Draft for professional review
Privacy Notice
This notice must be completed so it reflects the business’s real registrations, providers, processes, client types, and retention practices before publication.
When this notice applies: From the first collection or processing of personal information, including an initial project enquiry, and throughout any deposit, project, payment, launch, care, and retention period.Add every provider actually used, confirm the listed retention periods, record a publication/revision date, and obtain appropriate professional review.
1. Who we are
EJBCreatives Web Development Services, trading publicly as EJB Creatives, provides website design, development, maintenance, domain, and related digital services from Capiz, Philippines. For the information described here, the business may act as a personal information controller.
Privacy contact: ejbcreatives26@gmail.com. Public/service address: 1909 Magallanes Street, Roxas City, Capiz, Philippines. Data protection contact: ejbcreatives26@gmail.com.
For some client websites, EJB Creatives may process information only on the client’s documented instructions. In that situation, the client is normally the controller and EJB Creatives acts as its processor; the client’s own privacy notice also applies.
2. Information we may collect
- Identity and contact information, including name, business name, email, phone, country, and address where required.
- Enquiry and project information, including goals, content, files, brand assets, feedback, and communications.
- Transaction and billing information, including invoices, payment status, currency, and transaction references. Full card details should remain with the payment provider.
- Technical information that hosting and security providers may receive, such as IP address, browser/device information, request logs, and pages visited.
- Support information and access details that a client deliberately provides through an agreed secure method.
Do not send passwords, payment-card details, government IDs, health data, or other sensitive information by ordinary email.
3. Sources of information
Information may come directly from emails, calls, contracts, payments, support requests, and project collaboration. It may also come from authorised client staff or contractors, public business sources, referral partners, and service providers used to deliver a project.
4. Why information is used
- Respond to enquiries and prepare quotes.
- Take requested pre-contract steps and perform contracts.
- Design, build, test, launch, maintain, and secure websites.
- Register or manage domains and email when instructed.
- Process payments, issue invoices, maintain records, and meet legal obligations.
- Communicate about projects, renewals, support, and service changes.
- Prevent misuse, protect lawful rights, and respond to security incidents.
Applicable grounds under Philippine law may include consent, contract necessity, requested pre-contract steps, legal obligations, protection of lawful rights and interests, and other grounds permitted by the Data Privacy Act and its rules. The ground depends on the activity and must be verified.
5. Providers and recipients
Information may be disclosed only as needed to configured hosting, email, domain, payment, accounting, collaboration, security, and professional-adviser providers, or where law requires it. The current public-site provider list is:
| Provider | Purpose | Data | Region | Notes |
|---|---|---|---|---|
| Vercel | Website hosting and delivery | IP address and technical request data | Provider-controlled global infrastructure | Review Vercel project settings and current terms before launch. |
| Google (Gmail) | Receive and manage project enquiries and business email | Email addresses, message content, attachments, and email metadata | Provider-controlled global infrastructure | Visitors choose what to include when they send an email. Sensitive information should not be sent by ordinary email. |
6. International transfers
Providers and overseas clients may involve storage or processing outside the Philippines. The business must identify the relevant locations, safeguards, and contractual arrangements before launch. Foreign privacy or consumer requirements may also apply when services target or handle people in another country.
7. Retention
| Record type | Retention period |
|---|---|
| Enquiries that do not become clients | 6 months |
| Unaccepted quotes and proposals | 12 months |
| General project files and communications | 2 years after completion |
| Signed contracts, scopes, and approvals | 10 years after completion or termination |
| Invoices, payments, and accounting records | At least 5 years, calculated under the applicable BIR requirements |
| Security logs, and contact-form logs if added later | 90 days |
| Website backups | 30–90 days on a rolling basis |
| Client credentials | Deleted or returned within 30 days after handover or service termination |
| Care-plan support records | For the duration of the plan, plus 2 years |
| Marketing records | Until consent is withdrawn or the person opts out |
| Opt-out suppression list | Email address and opt-out status only, for as long as needed to prevent further marketing |
| Cookie-consent record | 6–12 months, then a new choice is requested |
| Portfolio permission | While displayed, plus 2 years after removal |
Information should be deleted or anonymised when it is no longer needed, subject to legal, accounting, dispute, backup, and security requirements.
8. Security
Reasonable technical and organisational safeguards may include access controls, strong authentication, secure transfer methods, software updates, limited provider access, backups, and incident procedures. No system or transmission can be promised as perfectly secure.
9. Your rights
Subject to the Philippine Data Privacy Act, its rules, and applicable exceptions, individuals may have rights to be informed, access information, object, correct inaccurate information, erase or block information, data portability, make a complaint, and seek damages in appropriate cases. Contact ejbcreatives26@gmail.com to make a request. Identity may need to be verified proportionately.
You may also contact the National Privacy Commission. Where UK, EEA, or another country’s mandatory rules apply, additional rights and safeguards may be required; this draft does not assume they always apply.
10. Cookies, analytics, and children
The basic static site does not intentionally set analytics, advertising, or marketing cookies. Hosting infrastructure may still process technical request data. See the Cookie Notice.
This website is intended for business enquiries and is not directed at children. If children’s information may be handled for a particular project, obtain specific professional advice and implement appropriate safeguards before collection.
11. Changes
This notice may be updated when providers, services, law, or processing practices change. Material changes should be communicated where appropriate, and the effective date above must be updated.