1. Introduction
WebCraft Studios ("we," "our," or "us") operates as a web development agency providing design, development, and digital marketing services. We recognize that data privacy is a fundamental right, and we are fully committed to complying with the General Data Protection Regulation (GDPR) and applicable data protection laws.
This Privacy Policy explains how we collect, use, process, and safeguard your personal data when you visit our website, engage with our services, or communicate with our team.
Data Controller: WebCraft Studios, 123 Innovation Drive, San Francisco, CA 94102. In accordance with GDPR, we act as the Data Controller for the personal data collected through our website and client engagements.
2. Information We Collect
We collect personal data that you voluntarily provide to us, as well as certain data collected automatically when you interact with our website. The categories of data we process include:
- Identity Data: Name, username, or similar identifier.
- Contact Data: Billing address, delivery address, email address, and telephone numbers.
- Transaction Data: Details about payments to and from you and other details of services you have purchased from us.
- Technical Data: Internet protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
- Usage Data: Information about how you use our website, products, and services, including pages visited, click patterns, and access times.
- Project Data: Client briefs, brand assets, and business information provided for the purpose of web development services.
3. How We Use Your Data
We process your personal data for the following purposes, ensuring each activity has a clear legal basis:
- To manage our relationship with you, including account registration and client onboarding.
- To provide you with information, products, or services that you request from us, such as project proposals and website deliverables.
- To send administrative information, including updates to our terms or privacy policy, and technical notices.
- To respond to inquiries, comments, or questions and provide customer support.
- To improve our website, products, services, and customer relationships through analytics and feedback.
- To comply with legal and regulatory obligations, including data retention requirements.
4. Legal Basis for Processing
Under GDPR Article 6, we process your personal data based on the following legal grounds:
- Consent: Where you have provided explicit consent for specific processing activities, such as marketing communications or non-essential cookies.
- Contract: Where processing is necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract.
- Legitimate Interests: Where processing is necessary for our legitimate interests (e.g., network security, fraud prevention, and business improvement) provided your interests and fundamental rights do not override those interests.
- Legal Obligation: Where processing is necessary for compliance with a legal or regulatory obligation applicable to us.
6. Third-Party Processors
We may engage trusted third-party Data Processors to assist us in providing our services. These processors are contractually bound to handle your data securely and in compliance with GDPR. Current processors include:
- Cloud hosting providers for website infrastructure.
- Analytics platforms for site performance monitoring.
- Email service providers for transactional communications.
- Payment processors for secure financial transactions.
We do not sell your personal data to third parties. Data transfers outside the European Economic Area (EEA) are protected by appropriate safeguards, such as Standard Contractual Clauses (SCCs).
7. Your Data Protection Rights
Under GDPR, you have the following rights regarding your personal data:
- Right to Access: Request copies of your personal data held by us.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure: Request deletion of your data where there is no compelling reason for continued processing.
- Right to Restrict Processing: Request restriction of processing under certain circumstances.
- Right to Data Portability: Receive your data in a structured, machine-readable format.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, please contact our Data Protection Officer using the details provided below. We will respond to your request within 30 days, as required by law.
8. Data Security
WebCraft Studios implements industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit (TLS/SSL) and at rest.
- Regular security audits and vulnerability assessments.
- Access controls and authentication mechanisms for staff.
- Employee training on data protection best practices.
While we strive to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We encourage you to take steps to safeguard your information as well.
9. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. Retention periods are determined by:
- The nature of the data and purpose of processing.
- Applicable statutory or regulatory retention periods.
- Whether there is a likelihood of litigation.
When data is no longer needed, it is securely deleted or anonymized in accordance with our data retention policy.
10. Children's Data
Our services are directed to businesses and professionals, not children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will take immediate steps to delete such data.
11. Updates to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of significant changes by posting the updated policy on this page with a revised "Last Updated" date. We encourage you to review this policy regularly.
Contact Our Data Protection Officer
If you have questions about this Privacy Policy, wish to exercise your rights, or need to report a concern, please reach out to our DPO.
San Francisco, CA 94102