Privacy policy

01 In short

• We only collect what you write in the contact form, plus the page you wrote from and, if present in the link, the campaign that brought you here.
• We use it to answer you. No newsletter, no marketing, no sale of data.
• It reaches us by email and is not stored in any database on this website.
• This website uses no cookies, no analytics and no tracking pixels.

02 Who is responsible for your data

The data controller is PT MAHKOTA PROPERTY GLOBAL, a company incorporated in Indonesia that trades as AxisWorks.

Contact for anything related to your data: hello@axisworks.studio.

03 What data we collect

Through the contact form:

• Your name and email address.
• Your company, if you choose to give it.
• Your message and anything you include in it.
• The page of this website you sent the form from.
• If the link you followed carried campaign parameters (utm_source, utm_medium, utm_campaign and similar), the values of those parameters. They tell us which channel or campaign brought you here. They do not identify you.

To stop spam, the form limits how many messages can be sent from the same IP address. For that, the server keeps your IP address only in the form of a hash, combined with a secret that changes every day, so it cannot be read back. That hash is deleted in less than 24 hours.

Like any web server, the one that hosts this site records technical data about each request (IP address, date and time, page requested, browser) to keep the service running and secure.

We do not ask for special categories of data. Please do not include them in your message.

04 Why we use it and on what legal basis

• To answer a request about our services (a quote, a project, a question before hiring us). Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• To answer any other message (press, job applications, other questions). Legal basis: our legitimate interest in replying to people who write to us (Article 6(1)(f) GDPR). You write to us to get an answer, so replying is what you expect.
• To protect the form from spam and the server from abuse, including the IP hash and server logs. Legal basis: our legitimate interest in keeping the website secure (Article 6(1)(f) GDPR).

There is no checkbox in the form because we do not rely on your consent for any of this. We will not use your data to send you newsletters or advertising.

No decision about you is made by automated means.

05 Who receives your data

Nobody outside the studio, except the providers that process it on our behalf under a data processing agreement:

• Hostinger, which hosts this website and our email inbox.

We do not sell or rent your data, and we do not share it with third parties for their own purposes. We will only disclose it if a law or a competent authority requires us to.

06 International transfers

We are established in Indonesia. The European Commission has not adopted an adequacy decision for Indonesia, so the level of data protection there has not been declared equivalent to that of the European Union.

When you write to us from the EU about our services, sending your message to Indonesia is necessary to take the steps you asked for before a possible contract. That transfer rests on Article 49(1)(b) GDPR. For any other message, you are sending it directly to a company established outside the EU, and we apply this policy and the GDPR to it in the same way.

Wherever the data is, we protect it with the same measures: access limited to the people who need it, encrypted connections (HTTPS) and no copies outside our inbox.

07 How long we keep it

• Contact form messages: for as long as the conversation lasts. If no working relationship follows, we delete them 24 months after the last message exchanged. That window covers the usual case of a project that comes back months later.
• If you become a client: the correspondence becomes part of the project file and is kept for as long as the contract lasts and, afterwards, for the period required by tax and commercial law or needed to handle possible claims.
• IP hash for spam control: less than 24 hours.

If you ask us to delete your message before those periods end, we will, unless a law requires us to keep it.

08 Your rights

You can ask us at any time to:

• access the data we hold about you;
• correct it if it is wrong;
• delete it;
• object to its use, including when we rely on legitimate interest;
• restrict its use while we check a request;
• receive it in a structured, commonly used format, or have it sent to someone else (portability).

Write to hello@axisworks.studio saying which right you want to exercise. We will reply within one month. We may ask you to confirm your identity if we have reasonable doubts that the request comes from you.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority of the EU country where you live or work. We would appreciate the chance to fix it first.

As an Indonesian company we are also subject to Indonesian Law No. 27 of 2022 on Personal Data Protection (UU PDP), which gives you equivalent rights. You can exercise them at the same email address.

09 Security

The whole site runs over HTTPS. Form messages go straight to our inbox and are not saved in a database on the web server. Only the people at the studio who need to answer you can read them.

If a security incident affects your data and puts your rights at risk, we will notify the competent authority and, where required, tell you directly within the legal deadlines.

10 Minors

This website is aimed at businesses and professionals. It is not directed at children and we do not knowingly collect data from anyone under 14. If you believe a minor has written to us, let us know and we will delete the message.

11 Changes to this policy

If we change the way we process data, we will update this page before the change applies. The date at the top shows the latest version.