Lappo is a small, senior design studio based in Indonesia, working across brand design, visual identity, and web design and development. In this policy, “Lappo”, “we”, “us” and “our” refer to the studio.

This Privacy Policy applies to this website (the “Site”) and to the information you share with us through it.

We aim to collect only what we need, use it for clear purposes, and treat it with care. By using the Site, you acknowledge the practices described in this policy.

We collect a limited amount of information, either because you choose to share it with us or because it is generated automatically when you browse the Site.

• Contact form details: your name, email address, enquiry type, phone number, and the message you send

• Studio update sign-ups: the email address you enter in the footer to receive updates from the studio

• Correspondence: any information you include when you email us directly

• Usage information: where analytics are enabled, aggregated data about visits, such as pages viewed, referring websites, and device type

• Technical information: basic data your browser sends when loading the Site, such as your IP address and browser type, which our hosting platform may process to deliver and protect the Site

We do not ask for sensitive personal data, such as health or financial information, and we ask that you do not include it in your messages.

We use the information we collect for the following purposes:

• To reply to your enquiry and discuss a potential project

• To send you studio updates, if you have signed up for them

• To understand how the Site is used, so we can improve its content and performance

• To keep the Site secure and working properly

• To meet our legal obligations, where required

We do not sell your personal data, and we do not use it for advertising or to build marketing profiles.

Our handling of personal data is guided by Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, the “PDP Law”). Depending on the situation, we rely on one or more of the following grounds:

• Your consent, for example when you submit the contact form or sign up for studio updates

• Steps taken at your request before entering into an agreement, such as responding to a project enquiry

• Our legitimate interests in running, measuring, and protecting the Site, balanced against your rights

• Our legal obligations, where applicable

Where we rely on consent, you may withdraw it at any time by contacting us. Withdrawing consent does not affect any processing carried out before you withdrew it.

We share personal data only where it is needed to run the Site and respond to you. This may include:

• Our website platform, Framer, which hosts the Site, delivers its files, and processes contact form submissions before forwarding them to us by email

• The email service we use to receive and store messages and form submissions

• Public authorities or professional advisers, where required by law or reasonably necessary to protect our rights

These parties may process data on our behalf or under their own privacy policies. We do not sell, rent, or trade your personal data.

The Site may use a small number of cookies and similar technologies. For example, it may keep small, non-identifying items in your browser’s session storage, such as a note that the intro animation has already played during your visit.

The Site may also use our hosting platform’s built-in, privacy-friendly analytics, which measure visits in aggregate. We do not use advertising or marketing cookies.

For more detail, please read our Cookie Policy. To learn how to manage cookies and browser storage through your browser, visit our Cookie Settings page.

We keep personal data only for as long as it is needed for the purposes described in this policy.

• Enquiries and correspondence: for as long as needed to respond to you and manage any resulting project, and for a reasonable period afterwards for our records

• Studio update sign-ups: until you ask to stop receiving updates or ask us to remove your email address

• Analytics data: only in aggregated form, which does not identify individual visitors

When data is no longer needed, we delete it or make it anonymous, unless we are required by law to keep it for longer.

Copies held by our service providers may also be subject to their own retention practices.

We are based in Indonesia, but the platforms and service providers that help us run the Site may store or process data on servers located in other countries.

Where your data is transferred outside Indonesia, we use established providers and take reasonable steps to help ensure it is handled securely and in line with this policy and applicable law.

Subject to applicable law, including the PDP Law, you have certain rights over your personal data. These may include the right to:

• Access the personal data we hold about you

• Correct data that is inaccurate or incomplete

• Request the deletion of your personal data

• Request a copy of your personal data in a commonly used format, where applicable

• Withdraw your consent at any time, including for studio updates

• Object to, or ask us to limit, certain processing

If you are visiting from another region, such as the European Union or the United Kingdom, you may have additional rights under your local laws, including the right to raise a concern with your local data protection authority.

To exercise any of these rights, email us at lappo@gmail.com. We may need to verify your identity before acting on your request, and we will respond in line with applicable law.

We take reasonable technical and organisational measures to protect your personal data from loss, misuse, and unauthorised access. We also rely on established platforms that maintain their own security safeguards.

No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee its absolute security.

The Site links to our profiles on Instagram, LinkedIn, Dribbble, and Behance, and may include embedded media from third-party services. Embedded content may behave as if you had visited the other service directly, and that service may collect data about your visit.

These services operate independently and have their own privacy policies. We are not responsible for their practices, so we encourage you to review their policies before sharing information with them.

The Site is intended for a professional audience and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18.

If you believe a child has shared personal data with us, please contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Any updates will be posted on this page with a revised effective date.

We encourage you to review this policy periodically. Your continued use of the Site after changes are posted means you acknowledge the updated policy.

If you have any questions about this Privacy Policy or how we handle your personal data, we would be glad to hear from you.

You can reach us at lappo@gmail.com or through the contact form on the Site.