Privacy

This site sets no cookies, runs no analytics, loads no third-party scripts and embeds nothing from another domain. What is left is described below in full, and it is short.

1 · Who is responsible

2 · Why this page exists at all

Two laws could have applied to us, and neither does.

In Australia, the Privacy Act 1988 exempts a small business under AUD $3 million turnover. We are well under it, so the Australian Privacy Principles do not bind us.

In Europe, the GDPR applies to a business outside the EU only if it offers services to people inside it. We do not — we work with Australian clients — and being reachable from Europe is not the same thing.

Both of those are exemptions we could hide behind, and this page is what we do instead. Everything below is a commitment, not a compliance exercise. If we ever take on a European client, we will rewrite this page before that work starts rather than after.

3 · Server logs

Every request to a web server is recorded by that server. Our host records the requesting IP address, the date and time, the page requested, the referring page, and the browser and operating system your browser reports.

• Why: delivering the site, and detecting and investigating abuse or attack.
• Legal basis (GDPR): Art. 6(1)(f) — our legitimate interest in running a site that works and is not under attack.
• How long: for as long as Hostinger keeps them. Their privacy policy publishes retention periods for several other things but not for server logs, so we cannot honestly quote you a number. What we can say is that we do not export those logs, analyse them, or keep a copy of our own anywhere else.

These logs are not combined with anything else and are not used to identify you.

4 · Hosting and where the data sits

The site is served by Hostinger, Hostinger International Ltd., 61 Lordou Vironos Street, Larnaca 6023, Cyprus, from a data centre in Malaysia.

If those servers are outside Australia, your request leaves the country to be answered. We name the region above so you can see that rather than having to ask. A data processing agreement with the host is in place. It is annexed to their terms of service and takes effect with them rather than being separately signed, and it carries the European Standard Contractual Clauses — so the safeguard exists already, before there is any European client who would need it.

5 · Fonts

Every typeface is served from this domain. No request is made to Google Fonts or any other font service, so your IP address is never handed to a third party just to draw this page. That is deliberate: embedding Google Fonts without consent was held unlawful by the Munich Regional Court in January 2022 (LG München I, 3 O 17493/20).

6 · What is stored on your device

No cookies are set. The site stores exactly one value in your browser’s sessionStorage: which project you last opened and how far down the page you were, so closing a case study puts you back where you left rather than at the top.

• It never leaves your browser. It is not sent to us or to anyone else.
• It is deleted when you close the tab.
• It holds a list position and a scroll offset. Nothing about you.

You can clear it at any time through your browser’s site-data settings.

7 · If you contact us

There is no contact form. If you email or call, we process what you send in order to answer you.

• Legal basis (GDPR): Art. 6(1)(b) where it concerns a contract or the steps before one, otherwise Art. 6(1)(f).
• How long: until the enquiry is finished, then deleted — unless Australian tax and record-keeping rules require us to keep it, which is generally five years for anything that became a transaction.

Email is not encrypted end to end unless both sides support it. If you have something confidential, say so and we will find another route.

8 · Encryption

The site is served over HTTPS. The lock in your address bar is the proof.

9 · Your rights

We give you these whether or not a law requires us to. Ask us to:

• get a copy of what we hold (Art. 15)
• have it corrected (Art. 16) or erased (Art. 17)
• have its use restricted (Art. 18)
• receive it in a portable form (Art. 20)
• object to processing based on legitimate interest (Art. 21) — which is the server logs above
• withdraw consent at any time, with effect from that point on (Art. 7(3))

Write to webagencysunny@gmail.com. We will answer within 30 days.

10 · Complaints

Tell us first — webagencysunny@gmail.com — and we will answer in writing.

If that does not resolve it, you can complain to the Office of the Australian Information Commissioner (OAIC). The OAIC generally cannot act against a business exempt under s 6D, but it can tell you where you stand, and we would rather point you there than pretend there is nowhere to go.

11 · Automated decisions

None. No profiling and no automated decision-making within the meaning of Art. 22 GDPR happens on this site.

12 · Changes

If this site starts doing something new — a form, an analytics tool, an embedded map — this page changes before that ships, not after.

Last reviewed: 20 September 2026