Privacy Policy

Last updated: 4 May 2026 · Effective from the date above.

1. Who we are

Cobbs Lab (“Cobbs Lab”, “we”, “us”, or “our”) is a web design and development studio based in Singapore. This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit cobbslab.com or engage us for services.

This policy is written to comply with the Personal Data Protection Act 2012 (PDPA) of Singapore, including the Data Protection, Do Not Call, and (where applicable) Data Portability provisions, as well as the advisory guidelines issued by the Personal Data Protection Commission (PDPC).

2. Data Protection Officer (DPO)

In line with section 11(3) of the PDPA, we have appointed a Data Protection Officer who can be contacted for any questions, requests, or complaints concerning your personal data:

• Email: info@cobbslab.com (subject line: “DPO — PDPA query”)
• Phone: +65 8141 8897
• Postal address: Cobbs Lab, Singapore

3. What personal data we collect

We only collect personal data that is reasonably necessary to provide our services. Specifically:

• Identity & contact data — name, email address, phone number and business name you submit through the quote form, the express checkout flow or direct correspondence.
• Project data — tier selection, timeline, budget range, free-form project notes and any assets (logos, copy, images) you upload.
• Payment data — when paying a deposit or balance, payment is processed by Stripe, Inc. Your card number, CVC and expiry are entered directly on Stripe's PCI-DSS compliant infrastructure. We never see or store your full card details. We retain only the last four digits, brand, and a transaction reference.
• Technical data — IP address, browser type, device type, referring URL, pages visited, and timestamps. This data is collected via web server logs and, where you have given consent, privacy-friendly analytics.
• Cookie preferences — a single first-party cookie / local storage entry (cl_consent_v1) is used to remember your cookie consent decision.

We do not knowingly collect personal data from children under 13. We do not collect special categories of personal data (e.g. NRIC/FIN numbers, medical information) and ask that you do not submit such data through our forms.

4. Purposes for which we use personal data

We collect, use and disclose personal data only for the purposes notified to you and for which you have given (or are deemed under the PDPA to have given) consent. The purposes are:

1. To respond to your enquiry and prepare a website quotation.
2. To deliver, support and invoice the services you have engaged us for.
3. To process payments (including the 50% deposit and balance) via Stripe.
4. To send transactional and project-related communications (e.g. drafts, revisions, launch confirmations).
5. To improve our website and services through aggregated, de-identified analytics (only if you accept analytics cookies).
6. To comply with our legal and regulatory obligations under Singapore law, including the PDPA, the Income Tax Act, and the Spam Control Act.

5. Legal basis — consent

Under the PDPA, we generally rely on your consent to collect, use and disclose your personal data. By submitting a form, ticking a consent checkbox, or engaging us for paid work, you consent to the processing described in this policy. Where the law permits, we may rely on the deemed consent, legitimate interests, or business improvement exceptions in the First Schedule of the PDPA — for example, server logs needed to prevent abuse, or sending an invoice you reasonably expect.

6. Disclosure to third parties

We do not sell or rent your personal data. We share it only with the following categories of recipients, on a strict need-to-know basis and under written contracts requiring an equivalent standard of protection:

• Payment processor — Stripe, Inc. (United States & Ireland), to charge the deposit and balance.
• Email delivery — transactional email providers (e.g. Resend, Postmark) used to send and receive correspondence at info@cobbslab.com.
• Hosting & infrastructure — cloud providers such as Vercel, Cloudflare and AWS, where the website and any project files are hosted.
• Analytics — if you opt in, a privacy-friendly analytics provider such as Plausible or Google Analytics 4 with IP-anonymisation.
• Government authorities — where required by law, court order, or to protect our legal rights.

7. Cross-border transfers

Some of the third parties above process data outside Singapore (notably the United States and the European Economic Area). In line with section 26 of the PDPA and the Personal Data Protection Regulations 2014, we take reasonable steps to ensure that any overseas recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the PDPA. Where appropriate, we rely on the recipient's adherence to recognised certifications (such as the APEC CBPR system) or contractual data-protection clauses.

8. How long we keep your data

In line with the PDPA's retention limitation obligation, we keep personal data only for as long as it is needed for a legal or business purpose:

• Quote requests that do not result in an engagement — up to 12 months, then deleted.
• Project records and contracts — for the duration of the engagement plus 5 years (to comply with section 67 of the Income Tax Act).
• Invoices and payment records — 5 years from the end of the relevant year of assessment.
• Server access logs — up to 90 days, then deleted or anonymised.
• Marketing email lists — until you withdraw consent or unsubscribe.

9. Your rights under the PDPA

You have the right to:

• Access the personal data we hold about you and information about how it has been used or disclosed within the past year.
• Correct any personal data that is inaccurate or incomplete.
• Withdraw consent at any time to any or all of the purposes set out in section 4 above. Withdrawal will not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer provide the service.
• Port your personal data to another organisation, where the data portability provisions of the PDPA come into force and apply to the data in question.

To exercise any of these rights, please email info@cobbslab.com. We will respond within 30 days, in line with PDPC guidance.

10. Do Not Call (DNC) Registry

We respect Singapore's Do Not Call Registry. We will not send marketing messages to your Singapore phone number unless we have your clear consent or an existing ongoing relationship that permits us to do so under the DNC provisions of the PDPA. You can opt out of marketing at any time by replying “UNSUBSCRIBE” to any marketing email or by contacting our DPO.

11. Cookies

On your first visit, we ask whether you accept analytics cookies. We always set:

• Strictly necessary — one local-storage entry to remember your cookie choice (cl_consent_v1).

Only with your consent do we set:

• Analytics — a privacy-friendly analytics provider that records aggregated traffic statistics (e.g. page views, referring sources). IPs are anonymised and we do not build cross-site profiles.

You can change your decision at any time by clearing your browser's storage for this site, or by contacting us.

12. Security

We protect personal data with reasonable technical and organisational measures: TLS (HTTPS) on all pages, hardened cloud infrastructure, principle-of-least-privilege access controls, and encryption at rest where supported by the underlying provider. No system is perfectly secure — if we discover a data breach that is likely to cause significant harm, we will notify the PDPC and affected individuals as required under section 26D of the PDPA.

13. Updates to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the latest revision. Material changes will be notified through a banner on this site or by email where we have your address.

14. Complaints

If you are dissatisfied with how we have handled your personal data, please contact our DPO first so we have the opportunity to resolve the matter. If you remain dissatisfied, you may lodge a complaint with the PDPC at www.pdpc.gov.sg.

← back home