Privacy Policy

The short version

This site collects the minimum it needs to reply to you and to deliver consulting you have paid for. Nothing is sold. Nothing tracks you until you accept cookies, and declining costs you no functionality.

Who is responsible for your data

Ezekiel Contreras-Forrest, trading under his own name, is the controller of the personal data described here. That means the personal information controller under the Philippines Data Privacy Act of 2012, the data controller under Vietnam's Personal Data Protection Law and under Indonesia's Law No. 27 of 2022, and the controller under the GDPR and UK GDPR. There is no data protection officer to route things through: he handles these questions personally, at ezekielphilippines25@gmail.com.

What is collected, and when

Nothing is collected simply from reading these pages. Information is collected only when you actively do one of the following.

Using the contact form

Your name, email address, and the message you write. These are emailed to Ezekiel so he can reply. The site keeps no database, so no copy is stored here.

Booking a call

Scheduling is handled by Calendly, which collects your name, email, and chosen time under its own privacy policy. The Calendly embed does not load until you accept cookies or explicitly ask for it, so nothing reaches Calendly before then.

Paying for consulting

Payment is processed by Stripe. Your card details go directly to Stripe and are never seen, handled, or stored by this site. Ezekiel receives your name, email, and the amount paid so the session can be delivered and receipted.

During a session

Whatever you choose to tell him about your situation. Some of it may be sensitive, such as your finances or your family circumstances. Share only what you are comfortable sharing. Notes are kept only as long as they are useful to you, and deleted on request.

Accepting analytics

If, and only if, you accept cookies, an analytics script loads and records aggregate page views. Your choice is remembered in your browser and can be changed by clearing site data.

Why it is allowed to be collected

Under the GDPR and the UK GDPR, personal data needs a lawful basis. The bases relied on here are:

Performing a contract

Your name, email, and payment record, used to deliver and receipt a session you booked.

Your consent

Analytics, and the loading of the Calendly embed. You give it by clicking Accept, and you can withdraw it at any time by clearing this site's data in your browser.

Legitimate interests

Replying to a message you sent, and keeping the site secure by rate-limiting abuse. The interest is running a small consultancy and answering the people who contact it, which does not override your rights.

Legal obligation

Keeping payment records for as long as tax and accounting rules require.

Server logs

The hosting provider keeps standard technical logs, including IP addresses, for security and abuse prevention. Your IP address is also held briefly in memory to rate-limit the contact form. It is not stored beyond that and is not linked to your message.

Who it is shared with

Only the service providers needed to run the site: the hosting provider, Stripe for payments, Calendly for scheduling, the email provider used to deliver form messages, and the analytics provider if you accepted cookies. Each processes data under its own privacy policy and under contract. Your information is never sold, and never shared for advertising.

Where your data goes

Ezekiel lives and works in Southeast Asia, and the providers above are largely based in the United States, so your data is processed outside the country you live in. Where data leaves the European Economic Area or the United Kingdom, the providers used rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard. Under the Philippines Data Privacy Act, responsibility for your data stays with Ezekiel even when a provider processes it abroad.

How long it is kept

Emails from the contact form are kept as long as the conversation is useful, and deleted on request. Session notes are kept while they are useful to you, and deleted on request. Payment records are retained as long as tax and accounting rules require, which is typically several years and is not something that can be waived.

Your rights

Wherever you live, you can ask what information is held about you, ask for it to be corrected, ask for it to be deleted, ask for a copy in a portable format, or object to its use. Email ezekielphilippines25@gmail.com and it will be handled without charge, normally within 30 days.

Complaining to a regulator costs you nothing, and you do not need to raise it here first, though it is usually faster if you do. Where you live decides which law those rights come from and who you can complain to.

Philippines

Your rights come from the Data Privacy Act of 2012 (RA 10173): to be informed, to object, to access, to correct, to erase or block, to data portability, and to damages. You can complain to the National Privacy Commission.

Vietnam

Your rights come from the Personal Data Protection Law (Law No. 91/2025/QH15) and Decree 356/2025/ND-CP, both in force since 1 January 2026: to know, to access, to withdraw consent, to delete, to restrict processing, to object, and to complain. Requests are acknowledged within two working days and acted on inside the periods that law sets. You can complain to the Department of Cyber Security and High-Tech Crime Prevention under the Ministry of Public Security.

Indonesia

Your rights come from Law No. 27 of 2022 on Personal Data Protection: to be informed, to access, to correct, to erase, to withdraw consent, to object to automated decisions, to restrict processing, to data portability, and to seek compensation. You can complain to the supervisory authority designated under that law.

European Union and United Kingdom

Your rights come from the GDPR and the UK GDPR: access, rectification, erasure, restriction, portability, objection, and the right not to be subject to automated decision-making. No automated decisions are made about you here. You can complain to your national data protection authority, or to the Information Commissioner's Office in the UK.

Anywhere else

The same rights are honoured regardless of whether a local law compels it. Ask, and it will be done.

If something goes wrong

If a breach happens that puts your personal data at real risk, you will be told, and the relevant regulator notified, within 72 hours of it being discovered. That is the deadline the Philippine Data Privacy Act, Indonesia's Law No. 27 of 2022, and the GDPR all set, and Vietnam's Personal Data Protection Law requires notification on a comparable footing, so 72 hours is treated as the rule everywhere rather than being decided case by case.

Children

This service is sold to adults only. Information is not knowingly collected from anyone under 18. If you believe a child has sent information through this site, email the address above and it will be deleted.

Changes

If this policy changes materially, the date at the top will be updated. Continuing to use the site after a change means accepting the revised policy.