Website and customer privacy notice

Last updated: 9 October 2026.

This notice explains what Web and Cloud Innovation Ltd ("we") collects about you through the website at premises.ph — when you create an estate, raise a support ticket or talk to the concierge — and what we hold about the administrators and billing contacts of the businesses that subscribe to the Service.

For that information we decide what is collected and why, so we are its controller: the personal information controller under the Data Privacy Act of 2012 (Republic Act 10173) of the Philippines, and the controller under the General Data Protection Regulation (EU) 2016/679, which applies to us because we are established in Malta.

It does not cover the records a business keeps in its own workspace about its tenants, owners, staff and visitors. The business is the controller of those, and we process them only on its instructions. The Data privacy notice and the Data processing agreement describe that.

1Who We Are

Web and Cloud Innovation Ltd, a company registered in Malta under number C106789, of 30/1 Kenilworth Court, Sir Augustus Bartolo Street, Ta' Xbiex XBX 1093, Malta.

Our privacy contact is privacy@premises.ph. It reaches the person we have designated to act as our Data Protection Officer, and it is where any request or question about this notice should go.

2What We Collect, And Why

When you create an estate: your name, email address and mobile number, your role, the name and kind of your estate, its size, the web address you choose for it, and the network (IP) address the form was sent from. We use them to set up the workspace you asked for, to reach you about it, and to keep a record of who asked for it.

When you raise a support ticket: your name, email address, phone number if you give it, your message, and the network address it was sent from. We use them to answer you and to keep a record of what was asked and answered.

When you talk to the concierge: the messages you type, the answers you are given, and the network address they came from. If you choose to leave an email address or a name in the chat so that a person can follow up, we keep it with the conversation. We use all of this to answer your question, to follow up where you asked us to, to keep the chat from being abused, and to find where its answers fall short.

When you administer or pay for a subscription: the names, email addresses and phone numbers of the business's administrators and billing contacts; the business's billing name, address and tax number; the invoices we issue and the payments we receive; and the record of who accepted which version of our terms, and when. We use them to provide the Service, to bill for it, and to keep the accounting and contract records the law requires.

When you open any page: our web server keeps an ordinary log of each request, with the network address, the time, the address asked for, the answer given, and what the browser says about itself. We use it to keep the site working and secure, and to investigate abuse.

We use no advertising trackers, no analytics service and no social-media pixels, and we build no profile of any visitor. The Cookie notice lists everything the website stores in a browser.

3The Lawful Basis

• Creating an estate, and running a subscription: the steps you ask us to take before a contract, and the performance of that contract.
• Invoices, payments and the acceptance record: our legal obligations under tax and accounting law, and the contract.
• Support tickets and the concierge: our legitimate interest in answering the people who write to us, balanced against yours.
• A name or email address you leave in the chat: your consent to be contacted, which you may withdraw at any time.
• Server logs and protection against abuse: our legitimate interest in keeping the site and the people who use it safe.

Under RA 10173 these are the matching criteria of its section 12: contract, legal obligation, legitimate interests and consent.

4Who Receives It

We never sell personal information, and we never share it for anybody's marketing. Inside the company, only the people whose work needs it can see it. Outside, these services process it for us:

• Hetzner Online GmbH, in Germany, hosts the servers the website and its databases run on.
• Anthropic PBC, in the United States, provides the AI model that writes the concierge's answers. It receives the messages typed into the chat in order to answer them, and under the terms we use it on it does not train its models on them.
• Telegram, and the email provider that carries our mail, deliver the internal alert that tells us a sign-up or a ticket has arrived. The alert carries the details you entered in the form.
• The same email provider delivers the replies and confirmations we send you.
• Where you pay us, the bank or payment service you choose to pay through sees the payment.

Beyond them, information is disclosed only to professional advisers who owe us a duty of confidence, and to authorities where the law requires it.

5Transfers Abroad

We are in Malta and our servers are in Germany, both inside the European Economic Area. The concierge's provider is in the United States, and Telegram may process its messages outside the European Economic Area.

Where personal information leaves the European Economic Area, we rely on the safeguards the GDPR recognises: an adequacy decision where one covers the destination, and otherwise the European Commission's Standard Contractual Clauses. Where information about a person in the Philippines is transferred, we stay accountable for it under RA 10173 and protect it with the same contracts and measures.

6How Long We Keep It

• A concierge conversation in which no email address or name was left: twelve (12) months from its last message, then deleted.
• A concierge conversation in which an email address or a name was left: twenty-four (24) months from its last message, then deleted.
• A support ticket: twenty-four (24) months from when it was raised, then deleted.
• A sign-up that did not become a customer: twenty-four (24) months from when it was made, then deleted.
• A customer's records, invoices and acceptance record: for the life of the subscription, and afterwards for as long as tax, accounting and contract law require.
• Server logs: only for as long as they are needed for security and fault-finding, then deleted.

7Your Rights

Under RA 10173 and the GDPR you may: be told how your information is used, which is what this notice is for; see what we hold about you and have a copy; have it corrected or completed; have it deleted or blocked where the law allows; object to processing that rests on our legitimate interests; withdraw a consent at any time, without affecting what was done before; receive what you gave us in a portable form; and, under RA 10173, be compensated for damage caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your information.

Write to privacy@premises.ph. Asking costs nothing. We answer without undue delay, and within the period the law sets: under the GDPR that is one month, which may be extended where a request is complex, in which case we will tell you.

8Complaints

If you are not satisfied with how we have handled your information, you may complain to the National Privacy Commission of the Philippines (privacy.gov.ph), to Malta's Information and Data Protection Commissioner (idpc.org.mt), or to the supervisory authority where you live or work in the European Union. We would like the chance to put it right first, but you do not have to ask us before you complain.

9Security

Every page and form travels encrypted. The sign-up, ticket and chat records are kept in databases that no web address reaches, and the inbox that reads them is behind its own password.

10Children

The website and the Service are made for businesses and the people who run them. We do not knowingly collect information about children through the website.

11Changes

When this notice changes, the date at the top changes with it, and so does the fingerprint shown beside it.