Privacy policy

1. Who we are (Personal Information Controller)

ElleDesigns — a one-person studio run by Michelle Austria — decides how your data is used.

ElleDesigns ("ElleDesigns", "we", "us") — a one-person studio operated by Michelle Austria — is the Personal Information Controller responsible for personal data collected through this website, including the design catalog and the concept demo sites hosted under it.

We are committed to processing personal data fairly and lawfully in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).

2. Personal data we collect

What you type into the form, plus basic technical data your visit generates.

We collect only what we need to respond to you and deliver a project:

• Information you provide: your name, business name, email address and the contents of any message you send through the contact or quote form.
• Information collected automatically: technical data recorded by our hosting provider and analytics, such as IP address, approximate location, device and browser type, pages viewed, and the site you came from. This is used mainly in aggregate.
• Correspondence: emails and messages you exchange with us about a possible or ongoing project.

3. Purposes and lawful basis for processing

We use it to reply, quote, run a project, keep the site working, and meet legal duties.

We process personal data for the following purposes and on the following bases:

• To respond to your enquiry, prepare a proposal and quote, and carry out a project if you engage us — on the basis of steps taken at your request prior to entering a contract, and performance of that contract.
• To operate, secure and improve this website and understand which pages are useful — on the basis of our legitimate interests, balanced against your rights.
• To send you information you have asked for — on the basis of your consent, which you may withdraw at any time.
• To comply with legal, tax and accounting obligations — on the basis of legal obligation.

4. Sharing and disclosure

A short list of named service providers, and no one else — we never sell it.

We do not sell personal data and we do not use it for third-party advertising. We share it only with service providers acting as our Personal Information Processors under written instructions, and only as needed:

• Amazon Web Services (AWS) — hosts and serves this website (AWS Amplify Hosting, backed by Amazon S3 and Amazon CloudFront), and records standard server and request logs.
• Web3Forms (operated by Nextacular LLC) — receives the contents of the contact and quote form and forwards it to our email inbox.
• Our email provider — stores and lets us read and reply to your message.
• Plausible Analytics (operated by Plausible Insights OÜ) — cookieless website analytics that measures traffic in aggregate without identifying individual visitors.
• Google Analytics (Google LLC, measurement ID G-LK5C1CEBQD) — measures how the site is used. Google receives your IP address and sets cookies for this purpose under its own privacy policy; data may be processed on Google servers outside the Philippines.
• Professional advisers, or authorities and courts where disclosure is required or permitted by law.

5. Third-party content loaded by this site

Fonts, map tiles and stock images are served by third parties who see your IP address.

Some pages load resources from third parties who receive your IP address and standard request data under their own privacy policies: Google Fonts (typography), OpenStreetMap (map tiles on some demo pages) and Pexels (stock imagery). We do not control these providers.

6. Cross-border processing

Some providers store data outside the Philippines under contractual safeguards.

Some of our processors store or process data on servers outside the Philippines. Where this happens, we take steps intended to ensure a comparable level of protection through contractual commitments, consistent with the Data Privacy Act and NPC guidance on cross-border transfers.

7. Retention

We keep it only as long as we need it, then delete or anonymise it.

We keep enquiry correspondence for as long as needed to follow up and, where a project proceeds, for the duration of the engagement plus the period required for tax, accounting and legal purposes. Aggregated analytics are retained on a rolling basis by the analytics provider. When personal data is no longer needed, we securely delete or anonymise it.

8. Security measures

Reasonable technical and organisational safeguards, though no system is perfectly secure.

We maintain reasonable and appropriate organisational, physical and technical measures to protect personal data against loss, misuse and unauthorised access, in line with the Data Privacy Act. These include access controls, encryption in transit, limiting who can see enquiry data, and vetting our processors. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights as a data subject

Under the Data Privacy Act you can see, correct, object to, or delete your data.

Under the Data Privacy Act you have the right to:

• Be informed whether personal data about you is being processed, and how.
• Access the personal data we hold about you.
• Object to processing, including for direct marketing or automated decision-making.
• Have inaccurate or outdated personal data corrected (rectification).
• Suspend, withdraw or order the blocking, removal or destruction of your personal data (erasure or blocking) where the grounds under the Act apply.
• Data portability — obtain a copy of data you provided in an electronic, structured and commonly used format.
• Be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal data.
• Lodge a complaint with the National Privacy Commission.

10. How to exercise your rights or contact us

Email or call us and we will verify your identity and respond within the legal timeframe.

To exercise any of these rights, or for any question about how we handle your personal data, contact us at michaustriaqa@gmail.com or +63 947 150 0964. ElleDesigns is a one-person studio operated by Michelle Austria, who is the person responsible for data protection. We will verify your identity and respond within a reasonable period, and in any case within the timeframes required by law.

11. Complaints to the National Privacy Commission

You can complain to the NPC — please contact us first so we can try to fix it.

If you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission (NPC), 5th Floor, Delegation Building, PICC Complex, Roxas Boulevard, Pasay City 1307; email complaints@privacy.gov.ph; website https://privacy.gov.ph. We ask that you contact us first so we can try to resolve the matter.

12. Cookies and browser storage

A small amount of storage for preferences; you can clear it without breaking the site.

This site uses a small amount of browser storage to remember interface preferences. Analytics may set cookies to distinguish repeat visits. You can block or clear cookies in your browser without breaking core functionality.

13. Children

The site is for business enquiries; tell us if a minor has sent us data and we will delete it.

This site is intended for business enquiries and is not directed at children. We do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, contact us at michaustriaqa@gmail.com and we will delete it.

14. Changes to this policy

We may update this page; the effective date shows when it last changed.

We may update this policy from time to time. The effective date above shows when it last changed, and material changes will be highlighted on this page. Continued use of the site after a change means you have read the updated policy.