Legal Info
Data Privacy
This policy explains how Bagong Proceso Oficina, Inc., operating as Lumikha Teams ("Lumikha", "we", "us") collects, uses, shares, and protects personal data when you visit lumikha.co and our related sites, contact us, or work with us as a client.
If you are applying for a role with Lumikha, our Applicant Privacy Notice covers how we handle your application data.
We are based in the Philippines and follow the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules, and the issuances of the National Privacy Commission (NPC). Where other privacy laws apply to you, Section 10 explains your additional rights.
What We Collect
Information you give us
Contact details — name, work email, phone number, company, job title, country.
Enquiry details — what you tell us about your business, team, and needs through forms, email, calls, or meetings.
Client engagement information — contract contacts, billing details, and information shared during scoping and delivery.
Newsletter and content preferences, if you subscribe.
Information collected automatically
Device and usage data — IP address, browser type, device type, pages visited, referring page, and time on site.
Approximate location derived from your IP address.
Cookie and similar data, as described in our Cookie Policy.
Information from others
Business contact information from public sources such as company websites and LinkedIn, where we are reaching out about a potential business relationship.
Referrals from partners or existing clients.
Scheduling and meeting tools you use to book time with us.
We do not ask for sensitive personal information (as defined under the Data Privacy Act) through our website. Please do not send it to us through contact forms.
How We Use Data, and Why
Purpose | Lawful basis |
|---|---|
Responding to enquiries and arranging calls | Your request, and our legitimate interest in answering it |
Preparing proposals and delivering services | Performance of a contract, or steps taken at your request before one |
Billing, accounting, and tax records | Legal obligation and contract |
Sending newsletters and content you subscribe to | Consent, which you can withdraw at any time |
Business outreach to professional contacts | Legitimate interest, with an easy opt-out in every message |
Understanding and improving how our website is used | Consent for non-essential cookies; legitimate interest for essential operation |
Security, fraud prevention, and protecting our systems | Legitimate interest and legal obligation |
Meeting legal and regulatory requirements | Legal obligation |
We do not sell personal data and we do not use it for automated decisions that produce legal or similarly significant effects on you.
Who We Share It With
We share personal data only where needed for the purposes above:
Service providers that host, operate, or support our business — for example website hosting ([Framer]), email and productivity ([Google Workspace]), CRM and email marketing ([HubSpot], [MailerLite]), scheduling, analytics, payments ([Stripe]), accounting, and meeting notes tools. They process data on our instructions under contract.
Professional advisers such as lawyers, accountants, and auditors, under confidentiality.
Authorities, where required by law or to protect rights, safety, or property.
A buyer or successor, if Lumikha's business is reorganised, merged, or sold, subject to this policy.
International Transfers
We are based in the Philippines and our clients and service providers are located in several countries, including the United States, Singapore, and Australia. Your data may be processed outside the country where you live. When we transfer personal data, we use contractual safeguards that require the recipient to protect it to the standard required by the Data Privacy Act and, where applicable, the law of your country — including standard contractual clauses where the GDPR or UK GDPR applies.
How Long We Keep It
Data | Retention |
|---|---|
Enquiries that do not become engagements | [2 years] from last contact |
Client contract and engagement records | Duration of the engagement plus [5] years |
Financial and tax records | As required by Philippine tax law (currently up to [10] years) |
Newsletter subscriptions | Until you unsubscribe |
Website analytics | [14 months] |
When retention ends, we delete or anonymize the data.
How We Protect It
We use organizational, physical, and technical measures appropriate to the risk, including access controls, multi-factor authentication, encryption in transit, device security standards for staff, confidentiality undertakings, and staff training on data privacy. No system is completely secure. If a personal data breach affects you, we will notify you and the NPC where required by law.
Your Rights
Under the Data Privacy Act you have the right to:
be informed about how your personal data is processed;
access your personal data;
object to processing, including for direct marketing;
have inaccurate data corrected;
have data erased or blocked where it is incomplete, outdated, false, unlawfully obtained, or no longer needed;
obtain a copy of your data in a structured, commonly used format (data portability);
withdraw consent at any time, where processing is based on consent;
be indemnified for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data; and
lodge a complaint with the National Privacy Commission (privacy.gov.ph).
To use any of these rights, email over@lumikha.co. We will respond within [30] days and may need to verify your identity first.
Client Data We Handle on Your Behalf
When our team members work on client systems or data, we process that data as a processor on the client's instructions under our Service Terms and any data processing addendum. If your personal data reached us through one of our clients, please contact that client first; we will assist them in responding.
Additional Rights by Location
European Economic Area and United Kingdom. You have rights of access, rectification, erasure, restriction, portability, and objection under the GDPR or UK GDPR, and the right to complain to your local data protection authority. [EU/UK representative, if appointed.]
Singapore. You may request access to and correction of your personal data and withdraw consent under the Personal Data Protection Act 2012.
Australia. You may request access to and correction of your personal information, and complain to the Office of the Australian Information Commissioner if we do not resolve your concern.
United States. Depending on your state, you may have rights to know, access, correct, and delete personal information, and to opt out of its sale or sharing for targeted advertising. We do not sell personal information. We honour these requests wherever you live.
Children
Our website and services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from children.
Changes to This Policy
We will post updates on this page and change the "Last updated" date. Where a change materially affects how we use personal data you have already given us, we will tell you directly.