Privacy Policy

1. Information We Collect

We collect both personal and non-personal information to provide our services effectively and to protect the trust placed in us by our clients, employees, and partners.

2. Use of Information

We use your information to:

• Provide and improve our services: deliver requested products and services, and enhance your user experience.
• Communicate with you: respond to inquiries, provide support, send administrative messages, and notify you of updates.
• Marketing: send promotional materials and newsletters, only if you have opted in. You may opt out at any time.
• Site analytics: understand how the Site is used to improve content, navigation, and performance.
• Legal compliance: fulfill our legal and regulatory obligations.
• Internal Training or QA: we may use aggregated or properly anonymized data for staff training, service quality audits, or process improvements. If data is only pseudonymized and remains reasonably linkable to an individual, we continue to treat it as personal data and protect it accordingly.

3. Cookies and Tracking

We use cookies and similar tracking technologies to operate our website, improve performance, and understand how visitors interact with our content.

• Essential Cookies – Required for the site to function (e.g., security, session management, form submissions). These cannot be turned off.
• Analytics Cookies – Help us understand traffic, usage patterns, and improve our services.
• Marketing Cookies – May be used to deliver more relevant ads and measure campaign performance.

For visitors from the EEA, UK, and other jurisdictions with cookie consent requirements, we will obtain prior, informed consent before setting non-essential cookies (e.g., marketing cookies). Our cookie banner provides “Accept All”, “Reject All”, and “Customize” options.

For California residents subject to CPRA, you may exercise your right to opt out of the “sale” or “sharing” of personal information by contacting us at [email protected] or by using the “Do Not Sell/Share My Personal Information” link available on our website.

In addition, we may use analytics tools to generate insights and improve services. These tools may create user profiles based on browsing behavior or engagement data.

4. Communication Data Collection (Phone, Email, SMS)

We may collect personal information during phone calls, email exchanges, or SMS messages to fulfill customer support, project coordination, or service requests. This may include your contact details, inquiries, or feedback.

• Phone Calls: Some calls may be recorded, but only with your prior verbal consent at the start of the conversation. If you decline, no recording will take place, and our team will take notes instead. Any recordings are logged in our internal systems, stored securely, and used only for the stated purpose (e.g., note-taking or project accuracy).
• Email and SMS: Any messages you send to us may be stored in our systems for record-keeping and support. These communications are retained for the duration of your active service and for up to three (3) years after the end of the contract, unless deletion is requested earlier or a longer retention period is required by law.
• Marketing Texts or Calls: We will never send marketing-related SMS or phone calls without your prior express written consent in compliance with the Telephone Consumer Protection Act (TCPA) and applicable “Do Not Call” rules.
• Access & Deletion Requests: You may request access to, or deletion of, your email or SMS data at any time by contacting us at [email protected].

All communication data is handled securely, with access limited to authorized personnel only.

5. Data Sharing

We do not sell or rent your personal data. We share personal information only when:

• Service delivery is required – e.g., hosting providers, domain registrars, payment processors, or email platforms.
• Law or regulation requires it – to comply with legal obligations, court orders, or government requests.
• Fraud, security, or misuse prevention – to protect our services, users, and company from threats or unlawful activity.
• Business transfers – in the event of a merger, acquisition, or asset sale, provided the recipient assumes equivalent privacy obligations.
• With your consent – if you approve specific sharing at the time of collection.

When working with subprocessors or service providers, we partner only with reputable vendors that apply appropriate data protection standards. Where available, this includes published Data Processing Addendums (DPAs) or equivalent contractual safeguards. A current list of our subprocessors can be made available on request.

6. International Data Transfers

As a Philippines-based company serving U.S. and international clients, we may transfer data across borders when using third-party service providers (e.g., hosting, storage, or communication tools). Where required by law, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs), contractual data protection terms, encryption, access controls, and other industry-standard security measures with our vendors.

Clients may contact us at [email protected] to request additional information about our safeguards, including a current list of subprocessors. Where applicable, we can also provide a Data Processing Agreement (DPA) or, for healthcare-related projects involving Protected Health Information (PHI), a Business Associate Agreement (BAA) before processing.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal and regulatory obligations, and to protect legitimate business interests.

Retention periods vary depending on the nature of the data and the services provided:

• Website production build files (such as code, design, layout, and static assets) may be archived long-term as part of our service continuity and backup commitment. These archived files exclude hosted databases and personal data and are retained primarily for technical restoration purposes.
• Hosted databases, form submissions, appointment data, and other personal data stored within a website are retained only for the duration of active service engagement or as instructed by the client. Upon termination of service, such data may be made available to the client for retrieval upon request within a reasonable transition period before secure deletion, in accordance with our Data Processing Agreement and applicable law.
• Client contracts and project records are generally retained for up to ten (10) years for legal, audit, and business documentation purposes.
• Billing and payment records are retained for up to ten (10) years in compliance with tax, accounting, and regulatory requirements.
• Client communications (including emails, support tickets, chat exchanges, and project updates) are retained for the duration of the service engagement plus up to three (3) years for service history and dispute resolution purposes.
• Marketing and campaign-related data are retained only as long as necessary to complete the campaign and for a limited period afterward for reporting and performance reference.

