Privacy policy

2. What we collect, and when

We collect in two stages, and the second one only starts if you ask us to act for you.

• When you enquire. Your name, WhatsApp number, email address, the nationality you select, whatever you type into the message box, and — as the record of the consent you gave with the checkbox — the moment you gave it and the request it came from. Nothing more: we do not ask for a document in order to answer a question.
• When you engage us. The documents an application actually requires: passport biodata page, photograph, and depending on the index a sponsor’s identity card and family card, a marriage certificate, an employment contract, company registration documents, proof of funds or bank statements, a police certificate, and previous visa or stay-permit records. Which of these we need is set by the index you are applying for, and we will tell you the list before you send anything.
• Automatically, when you use the site. Standard server request logs (IP address, browser, the pages requested), the language and nationality choices you make so the page can answer you, and any campaign parameters in the link you arrived on so we know which advert or article brought you here.

Please do not send us identity documents over email, or in a first message before we have asked for them. If a document reaches us that we did not need, we delete it rather than file it.

3. Why we are allowed to hold it

Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, "UU PDP") requires a lawful basis for each purpose. Ours are:

• Your consent — for the enquiry itself. You give it with the checkbox on the form, and you can withdraw it at any time, which stops us contacting you.
• Performing our contract with you — for assessing, assembling, filing and tracking an application you have engaged us for, and for invoicing it.
• Complying with a legal obligation — for what Indonesian immigration, manpower and tax law require us to submit, keep and be able to produce.
• Our legitimate interest — for keeping the site secure, keeping records of what we advised and when, and understanding which pages answer people’s questions.

4. The enquiry form and WhatsApp, specifically

The form on this site posts to us. We record your enquiry — the fields you filled in, the page you sent it from, any campaign parameters in the link you arrived on, and the fact and time of your consent — and then we hand you to WhatsApp with the enquiry composed into a message for you to send.

So there are two copies, and you should know about both. Ours is on our own systems and is covered by everything else in this policy. The one you send travels through WhatsApp — a Meta service, with its own privacy terms and its own servers outside Indonesia.

One useful consequence: if you would rather not use WhatsApp at all, you can simply close it without pressing send. We already have your enquiry, and we will reply by email instead.

Never send a passport scan or an identity document over WhatsApp, whoever is asking. Once we are acting for you, documents come in through a portal we control.

5. Who else sees it

We share the minimum necessary, with these recipients and no others:

• Indonesian authorities. The Directorate General of Immigration, and where an index requires it the Ministry of Manpower, the investment authority or the relevant embassy. This is the whole point of an application and it cannot be opted out of.
• Your counterparty on the case. Where an employer, an event organiser or an Indonesian sponsor is the party sponsoring you, they see the status of the application they are sponsoring and the documents they are legally required to hold. They do not see documents that are none of their business.
• Service providers, under contract. Our hosting provider, email provider and payment processors, each only what they need to do their part. They may not use your data for anything else.
• Professional advisers, where we need legal or accounting advice on a case.

We do not sell your personal data, we do not rent our enquiry list, and we do not pass your contact details to another agent.

6. Where it is stored, and how it is protected

Identity documents are held in private storage that is not reachable by a public URL. They are served only to an authorised staff member through a controller that checks permission first, and every read is written to an audit log with the account, the time and the address that made it. Sensitive fields and document paths are encrypted at rest.

Access is by role rather than by seniority: not everyone who works on your case can open a passport scan, and the ones who cannot, cannot. Staff accounts require multi-factor authentication.

Our primary systems are hosted in Indonesia or Singapore. Where a service provider processes data outside Indonesia — WhatsApp, and our email provider — we rely on their contractual commitments and the safeguards UU PDP requires for a cross-border transfer.

7. How long we keep it

Not indefinitely, and not "just in case".

• Enquiries that never became a case — twelve months from your last message, then deleted.
• Identity documents — deleted once the application is decided and delivered and any window for a re-filing has passed, unless a law requires us to keep a specific record longer.
• Case records and invoices — kept for the period Indonesian tax and company law require, currently ten years for accounting records.
• Audit logs — kept for as long as the records they describe, because a log that outlives its subject is the only way to answer a question about who looked at what.

Deletion is enforced by a scheduled job that actually removes the files and records the removal, not by someone remembering to. If you want your documents deleted sooner than the schedule, ask — we will do it unless a legal obligation stops us, and we will tell you if one does.

8. Your rights

Under UU PDP you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong or out of date;
• delete what we hold, where no legal obligation requires us to keep it;
• stop processing it, or stop using it for a particular purpose;
• withdraw a consent you previously gave, which we will act on immediately going forward;
• send you your data in a portable form, or send it to someone else.

Write to halo@orpvisa.com. We answer within fourteen days, and we do not charge for it. If you are not satisfied with our answer you can complain to the Indonesian data protection authority, and nothing in this policy takes that right away.

9. Cookies and measurement

This site sets very little, and nothing that follows you elsewhere.

• A session cookie, so a form you are filling in does not lose its place. Strictly necessary; it expires when you close your browser.
• A preference cookie if you dismiss the banner that offers you the page for your own nationality or language, so it does not ask again.

There is no advertising cookie, no third-party analytics script and no tracking pixel on this site today. If that changes, this clause changes before the script does — and if the new one needs consent, you will be asked for it rather than told about it.

10. Children

Our services are for adults. We do process children’s data where a child is a dependent on a family application — a spouse KITAS with children, for instance — and in that case it comes to us from the parent or guardian who is applying, with their consent, and it is held to the same rules as everything else in this policy.

11. If something goes wrong

If personal data we hold is exposed or lost, we will tell the affected people and the authority within the period UU PDP requires, and we will say what happened, what was affected and what we are doing about it. We would rather tell you about a problem than have you discover one.

12. Changes to this policy

When we change this policy we move the date at the top of the page. For a change that materially affects how we use data you have already given us, we will contact you rather than rely on you re-reading the page.

This policy describes Indonesian law and our own practice. It is not legal advice about your situation.