Privacy Policy
This policy explains what personal data Luxt Industries collects through this website, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It is written to meet the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules, and — for visitors in the European Economic Area and the United Kingdom — the General Data Protection Regulation.
1. Who is responsible for your data
Luxt Industries is the Personal Information Controller (and, under the GDPR, the data controller) for the personal data described here.
Operator: complete before publishing. Philippine law requires a Personal Information Controller to identify itself. Replace this box with your registered business name, your DTI or SEC registration number, and your registered business address. If you have appointed a Data Protection Officer, give their title and contact details here as well — the NPC expects a DPO to be identifiable to data subjects.
- Trading name: Luxt Industries
- Country of establishment: Philippines
- Privacy contact: [email protected]
- General contact: [email protected]
2. What we collect, and why
2.1 When you send an inquiry
The contact form asks for your name, your email address, and the message you write. If you selected a pricing package before writing, the name of that package is submitted with it. We also record the date and time of the submission.
We use this solely to read your inquiry, reply to it, and — if we go on to work together — to quote and deliver the project. We do not use it for unrelated marketing, we do not sell it, and we do not add you to a mailing list.
Lawful basis. Under the Data Privacy Act, processing is based on your consent in sending the inquiry and on the necessity of taking steps at your request prior to entering into a contract (Section 12(b)). Under the GDPR the equivalent bases are Article 6(1)(a) consent and Article 6(1)(b) pre-contractual steps.
Please do not include sensitive personal information — health, religion, government-issued identifiers, and the other categories listed in Section 3(l) of the Data Privacy Act — in a contact form message. We do not need it to answer you.
2.2 Anti-spam checks
Submissions pass through Cloudflare Turnstile, which decides whether the sender is a person or a bot. Cloudflare processes technical signals from your browser for this check. See Cloudflare's Turnstile privacy policy. We also apply a short-lived rate limit. To do that without keeping your IP address, we store only a one-way cryptographic hash of it. That hash expires with its counting window — at most 24 hours — and is never written into your inquiry record.
Lawful basis. Our legitimate interest in keeping the form usable and free of abuse (GDPR Article 6(1)(f); Data Privacy Act Section 12(f)).
2.3 Website traffic measurement
We measure nothing until you agree to it. If you accept in the banner shown on your first visit, we record, for each page view: the path you viewed, the host name of the site that referred you (for example google.com — never the full link), the country Cloudflare reports for your connection, and whether you are on a phone, a tablet or a desktop. If you decline, or simply never answer, no cookies are set and no page view is recorded at all.
We do this to understand which pages are worth keeping and where our visitors come from. We do not profile you, we do not track you across other websites, we do not run advertising pixels, and we store no IP addresses in our traffic records.
Lawful basis. Your consent (GDPR Article 6(1)(a) and Article 5(3) of the ePrivacy Directive; Data Privacy Act Section 12(a)). You may withdraw it at any time — see section 7.
2.4 Automatic technical logs
Our hosting and security provider, Cloudflare, processes connection data — including your IP address — as an unavoidable part of delivering this site and protecting it from attack. These are Cloudflare's operational logs, retained on their schedule under their privacy policy. We do not build our own analytics from them.
3. Cookies
This site sets no cookies at all unless you accept them. There are no advertising cookies and no third-party trackers on this site.
| Cookie | Purpose | Lifetime | Set when |
|---|---|---|---|
luxt_consent |
Remembers the choice you made in the consent banner, so we stop asking. Strictly necessary — it exists only to honour your decision. | 6 months | You click Accept or Decline |
luxt_vid |
A random identifier that lets us count unique visitors and tell a first visit from a return. It holds nothing but a random value and is never linked to your name or email. | 400 days | Only after you accept |
luxt_sid |
A random identifier that groups the pages you view into a single visit. Expires after 30 minutes of inactivity. | 30 minutes | Only after you accept |
luxt_vid and luxt_sid are HttpOnly:
no script running on the page can read them. You can delete all three at
any time in your browser settings, and you can change your mind through
the Cookie settings link in the footer.
We also honour Global Privacy Control. If your browser sends a GPC signal, we treat it as a refusal and never identify you as a visitor, whatever the banner says.
