Let’s talk
Legal

Privacy Policy

Last updated: 24 July 2026

This Privacy Policy explains how Dat Design Lab collects, uses, and protects your personal data when you visit datdesignlab.com, get in touch, or work with me. I take your privacy seriously and only collect what I need to run the studio and deliver work. Because I work with clients internationally, this policy also covers visitors in the European Economic Area, the United Kingdom, and the United States, including specific rights for California residents set out below.

Who is responsible for your data

Dat Design Lab is a sole proprietorship operated by Dat Truong, based in Silesia, Poland. For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, Dat Truong is the data controller for the personal data described in this policy.

If you have any questions about this policy or your data, contact me at contact@datdesignlab.com.

What personal data I collect

I collect the following, depending on how you interact with me:

  • Enquiry details. When you use the contact form or email me, I collect your name, email address, phone number if you provide it, and anything you include in your message.
  • Project information. If you become a client, I collect the information, files, and access I need to deliver your project, which may include business details, brand assets, and account access you choose to share.
  • Usage data. When you browse the site, I may collect your IP address, browser type, device information, the pages you visit, and how you arrived, through analytics and standard server logs.
  • Cookies and similar technologies. The site uses cookies as described in my Cookie Policy. Non-essential cookies only run after you consent through the cookie banner.

How I use your data and my legal basis

I only process your personal data where the law allows. Specifically:

  • To respond to your enquiry and prepare a quote, on the basis of taking steps at your request before entering a contract, and my legitimate interest in replying to you (GDPR Art. 6(1)(b) and 6(1)(f)).
  • To deliver and manage my services (design, development, SEO, hosting, and care plans), on the basis of performing our contract (Art. 6(1)(b)).
  • To send project updates and service-related messages, on the basis of our contract and my legitimate interest in keeping you informed (Art. 6(1)(b) and 6(1)(f)).
  • To understand and improve the website through analytics, on the basis of your consent, given through the cookie banner (Art. 6(1)(a)).
  • To keep the site secure and prevent abuse, on the basis of my legitimate interest in protecting the site and its visitors (Art. 6(1)(f)).
  • To meet accounting, invoicing, tax, and other legal obligations, on the basis of a legal obligation (Art. 6(1)(c)).
  • To send marketing emails, only if you have opted in, on the basis of your consent, which you can withdraw at any time (Art. 6(1)(a)).

Who I share your data with

I do not sell your personal data. I share it only with trusted service providers who help me run the studio and the website, and only as far as needed. These may include:

  • My website hosting provider, which stores the site and its data.
  • Analytics and search tools such as Google Analytics and Google Search Console.
  • My email and productivity tools, used to communicate with you and manage projects.
  • Contact form and anti-spam services used on the site.
  • My accountant and payment or invoicing providers, for billing and legal compliance.

Each of these providers processes your data under their own terms and appropriate data protection agreements. I may also disclose data where required by law.

International data transfers

Some of the providers I use, such as Google, are based in or transfer data to countries outside the European Economic Area, including the United States. Where that happens, the transfer is protected by appropriate safeguards, such as the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

How long I keep your data

I keep personal data only as long as I need it:

  • Enquiries that do not become projects are kept for a reasonable period so I can follow up, then deleted.
  • Client project data is kept for the duration of our work together and for a reasonable period afterwards, in case you return or need support.
  • Invoicing and accounting records are kept for as long as Polish tax law requires, generally five years.
  • Analytics data is retained according to the settings of the analytics tools in use.

Your rights

Under the GDPR you have the right to:

  • Access the personal data I hold about you.
  • Ask me to correct data that is inaccurate or incomplete.
  • Ask me to delete your data, where there is no legal reason for me to keep it.
  • Ask me to restrict or object to how I process your data.
  • Receive your data in a portable format, where applicable.
  • Withdraw consent at any time, where I rely on consent, without affecting processing already carried out.

To exercise any of these rights, email me at contact@datdesignlab.com. If you are in the EEA, you have the right to lodge a complaint with your local data protection authority, and in particular with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland. If you are in the UK, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Additional information for California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding your personal information.

Categories I collect. In the past 12 months I may have collected these categories of personal information: identifiers (such as your name, email address, phone number, and IP address), commercial information (such as the services you enquired about or purchased), and internet or network activity (such as how you interact with the site). I collect these for the business purposes described earlier in this policy.

No sale or sharing. I do not sell your personal information, and I do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA. I have not done so in the past 12 months.

Your California rights. You have the right to know what personal information I collect and how I use it, to request access to or deletion of your personal information, to correct inaccurate information, and to not receive discriminatory treatment for exercising any of these rights.

To exercise these rights, email me at contact@datdesignlab.com. I will take reasonable steps to verify your identity before responding, and you may use an authorised agent to make a request on your behalf.

How I protect your data

I use reasonable technical and organisational measures to keep your data safe, including secure hosting, HTTPS encryption, and limited access. No method of transmission or storage is completely secure, but I take protecting your information seriously and act quickly if anything goes wrong.

Links to other sites

The site may link to third-party websites. I am not responsible for their content or privacy practices, and I encourage you to read their policies before sharing any personal data with them.

Children’s privacy

This site and my services are intended for businesses and adults. I do not knowingly collect personal data from children. If you believe a child has provided me with personal data, contact me and I will delete it.

Changes to this policy

I may update this policy from time to time to reflect changes in my tools, services, or the law. The date at the top shows when it was last revised. Significant changes will be reflected here, so it is worth checking back occasionally.

Contact

If you have any questions about this Privacy Policy or how I handle your data, email me at contact@datdesignlab.com.