We implement secure disposal procedures to ensure that personal data is deleted, anonymized, or securely destroyed when no longer required.

8. Data Security

We apply reasonable technical, administrative, and physical safeguards to protect personal information against unauthorized access, use, or disclosure. These measures include:

• Role-based access controls (only authorized staff may access sensitive data)
• Secure storage of account credentials and business information
• Regular reviews of employee access rights
• Use of secure protocols (e.g., SSL/TLS) for file transfers and communications
• Ongoing privacy and security training for staff
• Incident response procedures to address potential security events
• Service providers handling personal data on our behalf are required to apply appropriate security measures

While no system can guarantee absolute security, we are committed to continuously improving our safeguards.

9. Children’s Privacy

Our services and website are not directed to children under 13, and we do not knowingly collect personal information from them. If we become aware that we have collected personal information from a child under 13 without parental consent, we will delete it promptly.

For clients whose websites or digital services are directed to children, compliance with the U.S. Children’s Online Privacy Protection Act (COPPA) is required. We will assist our clients in implementing appropriate parental consent mechanisms and safeguards, or require clients to confirm that they have obtained verifiable parental consent before submitting any child-related data to us.

If we operate or develop a site or service directed at children on a client’s behalf, we will require the client to ensure COPPA compliance. Where Proweaver processes children’s data directly, we will implement verifiable parental consent processes and appropriate safeguards.

10. Your Rights

You have rights over your personal information. Depending on where you live, these may include the right to:

• Access the information we hold about you
• Request corrections to inaccurate or incomplete data
• Request deletion of your personal information
• Opt out of receiving marketing communications
• Restrict or object to certain types of data use, as allowed by law

To submit a Data Subject Request (DSR), please email [email protected]. We will acknowledge your request within 5 business days and provide a full response within 30 calendar days where possible. For California CPRA requests, we will follow statutory timelines (typically 45 calendar days) and notify you if an extension is required.

We may request reasonable information to verify your identity, but we will not require more personal data than necessary. If your request is denied due to legal or regulatory reasons, we will explain why and provide information on how you can appeal or raise a concern with the relevant data protection authority.

11. Links to Other Websites

Our website may contain links to third-party websites, such as social media platforms, partner services, or payment providers. We do not control and are not responsible for the privacy practices, security, or content of those third-party sites. We encourage you to review the privacy policies of any websites you visit.

12. Data Breach Protocol

We maintain an internal breach notification and response process aligned with legal requirements. In the event of a data breach involving personal information, we will:

• Notify clients (when acting as a processor): We will inform the client without undue delay and, where feasible, within 72 hours of becoming aware of the breach, and provide details to support the client’s own notification obligations.
• Notify individuals and authorities (when acting as a controller): We will notify affected individuals and the relevant authorities within the timelines required by applicable laws.
• Contain and investigate: Take immediate steps to contain the incident, prevent further loss, and investigate the cause.
• Correct and prevent recurrence: Implement appropriate measures to address vulnerabilities and strengthen safeguards.
• Maintain records: Document the breach, actions taken, and all notifications made.

13. California Privacy Rights (CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Rights Act (CPRA), including the right to:

• Request access to the categories and specific pieces of personal information we have collected about you.
• Request correction or deletion of your personal information, subject to legal exceptions.
• Opt out of the “sale” or “sharing” of your personal information for cross-context behavioral advertising.

We do not sell personal information in exchange for money. However, we may share identifiers (such as IP addresses or cookies) with analytics and advertising partners, which may be considered “sharing” under CPRA.

To exercise these rights, please contact us at [email protected] or, for opt-out requests, use the “Do Not Sell/Share My Personal Information” option available in our website footer.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The “Last Updated” date at the top will indicate the latest revision.

For material changes that affect your rights or how we handle your information, we will provide additional notice (such as by email or a website banner) and, where required by law, obtain your consent.

15. Contact Information

If you have any questions or concerns about this Privacy Policy or how we handle your personal information, you may contact our Data Protection Officer (DPO) / Privacy Compliance Team:

Proweaver, Inc.
Attn: Data Protection Officer / Privacy Compliance Team
Email: [email protected]
Address: Kepwealth Center, Cebu City, Philippines, 6000

This Privacy Policy is administered by Proweaver in the Philippines and shall be governed by the laws of the Republic of the Philippines. Where local law imposes different requirements (such as CPRA or GDPR), we will comply as required. If we receive lawful requests for personal information from law enforcement or regulatory authorities, we will review and respond in compliance with applicable legal requirements.