When you send us your details
The consultation form asks for your name, your email address, your WhatsApp number if you want to give it, and what you need help with. When you press send, your details go to our server and are emailed to our team. The form does not open WhatsApp; once your enquiry has reached us you can choose to continue there (see "Where it is kept, and who else sees it"). With your enquiry we also keep the language you were reading in, the page you sent it from and the button that opened the form, so we know what you were asking about. If you agreed to analytics, we attach the random numbers that link your visits, and if you agreed to "where visitors come from", we attach the website or campaign that brought you here. We do not keep your internet address or browser details with an enquiry. Our lawful basis is that you asked us to contact you: steps taken at your request before an engagement (UU PDP Article 20(2)(b)). It does not depend on your cookie answer, and refusing cookies never stops us replying. An enquiry is deleted automatically six years after we receive it. Please do not put tax ID numbers, passwords, identity documents or financial records in the form.
While you are reading
If you agree to analytics, we record the pages you open, how far down each one you scroll, how long you spend on each, which links and buttons you press, when you change language, and which fields of the consultation form you fill in (never what you type in them). On the first page of each visit we also note the language you are reading in, your device's time zone, which is how we estimate your country, and whether your device has a touch screen. All of this is linked to two random numbers: one for your browser, kept until your answer expires, and one for the visit, which ends when you close the tab. Neither is your name, and neither can be used to recognise you on another website. We do not keep your internet address with these records. Our lawful basis is your explicit consent (UU PDP Article 20(2)(a)), and you can withdraw it at any time without giving a reason. These records are deleted automatically after thirteen months.
Where you came from
Only if you agree to "where visitors come from": the website that sent you here (its address, not the page) and any campaign tags in the link, such as which of our adverts or posts it was. We keep this with your visit records and with any enquiry you send, so that we know which of our efforts reach people. We do not keep the click identifiers that advertising networks add to links, and we give nothing to any advertising network.
If you say no
If you refuse, we keep only your answer itself on your device, in "justo-consent", so that we do not ask again on every page. We create no identifier and set no cookie. We still count each page you open and the language you read it in, but the count carries no identifier and no internet address, so it cannot be tied to you, to another visit or to an enquiry. Your browser sends each count to our server like any other request, and we do not store your internet address with it. We rely on our legitimate interest in knowing how many people read our site (UU PDP Article 20(2)(f)). It is the most we take from someone who has said no.
Proof of your answer
When you answer the cookie question, our server keeps a record of the answer: what you allowed, when, on which page, in which language, and against which version of this notice. UU PDP requires us to be able to show the consent we rely on (Article 24). If you accept, or later change or withdraw your answer, the record also carries your browser's random number, so that it can be matched to what was collected under it. It never carries your internet address or details of your browser. If you refuse, the record carries no identifier at all, and we keep it only to see how the question is answered. These records are kept for twenty-six months: the thirteen months your answer lasts, plus the thirteen months the data collected under it is kept.
What we do not do
We do not try to recognise your device from its settings. For analytics, our scripts read only the time zone and touch-screen setting mentioned above, and only if you accept. They do not read your screen size or browser details, and they do no canvas, audio or font probing. Clearing this site's data in your browser removes everything it stored there. We do not read what you type into the form until you send it. We do not sell your data or give it to anyone for their own use, we run no advertising trackers, and the site loads nothing from other companies. Even the fonts are served from our own hosting.
What is kept on your device
This site sets no cookies for visitors. It keeps a few small entries in your browser's own storage, which only this site's pages can read and which go nowhere unless the page sends them. "justo-consent" holds your answer to the cookie question and the date you gave it, for thirteen months, whatever you answered. "justo-visitor" holds your browser's random number and exists only if you accept analytics. "justo-session" holds the random number for one visit, also only with analytics, and ends when you close the tab. "justo.lang" holds the language you picked, if you picked one, until you pick another or clear your browser's storage. When your answer is thirteen months old, or this notice changes in a way that needs a new answer, we delete the answer and both random numbers and ask you again. Withdrawing your consent deletes the random numbers straight away. Before you answer, the site reads only its own saved answer and language; on your first visit it uses your browser's language setting to choose which language to show, without sending it anywhere. It also deletes, without reading them, any entries left by earlier versions of this site.
Where it is kept, and who else sees it
This site and its records are on a server in Singapore that we rent from our hosting company, DomaiNesia. Consultation enquiries are stored there, and a copy is emailed to our own mailboxes at justoaccountant.com, which DomaiNesia hosts on the same server: enquiries written in Arabic go to Ahmed and Monzer, all others to our office. Singapore has its own data protection law, the Personal Data Protection Act 2012. Nothing goes to an analytics company or an advertising network. The consultation form never opens WhatsApp by itself. Once your enquiry has reached us, you can choose to continue on WhatsApp, which opens with a short message that contains only your enquiry's reference. The other WhatsApp links on this site open a chat with a general greeting. WhatsApp is a Meta service, so a message you send us there is handled by WhatsApp as well as by us, under Meta's own terms and privacy policy. The same goes for the map and social media links: they take you to those companies' own services, where their terms apply rather than ours.
Children
This site is for businesses and their owners. It is not aimed at children, and we do not knowingly collect personal data from anyone under 18; under UU PDP that would need a parent's or guardian's consent (Article 25). If you believe a child has sent us their details, tell us and we will delete them.
If something goes wrong
We protect what we hold with encrypted connections, and we keep it in storage that no web address can reach, behind a dashboard that only we can sign in to. If a breach of personal data ever happens, we will tell the people affected and the authority in writing within 3 × 24 hours of finding out, as UU PDP Article 46 requires.
Records kept to protect the site
Some records exist only to keep this site and the data on it safe, and we rely on our legitimate interest in doing that (UU PDP Article 20(2)(f)). To stop the form and the page counter being flooded, our server keeps a scrambled (hashed) form of your internet address with a count of your recent requests: for five minutes for page counts, and for one hour for enquiries. Every attempt to sign in to our dashboard is logged with its time, internet address, type of browser and whether it worked, and the last 200 attempts are kept. An address that fails to sign in is remembered for up to two hours after its last attempt, so that it can be locked out, and an address that signs in successfully is remembered for 30 days. These counts and addresses are cleared out at least once a day after their time is up. Like any web server, our hosting company's server also keeps standard logs of the requests it answers, with the internet address, the time, the page asked for, the page that linked to it and the browser's own description of itself. These logs stay on the same server in Singapore and are deleted on our hosting company's schedule.
Your rights
Under Indonesia's Personal Data Protection Law (UU PDP, Law 27 of 2022) you can ask what we hold about you and for a copy of it, ask us to correct it, ask us to stop using it or to delete it, withdraw your consent, ask us to pause or limit what we do with it, and ask for it in a form you can take elsewhere. You can also tell us if you object to anything we do on the basis of our legitimate interest, and you can claim compensation if we process your data unlawfully (Article 12). Withdrawing consent takes one click at the bottom of every page, and it does not undo what was lawful before you withdrew. For anything else, write to the address below. We will answer within 3 × 24 hours, the time UU PDP sets.
Wherever you are reading from
Every visitor is treated the same way, wherever they are. Nothing is recorded about you until you answer the cookie question, and we do not try to work out where you are before you have answered. Justo serves clients in Indonesia. If you are reading from another country, including one in the European Union, the choices and rights described on this page apply to you in the same way.
If you think we have got this wrong
Tell us first: write to the address below and we will look into it. You do not have to come to us first, though. You can complain to the personal data protection authority set up under UU PDP, and complaining costs you nothing.
