Privacy Notice

Effective 2 October 2026. Last updated 2 October 2026.

This notice explains what personal information I collect through madebysalmon.com and in the course of my work, why I collect it, who I disclose it to, how long I keep it, and the rights you have over it, wherever you live.

1. Who I am

1.1 This website, madebysalmon.com (the Website), is operated by Lee Han Shuen (Simon), an independent web designer trading as Made By Salmon, a business registered in Malaysia (registration no. to be added). In this notice, “I”, “me” and “my” refer to me in that capacity, and “you” refers to any visitor, prospective client or client.

1.2 I am responsible for the personal information described in this notice, and I am personally the person accountable for privacy and in charge of the protection of personal information for my business. You can contact me about any privacy matter at simon@madebysalmon.com.

2. Scope

2.1 This notice applies to personal information I collect through the Website, by email, and in the course of preparing drafts and providing website design and development services to businesses.

2.2 I serve clients in several countries. This notice is designed to meet the requirements of the privacy laws of the United States (including state privacy laws), Canada (including Quebec), Australia and Malaysia. Some of those laws apply to me only above certain size thresholds; I extend the rights described in this notice to everyone, regardless of where they live.

3. Personal information I collect

3.1 The table below lists the categories of personal information I collect, where it comes from and why I use it. Section 9 sets out how long I keep it.

3.2 I do not collect sensitive personal information, such as health, financial account, government identifier, precise geolocation, racial, religious or biometric information, and I ask you not to send it to me.

3.3 Text you type into the “Try it with your business” preview remains in your browser. I do not receive, record or store it, and it is not sent to Google Analytics.

3.4 To prepare a free draft, I use information that a business has made publicly available, such as its name, services, area and opening hours. I do not collect personal information about private individuals for this purpose.

4. Cookies and analytics

4.1 I use Google Analytics 4, a web analytics service provided by Google LLC, to understand how visitors use the Website. When it is active, it sets the first-party cookies below. Google receives your IP address to determine your approximate location and then discards it; Google Analytics does not store IP addresses.

4.2 Consent where required. Where the law requires your consent before analytics cookies are set, including in Quebec, the European Economic Area, the United Kingdom and Switzerland, Google Analytics remains off until you choose to allow it.

4.3 Your choices everywhere. You can turn analytics off at any time with the “Privacy choices” button in this notice (where analytics needs your consent, the link also sits at the bottom of every page), block or delete cookies in your browser, or install the Google Analytics Opt-out Browser Add-on. If your browser sends a Global Privacy Control signal, the Website treats it as a request to opt out and does not load Google Analytics.

4.4 Do Not Track. There is no agreed standard for responding to Do Not Track signals. The Website does not respond to them, but it honors Global Privacy Control as described above.

4.5 I do not use Google Analytics advertising features or Google signals. The Website sets no other cookies and loads no advertising or social media tracking technology. For how Google processes data, see How Google uses information from sites or apps that use its services.

4.6 I also use Google Search Console, which reports how the Website appears in Google Search. It uses data from Google’s own systems and places no cookies or code on the Website.

5. How I use personal information

5.1 I use personal information only to:

• respond to enquiries and prepare quotes and drafts;
• design, build, launch and support websites under an agreement with you;
• issue invoices, receive payments and keep the records the law requires;
• understand how the Website is used and improve it;
• keep the Website secure and prevent misuse;
• send business communications as permitted in section 5.3; and
• comply with the law and establish, exercise or defend legal claims.

5.2 I do not use personal information for targeted advertising, for profiling, or for automated decision-making that produces legal or similarly significant effects. I will not use it for a new purpose without telling you first and, where the law requires, obtaining your consent.

5.3 I send commercial emails only where anti-spam law allows, including the CAN-SPAM Act in the United States, Canada’s Anti-Spam Legislation and Australia’s Spam Act 2003. Every commercial email identifies me, includes my contact details and a postal address, and contains a free unsubscribe option that I honor within ten business days.

6. Consent

6.1 I collect, use and disclose personal information with your consent, which may be express (for example, when you email me or allow analytics) or implied where the law permits. Where consent is not the basis, I rely on what is necessary to perform a contract with you or to comply with the law.

6.2 You may withdraw consent at any time by emailing me or using “Privacy choices”, subject to legal or contractual restrictions. I will explain the likely consequences, for example that I may be unable to provide a service. Withdrawal does not affect processing that took place before it.

6.3 Providing personal information is voluntary. If you choose not to provide contact details, I will not be able to respond to you or provide my services.

7. Disclosure of personal information

7.1 I disclose personal information only to the following categories of recipients, and only as needed for the purposes in section 5:

• Hosting and security: Cloudflare, Inc., which also stores the messages you send through the contact form and questionnaire.
• Analytics: Google LLC (Google Analytics), when analytics is active.
• Email: my business email provider, and Resend (Plus Five Five, Inc.), which delivers contact form and questionnaire messages to my inbox.
• Payments: Stripe, Inc., when you pay an invoice. Stripe collects and processes your card details under its own privacy policy; I never see or store your full card number.
• Professional advisers: accountants, auditors and lawyers, under duties of confidentiality.
• Authorities: regulators, courts or law enforcement, where the law requires it.

