Privacy Policy

This Privacy Policy explains how Firstrive Digital Marketing Services ("Firstrive," "we," "us," or "our") collects, uses, shares, and protects personal information when you visit firstrive.com (the "Website"), contact us, request a quote or a free website audit, or work with us as a client.

We are based in the Philippines and work with businesses around the world. We handle personal information in line with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission. Where other privacy laws apply to you, such as the EU or UK General Data Protection Regulation (GDPR) or California privacy law, the sections for those regions below also apply.

We have tried to keep this policy plain and specific. If anything is unclear, email us at [email protected].

1. Who we are and how to reach us

• Business name: Firstrive Digital Marketing Services (DTI Business Name Registration No. 6993648)
• Address: Quezon City, Metro Manila, Philippines
• Email: [email protected]
• Phone: +63 927 730 4104
• Data Protection Officer: Mark, Owner, [email protected]

For information you share through the Website or as a prospective client, Firstrive is the personal information controller. When we build or maintain a website for a client, we may also handle personal information about that client's own customers on the client's behalf. In that case the client is the controller, and our handling is governed by our agreement with that client (see Section 9).

2. Information we collect

Information you give us

• Quote requests: your name, email address, company name, website address, the service you are interested in, project details, budget range, and preferred timing.
• Free website audit and website review requests: your name, email address, company name, website address, and anything you tell us about your goals or concerns.
• General messages: whatever you include when you email, call, or message us, including your contact details.
• Client work: contact and billing details for the people we work with, project briefs, content, images, feedback, and the account or login access you give us to complete agreed work (for example, website, hosting, domain, analytics, or social media accounts).
• Agency partners: contact details and project information shared for white-label or partner work.

Please do not send passwords, payment card details, government ID numbers, health information, or other sensitive personal information through our forms or by email. If a project needs account access, we will agree on a secure way to share it.

Information collected automatically

When you visit the Website, our hosting provider and the tools we use may collect technical information such as your IP address, browser type, device type, operating system, referring page, pages viewed, and the date and time of your visit. Some of this is collected through cookies and similar technologies. Our Cookie Policy explains which ones we use and how to control them.

Information from other sources

We may receive your business contact details from someone who refers you to us, from an agency partner, or from public sources such as your company website or professional profile when you contact us first.

3. How we use your information

We do not sell your personal information. We do not use it for automated decision-making that has legal or similarly significant effects on you.

4. How we share your information

We share personal information only when it is needed for the purposes above:

• Service providers that help us run the Website and our business, under agreements that require them to protect your information. These include:
  • Website hosting and security: our website hosting provider, and Cloudflare for security and performance
  • Email and file storage: Google Workspace
  • Form handling: Gravity Forms, which stores form entries in our website database and emails them to our team
  • Website analytics: Google Analytics and Google Tag Manager, plus Google Search Console, which reports on search performance without placing cookies on your device
  • Spam protection: Google reCAPTCHA and Cloudflare
  • Invoicing and payments: Wise, our bank, and any other payment method agreed with the client
  • Project management and communication: the project management, messaging, and video call tools agreed with each client
• Team members and subcontractors who work on your project, bound by confidentiality obligations.
• Agency partners, when you are a client of an agency we support on a white-label basis and the agency has shared your information with us.
• Professional advisers such as accountants and lawyers, where needed.
• Authorities when the law requires it, or to protect our rights, our clients, or the public.
• A successor business if Firstrive is merged, sold, or restructured, subject to this policy.

5. International transfers

We are based in the Philippines and some of our service providers store or process data in other countries, including the United States. When personal information moves across borders, we take reasonable steps to make sure it stays protected, such as choosing providers with strong security practices and using contractual safeguards. For transfers out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the UK equivalent.

6. How long we keep information

• Inquiries that do not become projects: 24 months after our last contact, then deleted.
• Client and project records: for the length of our working relationship and 5 years after, so we can support past work and meet legal and tax requirements.
• Accounting and tax records: for the period required by Philippine tax law.
• Account access and credentials you share for a project: removed or returned when the project or maintenance period ends, unless you ask us to keep access.
• Website analytics data: 14 months in Google Analytics.

When information is no longer needed, we delete it or make it anonymous.

7. How we protect information

We use organizational, physical, and technical measures suited to a small digital agency, including access controls, two-factor authentication on key accounts, encrypted connections (HTTPS), limited access on a need-to-know basis, and regular updates and backups of our own systems. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the National Privacy Commission when the law requires it.

8. Your rights

Under the Philippine Data Privacy Act, you have the right to:

• be informed about how your personal information is processed;
• access the personal information we hold about you;
• object to processing, including processing for direct marketing;
• have inaccurate information corrected;
• have information erased or blocked when it is no longer needed or was processed unlawfully;
• receive your information in a portable electronic format, where applicable;
• withdraw consent where we rely on consent;
• be compensated for damages caused by inaccurate, incomplete, outdated, false, or unlawfully obtained information, or its unauthorized use; and
• file a complaint with the National Privacy Commission (privacy.gov.ph).

To make a request, email [email protected]. We may ask you to confirm your identity before acting on it. We aim to respond within 15 business days, and within any shorter period the law sets. We will not charge a fee unless a request is clearly unfounded or excessive.

9. Client websites and data we process for clients

When we build, host, maintain, or optimize a website or online store for a client, we may be able to access personal information that the client collects from its own customers, such as form submissions or store orders. We handle that information only to deliver the agreed work, following the client's instructions and our project or data processing agreement with them. If you are a customer of one of our clients, please contact that business directly about your information.

10. Visitors from the European Economic Area and the United Kingdom

If you are in the EEA or the UK, the GDPR or UK GDPR may apply to our handling of your information. The legal bases we rely on are listed in Section 3. In addition to the rights in Section 8, you have the right to restrict processing and to lodge a complaint with your local data protection authority.

11. Notice for California residents

This section explains our practices in the terms used by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"). We share it voluntarily so California visitors know what to expect, even where the CCPA may not apply to a business of our size.

• Categories we collect: identifiers (such as name, email, IP address); commercial information (such as services requested and project records); internet or network activity (such as pages viewed); professional information (such as company and role); and inferences drawn from your inquiry about the services you may need.
• Sources and purposes: described in Sections 2 and 3.
• Disclosure: we disclose these categories to the service providers listed in Section 4 for business purposes.
• Sale and sharing: we do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not knowingly sell or share the information of anyone under 16.
• Sensitive personal information: we do not use or disclose it for purposes that would give you a right to limit its use.
• Your rights: you can ask to know what we collect, use, and disclose; to delete it; to correct it; and to opt out of sale or sharing. You can also use an authorized agent. We will not discriminate against you for using these rights.

To make a request, email [email protected] with the subject line "California privacy request."

12. Children's privacy

Our Website and services are meant for businesses and adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us personal information, please contact us and we will delete it.

13. Links to other websites

The Website may link to other sites, including our social media profiles and tools we mention in our articles. Their privacy practices are their own, so please review their policies.

14. Changes to this policy

We will update this policy when our practices or the law change. The "Last updated" date at the top shows when it last changed. If a change is significant, we will make it clear on the Website or tell clients directly.

15. Contact us

For privacy questions or requests, contact our Data Protection Officer at [email protected] or write to Firstrive Digital Marketing Services, Quezon City, Metro Manila, Philippines. For anything else, email [email protected].