection equal to or higher than Indonesian law; failing that, where adequate and binding safeguards are in place; and failing both, only with your explicit consent. Articles 160 to 166 of Government Regulation No. 33 of 2026 set out how that assessment is to be made and recorded.
In practice this bears on enquiries very little, because we ask you not to send case documents through this website. Where a matter does require your material to leave Indonesia, we tell you before it goes, and on which of those three bases.
Your rights
Under Law No. 27 of 2022 on Personal Data Protection you may ask for an explanation of how your data is processed (Art. 5), correction of inaccurate data (Art. 6), access and a copy (Art. 7), deletion (Art. 8), and withdrawal of consent (Art. 9). The same law gives you the right to object to a decision taken solely by automated processing (Art. 10), to ask us to delay or restrict processing (Art. 11), and to receive your data in an interoperable format and have it transmitted to another controller (Art. 13). If you write to us from the European Economic Area or the United Kingdom, we handle your request on these same terms; we do not ask where you are before acting on it.
To exercise any of these, write to ask@lexaeternalawfirm.com. We respond within 30 days. We may ask you to confirm your identity before acting, and some rights are limited where the data forms part of a client file we are professionally obliged to retain.
Cookies
This site sets no advertising or analytics cookies. Typefaces are loaded from Google Fonts, which places a request to Google’s servers carrying your IP address; no cookie is set by that request.
Security
The site is served over HTTPS and administrative access requires two-factor authentication. No website is perfectly secure, which is the reason this one does not ask for sensitive information in the first place. Should a failure of personal data protection nonetheless occur, Article 46 of Law No. 27 of 2022 requires us to notify you, and the supervisory authority, in writing within 3 × 24 hours.
Changes
Material changes to this policy are published here with a revised date. This version is dated 5 October 2026.