Privacy policy.

This policy covers alabdesign.co and any enquiry you send us. It applies wherever you are, and it's written to meet the GDPR, the UK GDPR, the Philippine Data Privacy Act, and the Australian and New Zealand privacy acts.

Alab Design Co. is a web design and development studio in the Philippines. We decide how the personal data described here is used, so we're responsible for it: the data controller under the GDPR, and the personal information controller under Philippine law. For anything about your data, including requests for our data protection officer, email hello@alabdesign.co.

We only collect what you send us, plus visit counts that don't identify you. We don't buy data or build profiles.

Payments go through PayPal or Wise, so we never see your card or bank details. Please leave sensitive information, such as health or financial details, out of your message.

• To reply to your enquiry and send you a copy of what you sent.
• To keep a record of our conversation in our CRM, so nothing gets lost.
• To quote, deliver and invoice work if you become a client.
• To see which pages and links help visitors, from counts that don't identify you.
• To keep spam and abuse off our forms.

Under the GDPR, our legal bases are legitimate interest for replying to enquiries, counting visits and stopping spam, contract for client work and the steps you ask for before it, and legal obligation for keeping tax records.

A few services handle data for us. Each one only processes it on our instructions.

• Bonsai: our CRM, proposals and invoicing
• Resend: sends the emails when you submit a form
• Google Workspace: our email, where replies to you are written
• Cloudflare: hosting, the contact form, spam protection and cookie-free visit counts
• Umami: cookie-free visit counts, stored in the EU
• PayPal and Wise: payments, if you become a client

We only share data with anyone else when the law requires it.

We work from the Philippines. Our Umami visit counts stay in the EU, and most of our other providers store data in the United States. When data leaves the EU, UK, Australia or New Zealand, we rely on our providers' standard contractual clauses or equivalent safeguards.

We don't use cookies for analytics or advertising, and our visit counts don't store anything on your device. That's why there's no cookie banner.

If Cloudflare's security checks flag a visit as a possible bot, Cloudflare may set a short-lived cookie once you pass its check. It keeps the site secure and isn't used to track you.

You can ask us to show you, correct, export or delete the data we hold about you. You can also object to how we use it or ask us to limit it. It's free, though we may ask you to confirm who you are first.

Email hello@alabdesign.co and we'll reply within two business days, and finish within 30 days.

If you're unhappy with our answer, you can complain to your local regulator: the National Privacy Commission (Philippines), your EU data protection authority, the ICO (UK), the OAIC (Australia) or the Privacy Commissioner (New Zealand).

This site is for businesses. We don't knowingly collect data from anyone under 16.

The site runs over HTTPS, the keys that connect our services are stored encrypted, and only Alab can open the accounts that hold your data. No system is perfectly secure, so if a breach puts your data at risk, we'll tell you and any regulator the law requires.

When we change this policy, we update the date at the top of the page. If a change affects how we use data you've already given us, we'll email you first.