Privacy Policy

This policy explains what personal data workshop 63 ("we", "us") collects through this website, how we use it, and the rights you have over it. workshop 63 is a design atelier based in the Kingdom of Bahrain. We take data protection seriously and operate in line with Bahrain's Personal Data Protection Law (Law No. 30 of 2018, the "PDPL").

What we collect

We only collect data you actively give us through the forms on this site. Specifically:

• Newsletter — your email address.
• Product enquiries and commission enquiries — your name, email, phone number (optional), the piece or project you're asking about, and any message you include.
• Technical logs — when you submit a form, our server briefly records the submission timestamp and your IP address for the purpose of rate-limiting abuse. This is deleted automatically on a rolling basis.

We do not use analytics cookies, advertising trackers, or third-party pixels on this site.

Why we collect it

• To reply to your enquiry and, where relevant, quote, fulfil, and deliver a piece.
• To send you occasional dispatches on new work, studio visits, and material experiments — but only if you subscribed to the newsletter.
• To keep records of past clients for warranty, aftercare, and future correspondence.
• To prevent automated abuse of our forms.

Where your data is stored

Enquiries and newsletter sign-ups are stored in a Supabase database hosted in Frankfurt, Germany (EU). Access to this database is restricted to workshop 63 and is protected by authentication, row-level security, and environment-isolated keys. We do not sell, rent, or share your data with third parties for marketing purposes.

How long we keep it

• Newsletter subscribers — until you unsubscribe or ask us to delete your record.
• Enquiries that became orders — retained for up to seven years for warranty, aftercare, and financial record-keeping.
• Enquiries that did not become orders — retained for up to twenty-four months, after which they are deleted unless you ask for deletion sooner.
• Rate-limit logs — deleted automatically within twenty-four hours.

Your rights

Under the PDPL you have the right to:

• Know what data we hold about you.
• Ask us to correct any inaccurate data.
• Ask us to delete your data (the "right to be forgotten"), subject to any legal record-keeping requirements.
• Object to, or withdraw consent for, any processing based on your consent.
• Receive a copy of the data you have given us in a portable format.

To exercise any of these rights, email workshop.sixtythree@gmail.com. We will respond within thirty days.

WhatsApp and email enquiries

If you contact us through WhatsApp or directly by email rather than through a form on this site, your message is handled by Meta (WhatsApp) or your email provider under their own privacy terms. We only retain what is necessary to service your enquiry.

Security

We protect the data you entrust to us using industry-standard measures: encryption in transit (HTTPS), authentication-gated access, row-level security policies, no-indexing of internal pages, and strict separation between public and administrative keys. No system is absolutely secure; if a data incident affecting you ever occurs, we will notify you without undue delay.

Children

This site is not directed at children, and we do not knowingly collect data from anyone under the age of sixteen. If you believe a minor has submitted data to us, please email us and we will delete it.

Changes to this policy

We may update this policy from time to time. The "Last updated" date above reflects the most recent revision. Material changes will be announced on the site.

Contact

Questions about this policy, or about how we handle your data, should be sent to workshop.sixtythree@gmail.com.