Privacy Policy
Last updated: 3 August 2026 · Effective from: 1 September 2026
1. Who we are
Expat.or.id publishes information for expatriates in Indonesia. This policy explains what personal data we collect, why, and what rights you have over it.
Our website address is https://expat.or.id. We are the data controller for personal data collected through this Site. Contact: [email protected].
This policy is written to meet Indonesia’s Personal Data Protection Law (UU No. 27 of 2022). Because a substantial number of our readers are citizens or residents of the European Union and the United Kingdom, it also reflects the requirements of the GDPR and UK GDPR.
2. What we collect
Information you give us
| What | When |
|---|---|
| Email address | Newsletter signup |
| Name, email, message | Contact form, correction reports, contributor enquiries |
| Name, email, organisation, phone | Advertising and sponsorship enquiries |
| Name, email, review text | Directory reviews and testimonials |
| Enquiry details | School or service enquiry forms, where offered |
Comments
When you leave a comment on the Site we collect the data shown in the comment form, together with your IP address and browser user-agent string, to help with spam detection.
An anonymised string created from your email address (a hash) may be provided to the Gravatar service to check whether you use it. The Gravatar privacy policy is available at automattic.com/privacy. After your comment is approved, your profile picture is visible to the public alongside your comment.
You may opt in to saving your name, email address and website in a cookie so you do not have to re-enter them next time. That cookie lasts one year.
Media uploads
If you upload images to the Site, please avoid uploading images with embedded location data (EXIF GPS). Visitors can download images from the Site and extract any location data they contain.
Embedded content from other websites
Articles may include embedded content such as videos, maps or social posts. Embedded content behaves exactly as if you had visited that other website. Those sites may collect data about you, set their own cookies, embed additional third-party tracking, and monitor your interaction with the embedded content — including if you are logged in to that service.
Information collected automatically
| What | Purpose |
|---|---|
| IP address, approximate location | Security, abuse prevention, aggregate audience reporting |
| Browser, device, operating system | Ensuring the Site works across devices |
| Pages visited, time on page, referrer | Understanding which guides are useful |
| Cookie identifiers | Analytics and advertising — see section 5 |
| Cached page copies | Performance — see section 5 |
We do not knowingly collect sensitive personal data (health, religion, political opinion, biometric or financial data). Please do not include such information in messages to us.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Sending the newsletter you asked for | Consent |
| Replying to your enquiry or correction | Consent / legitimate interest |
| Passing an enquiry to a school or service you selected | Consent |
| Publishing a review, comment or testimonial you submitted | Consent |
| Spam detection on comments and form submissions | Legitimate interest |
| Measuring which content is read | Consent (analytics cookies) / legitimate interest |
| Displaying advertising | Consent (advertising cookies) |
| Site security and abuse prevention | Legitimate interest |
| Meeting legal or tax obligations | Legal obligation |
Where we rely on consent, you may withdraw it at any time — see section 8.
4. Who we share it with
We do not sell your personal data. We share it only with:
- Service providers who operate parts of the Site on our behalf — hosting, email delivery, analytics and advertising (section 5). They act on our instructions.
- Businesses you deliberately contact through an enquiry form. We tell you before you submit, and share only what is needed for them to reply.
- Spam detection services, which check comments and form submissions automatically. This involves sharing the submission content, IP address and user agent.
- Authorities, where required by Indonesian law or a valid legal order.
If you request a password reset, your IP address will be included in the reset email.
Advertisers receive aggregate audience statistics only. They do not receive your personal data from us.
5. Cookies and similar technologies
We use four categories of cookie. On your first visit, a consent banner lets you accept or reject everything except the strictly necessary category. You can change your choice at any time via the cookie settings link in the footer.
| Category | What it does |
|---|---|
| Strictly necessary | Session handling, security, remembering your cookie choice. Cannot be disabled. |
| Preferences | Remembering language, saved neighbourhoods, and display settings. |
| Analytics | Google Analytics — which pages are read, for how long, and from where. IP addresses are anonymised. |
| Advertising | Google AdSense and equivalent networks — serving and measuring ads, limiting repetition. May involve personalised advertising where you have consented. |
WordPress cookies
The Site runs on WordPress, which sets a small number of functional cookies:
- If you opt in when commenting, cookies storing your name, email and website — one year.