7.2 These service providers act on my instructions and must protect personal information appropriately.

7.3 In the past 12 months I have not sold personal information, shared it for cross-context behavioral advertising, or used it for targeted advertising, and I will not do so. I have no actual knowledge of selling or sharing the personal information of anyone under 16.

8. International transfers

8.1 I am based in Malaysia. Personal information is processed in Malaysia and, through my service providers, in the United States and other countries where Cloudflare, Google and Resend operate data centers. Information may therefore be accessible to authorities in those countries under their laws.

8.2 Before transferring personal information outside your country, I take reasonable steps to ensure it receives protection comparable to that required in your jurisdiction, including under section 129 of Malaysia’s Personal Data Protection Act 2010, Australian Privacy Principle 8, and Canadian and Quebec privacy law, using providers bound by contractual data protection commitments.

9. Retention

• Enquiries that do not become projects: up to 24 months from the last contact, then deleted.
• Information used to prepare a declined draft: deleted with the draft, within 30 days.
• Client agreements, invoices and accounting records: seven years, as required by Malaysian tax law.
• Client website content: until the project ends and handover is complete, unless you ask me to keep it.
• Google Analytics data: 14 months, after which Google deletes it automatically under my retention setting.

9.1 When I no longer need personal information, I delete or anonymise it securely.

10. Security and incidents

10.1 I protect personal information with reasonable technical and organizational safeguards appropriate to its sensitivity, including encrypted connections and access limited to what each task requires. No method of transmission or storage is completely secure.

10.2 I keep a record of any confidentiality incident. If an incident creates a risk of significant harm or serious injury, I notify the affected individuals and the relevant regulator within the time limits required by applicable law, and take prompt steps to contain it.

11. Your rights

11.1 Subject to applicable law, you have the right to:

• know and access the personal information I hold about you, how I use it and who I disclose it to, and receive a copy;
• correct information that is inaccurate, incomplete or out of date;
• delete your personal information, unless I must keep it by law;
• portability: receive your information in a structured, commonly used format, or have it sent to another provider;
• withdraw consent and object to direct marketing at any time;
• opt out of any sale, sharing, targeted advertising or profiling (I do none of these, but the right remains yours);
• de-indexation: ask me to stop disseminating your information or remove a link to it where its dissemination breaches the law (Quebec);
• appeal my decision on any request, as described in section 12; and
• not be discriminated against for exercising any of these rights.

12. Making a request

12.1 Email simon@madebysalmon.com with the subject “Privacy request”, stating the right you wish to exercise. I verify your identity by confirming details you have already given me, and I ask only for what is needed to do so.

12.2 You may use an authorized agent to make a request on your behalf. I will ask for written proof of the agent’s authority and may ask you to confirm your identity directly.

12.3 I respond within 21 days. Requests are free of charge, except where the law allows a reasonable fee for requests that are manifestly unfounded or excessive. If I cannot fully comply, I explain why.

12.4 Appeals. If I decline your request, you may appeal by replying with the subject “Privacy appeal” within 60 days. I will respond in writing within 45 days, explaining my decision. If your appeal is denied, you may contact the regulator for your location listed in section 13, including your state Attorney General if you live in the United States.

13. Regional information

United States

13.1 This notice is intended to meet the disclosure requirements of the California Consumer Privacy Act and California Online Privacy Protection Act and of the comprehensive privacy laws of other US states, to the extent they apply. The categories of personal information I collect, their sources, purposes and recipients are set out in sections 3 and 7. I do not sell personal information, so Nevada residents have no sale to opt out of, and I do not disclose personal information to third parties for their direct marketing purposes (California Civil Code section 1798.83).

Canada

13.2 I handle personal information in accordance with the Personal Information Protection and Electronic Documents Act and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Law 25). The person in charge of the protection of personal information is Lee Han Shuen, at simon@madebysalmon.com. You may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Australia

13.3 I handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988. You may request access to or correction of your information as described in sections 11 and 12. If you are not satisfied with how I handle a complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

Malaysia

13.4 I am the data controller under the Personal Data Protection Act 2010, as amended. You may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi).

Other locations

13.5 If you live elsewhere, including the European Economic Area or the United Kingdom, you have the rights in section 11 and may complain to your local data protection authority.

14. Children

14.1 My services are for businesses. The Website is not directed at children and I do not knowingly collect personal information from anyone under 16. If you believe a child has provided me with personal information, contact me and I will delete it.

15. Changes to this notice

15.1 I may update this notice from time to time. I will post the updated version on this page with a new effective date and, for material changes, notify current clients by email before the change takes effect.

16. Contact and complaints

16.1 Questions, requests or complaints about this notice or my privacy practices: simon@madebysalmon.com. I respond to complaints within 21 days.

16.2 If you are not satisfied with my response, you may contact the privacy regulator for your location listed in section 13.