Anonymous analytics
When you visit, we use Google Analytics 4 to see which pages get traffic, where in the world visitors are roughly coming from, what device they're on, and how they got here. It helps us understand and improve the website.
Analytics cookies aren't set by default. You'll see a banner asking whether to opt in. Accept, and Google sets cookies (_ga, _ga_<id>) and we receive aggregated reports. Reject, and Google Analytics receives only cookieless consent-mode pings without analytics cookies.
Form submissions
Fill out our Request a Quote form and we receive what you submit: full name, email address, phone number, industry, and message. We also record the submission time. We store the submission in our website CMS and use Resend to deliver a notification to our team's inbox.
We use this information to respond to your inquiry, discuss potential work, and keep a record of the conversation. Unless we need it longer for an active relationship, legal requirement, dispute, or security reason, we aim to delete or anonymize quote submissions within 24 months after the last meaningful contact.
Bot protection
We use Google reCAPTCHA on the form to keep automated submissions out. reCAPTCHA may set its own cookies and read technical signals from your browser. See Google's privacy notice for details.
Website hosting and CMS operations
This website is built on PayloadCMS and Next.js and runs on hosted infrastructure. Our hosting, database, file-storage, and deployment providers process the technical data needed to serve the site, store CMS content, store quote submissions, deliver media files, monitor availability, and protect the service.
This may include server logs, IP addresses, browser and device information, request timestamps, CMS records, uploaded media, and operational metadata. We use this data to operate, secure, maintain, and improve the website.
Admin accounts
If you are one of our staff or authorized CMS users, we process the information needed to create and manage your admin account, including your name, email address, authentication credentials, account activity, and timestamps. We use this to control access to the CMS and protect unpublished website content.
Internal admin activity logs
When our staff use the website's admin interface to create, edit, publish, or delete content, or to log into their accounts, we record the action, the staff member responsible, the time, and the IP address and browser used. We keep these records for 12 months and then automatically delete them. We do this to investigate incidents, recover from accidental changes, and meet our security obligations under the GDPR, Malaysia's PDPA, and the Philippines' Data Privacy Act.
Where a lawful basis is required, we rely on our legitimate interests in operating, securing, and maintaining accountability for our content management system, unless a different basis is required by applicable law. These records are not generated by visiting our public website. They cover only authenticated staff actions inside our admin interface.
Where applicable rights to access, correction, objection, restriction, or erasure of these records exist, we will respond within 30 days. We may retain entries until the 12-month retention window expires where earlier deletion would conflict with security, legal-compliance, incident-investigation, or legal-claim obligations.