Plain words about your details, and what happens to them.

Gerbang Studio (“we”, “us”) is an online-only web design studio serving Malaysian SMEs, registered with SSM as GERBANG STUDIO (202603246463 (003890333-P)). This notice covers this website only — the public pages, the enquiry form and the anonymous feedback buttons. It does not cover third-party services with their own privacy terms (for example WhatsApp or Cloudflare, described where relevant below).

When you send an enquiry, the form collects the details you type: your name, phone number, email (optional), business name, industry, the package or services you are interested in, your goal, and anything else you choose to tell us (existing website, domain, timeline, notes).

Fields marked * are the minimum we need to receive your enquiry and reply to it. The other fields are optional and can be left out. If the required fields are missing, we may not be able to respond or prepare a quotation.

Technical context, kept with each enquiry: the page the form was submitted from, the referring page, UTM campaign fields, a lead reference (GB-XXXXXX), timestamps, and the enquiry’s status as we work through it. This is ordinary business record-keeping — it is not used to profile you.

Anonymous feedback: the “was this helpful” buttons under the FAQ answers record a yes/no signal only. No name, no contact details, nothing that identifies you.

Abuse prevention: before an enquiry is sent, a short bot check runs (section 04) and a hidden honeypot field plus per-IP rate limits filter obvious spam. For rate limiting, IP addresses are stored only as a keyed one-way hash — raw IP addresses are not stored in our lead or feedback databases. The hash is one-way by design and keyed with a server-side secret; it is not meant to be reversed, and we make no claim that reversing it would be impossible — we simply never keep the raw address.

Enquiry details are used:

• to get in touch with you about the enquiry you sent, and prepare quotations
• to keep a tidy business record of enquiries and projects
• to protect the enquiry system from spam, bots and abuse

Nothing else. No marketing profiles, no scoring, no newsletters you didn’t ask for.

Enquiries submitted through this website are checked first (including the bot check above) and stored as enquiry records. Enquiries are stored in a PostgreSQL database provided through Prisma Postgres and connected to the Gerbang Studio website deployment on Netlify.

Where the configuration allows, a copy of every enquiry is sent to the studio’s own Google Sheet — a private spreadsheet used to manage and follow up on enquiries — through a private Google Apps Script connection protected by a shared secret. New enquiries can also trigger a short notification to the studio owner’s messaging channel so they can be answered quickly.

Administrative access to enquiry records is limited to the studio owner. The technical providers named in this notice process data only to the extent needed to provide their services. Enquiries travel over HTTPS, secrets are kept server-side only, and IP addresses are stored in the database only as a keyed one-way hash for abuse prevention — raw IP addresses are not stored.

The bot check: this website uses Cloudflare Turnstile. For bot detection and security purposes, Turnstile processes network and browser signals — including the IP address — under Cloudflare’s own terms. You can read how Cloudflare handles that data in Cloudflare’s Turnstile Privacy Addendum.

• We don't sell, rent or trade your personal information.
• We don't add you to newsletters or marketing lists you didn't ask for.
• We don't use your enquiry details for advertising, and we don't run advertising trackers on this site.
• We don't share your information with third parties except the service providers described in section 04 (hosting, the bot check, and — where configured — Google Sheets delivery), who process it solely to deliver those services.

Enquiry records are kept as long as needed for the purposes above — while we are in contact with you, and for a reasonable period afterwards as a business record. You can ask for access, correction or deletion at any time (section 07); where required or permitted for legal, accounting, dispute-resolution or legitimate business-record purposes, some information may need to be kept.

You can ask to access, correct or request deletion of your information at any time. You can also ask us to limit how we process it, or withdraw consent where our processing relies on your consent.

Deletion is not always unconditional: where required or allowed for legal, accounting, dispute-resolution or legitimate business-record purposes, some records may need to be kept — and we will tell you what and why if that ever comes up.

There are no forms and no fees: one email or WhatsApp message to the contact in section 08 is enough.

Questions about this notice, or any request under section 07, go straight to the owner:

This notice is provided in English and Bahasa Malaysia under section 7(3) of the Personal Data Protection Act 2010 (PDPA). Both versions say the same thing — use the language switch at the top of the page to read whichever is more comfortable.