- If you visit the login page, a temporary cookie to check whether your browser accepts cookies. It contains no personal data and is discarded when you close your browser.
- For logged-in contributors: login cookies lasting two days (two weeks with “Remember Me”), and screen-preference cookies lasting one year. A further cookie recording the post ID of an article you just edited expires after one day.
Caching
The Site uses LiteSpeed Cache, together with QUIC.cloud, to serve pages faster. Caching stores temporary duplicate copies of pages on display. Cache files expire on a schedule set by the administrator and can be purged at any time. They are not accessed by third parties except as necessary for technical support from the cache vendor. See the QUIC.cloud privacy policy.
Third-party cookies are governed by the privacy policies of those providers. You can also control cookies through your browser settings, and opt out of personalised Google advertising at adssettings.google.com.
6. International transfers
Some of our service providers store or process data outside Indonesia, including in the United States and the European Union. Where personal data of EU or UK residents is transferred outside those territories, we rely on Standard Contractual Clauses or an equivalent safeguard. Where personal data is transferred out of Indonesia, we take the steps required by UU No. 27 of 2022.
7. How long we keep it
| Data | Retention |
|---|---|
| Newsletter subscription | Until you unsubscribe, then 30 days |
| Contact form messages | 24 months from last correspondence |
| Advertising enquiries | Duration of relationship, plus 5 years for tax records |
| Published reviews and testimonials | Until you ask us to remove them |
| Comments and their metadata | Retained indefinitely, so follow-up comments can be recognised and approved automatically |
| Registered contributor profiles | For the life of the account. You can view, edit or delete your details at any time |
| Analytics data | 26 months, then aggregated |
| Server access logs | 90 days |
8. Your rights
Under UU No. 27 of 2022 and, where applicable, the GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Delete your data, where we have no overriding legal reason to keep it.
- Withdraw consent at any time, including by clicking unsubscribe in any newsletter.
- Object to or restrict processing based on legitimate interest.
- Portability — receive your data in a machine-readable format.
- Complain to the relevant supervisory authority in Indonesia, or your local data protection authority if you are in the EU or UK.
If you hold an account or have left comments, you can request an exported file of the personal data we hold about you, or ask us to erase it. Erasure does not extend to data we are obliged to keep for administrative, legal or security reasons.
To exercise any of these rights, email [email protected]. We respond within 30 days and may ask you to verify your identity first. There is no charge.
9. Security
We use HTTPS across the Site, keep our platform and plugins patched, restrict administrative access to named accounts with multi-factor authentication, and review our providers’ security practices. No system is perfectly secure, and we cannot guarantee absolute security of data transmitted to us.
Data breach procedure
Suspected or actual breaches are reported internally to the site administrator immediately. We assess the scope and risk, contain the incident, and record it in a breach log. Where a breach is likely to affect your rights, we notify the relevant supervisory authority and affected individuals within the timeframes required by law. To report a suspected vulnerability or breach, email [email protected].
Data we receive from third parties
We receive aggregate, non-identifying audience data from our analytics and advertising providers. We do not purchase personal data, and we do not receive marketing lists from third parties.
Automated decision-making
We do not carry out automated decision-making that produces legal or similarly significant effects. The only automated processing on the Site is spam filtering of comments and form submissions, and ad personalisation by third-party networks where you have consented. You can object to either by contacting us or by withdrawing advertising-cookie consent.
10. Children
The Site is intended for adults. We do not knowingly collect personal data from anyone under 17. If you believe a child has provided us with data, contact us and we will delete it.
11. Changes to this policy
We may update this policy. The current version is always published here with the date shown at the top. If we make a material change to how we use your data, we will notify newsletter subscribers by email and display a notice on the Site.
12. Contact
Privacy questions and data requests: [email protected]