4. Who we share it with
We do not sell personal data and we do not share it for anyone else's marketing. We use a small number of service providers — Personal Information Processors under the Data Privacy Act, processors under the GDPR — who handle data only on our instructions:
| Provider | What it handles | Where |
|---|---|---|
| Cloudflare | Hosting and delivery of this site, bot protection (Turnstile), and sending the notification email that carries your inquiry to us. | Global edge network |
| Upstash | The database that stores inquiries and traffic counts. | United States |
| Discord | Delivers a notification to our private team channel when an inquiry arrives, so that it contains your name, email and message. | United States |
We may also disclose personal data where we are legally obliged to — a lawful order from a Philippine court or government agency, for instance — or where it is necessary to establish, exercise or defend a legal claim.
5. International transfers
We are based in the Philippines, and the providers above process data in the United States and across a global network. Personal data you submit will therefore be transferred outside your own country, including outside the EEA and the UK.
Under Section 21 of the Data Privacy Act we remain accountable for personal data we transfer to a third party. For transfers out of the EEA and the UK, our providers offer the European Commission's Standard Contractual Clauses and the UK Addendum, which are the safeguards we rely on under Article 46 of the GDPR. You may ask us for details of these safeguards using the contact in section 1.
6. How long we keep it
| What | Kept for |
|---|---|
| Inquiries you send through the form | 24 months from submission, then deleted automatically |
| Traffic records (page, referring host, country, device) | 400 days, then deleted automatically |
| Rate-limiting hashes (no IP address) | Up to 24 hours |
| Duplicate-submission fingerprints | 5 minutes |
| Records relating to a project we actually take on | For the life of the engagement and as long afterwards as tax and accounting law requires |
You do not have to wait for these periods to run. Ask us to delete your inquiry and we will, unless we are legally required to keep it.
7. Your rights
Under Chapter IV of the Data Privacy Act, and under Chapter III of the GDPR if you are in the EEA or the UK, you have the right to:
- Be informed that your personal data is being processed — which is what this page is for.
- Access the personal data we hold about you, and be told how we came by it.
- Rectify anything inaccurate or incomplete.
- Erasure or blocking — have your data removed from our systems where the law allows.
- Object to processing, including the right to stop us measuring your visits.
- Data portability — receive your data in a structured, commonly used, machine-readable format.
- Restrict processing while a dispute about accuracy or lawfulness is resolved (GDPR).
- Withdraw consent at any time, as easily as you gave it, without affecting anything done before you withdrew it.
- Damages for inaccurate, incomplete, outdated, false or unlawfully obtained data (Data Privacy Act Section 16(f)).
- Complain to a regulator — see section 10.
How to exercise them. Email [email protected] and tell us what you want done. We will answer within 30 days. There is no charge. We may ask you to confirm the email address the inquiry came from, so that we do not hand your data to someone else.
To withdraw consent to traffic measurement, use the Cookie settings link in the footer of any page, or delete this site's cookies in your browser. Nothing further is recorded from that point.
8. Automated decisions
We do not make decisions about you by automated means that produce legal or similarly significant effects, and we do not profile you. The only automated judgement on this site is the Turnstile bot check; if it wrongly blocks you, email us directly and a person will read your message.
9. How we protect it, and what happens if that fails
The site is served over HTTPS with HSTS and a strict Content Security Policy. Inquiries travel to storage over encrypted connections, the administrative dashboard is behind authentication, and access to stored inquiries is limited to the people who need it to answer you.
No system is perfect. If a breach occurs that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected data subjects within 72 hours of becoming aware of it, as Section 20(f) of the Data Privacy Act and NPC Circular 16-03 require, and within the timeframes of GDPR Articles 33 and 34 where they apply.
10. Complaints
Please raise it with us first at [email protected] — most things are faster to fix directly. If you are not satisfied, you may complain to:
- the National Privacy Commission of the Philippines — 5th Floor, Delegation Building, PICC Complex, Pasay City; privacy.gov.ph, [email protected]; or
- if you are in the EEA or the UK, your national data protection authority, or the UK Information Commissioner's Office.
11. Children
This site sells professional services to businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us data, write to us and we will delete it.
12. Changes to this policy
If we change how we handle personal data, we will update this page and move the date at the top. Where a change materially affects you, or widens what we do with data you have already given us, we will ask for your consent again rather than rely on the old one.