Likha

Privacy Policy

Effective Date: April 21, 2026
Last Updated: April 21, 2026

1. Introduction

Welcome to Likha (the “Platform”), a creator-brand marketplace operated by Oscar Oganiza (the “Administrator,” “we,” “us,” or “our”). Likha is a creator-brand marketplace connecting brands with creators for collaboration opportunities across the Philippines and Southeast Asia.

Current Operational Status:
At the moment, Likha is personally administered and operated by Oscar Oganiza as a sole proprietorship. The formal entity registration under the name Crealabs with the Securities and Exchange Commission (SEC) is currently in process. All compliance registrations, including National Privacy Commission (NPC) registration as a Personal Information Controller (PIC), are also in process. Upon completion of these registrations, this Privacy Policy will be updated to reflect the registered legal entity.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information in compliance with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations (IRR), and applicable National Privacy Commission (NPC) circulars and advisories.

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

2. Data Controller Information

Personal Information Controller (PIC):
Oscar Oganiza (Sole Administrator)
Operating as: Likha
Entity Registration: Crealabs (SEC registration in process)
Email: [support@joinlikha.com]
NPC Registration: In process

Current Status:
At the moment, Oscar Oganiza personally administers and operates the Likha platform. The formal entity registration with the Securities and Exchange Commission (SEC) and compliance registrations with the National Privacy Commission (NPC) are currently in process. Upon completion of these registrations, this Privacy Policy will be updated to reflect the registered legal entity details.

For all privacy-related inquiries, concerns, or requests to exercise your data privacy rights, please contact us at the email address above.

3. Personal Information We Collect

We collect personal information necessary to operate the Platform and facilitate creator-brand collaborations. The information we collect depends on whether you register as a Brand or a Creator.

3.1 Information You Provide Directly

For All Users (Brands and Creators):

  • Full name
  • Email address
  • Phone number
  • Password (encrypted)
  • Company/business name (for Brands)
  • Stage name or creator handle (for Creators)
  • Profile photo
  • Bio and profile information
  • Social media links and handles
  • Communication preferences

For Brands:

  • Company registration details (SEC, DTI, or equivalent)
  • Industry and business type
  • Tax Identification Number (TIN)
  • Billing address
  • Authorized representative information
  • Payment information (processed through third-party payment processors)

For Creators:

  • Creator portfolio (images, videos, content samples)
  • Social media analytics and audience demographics
  • Rates and collaboration preferences
  • Tax Identification Number (TIN)
  • Bank account or e-wallet information for payouts
  • Government-issued ID (for identity verification)

3.2 Information Collected Automatically

When you use the Platform, we automatically collect:

  • IP address and device information
  • Browser type and version
  • Operating system
  • Pages visited and time spent on pages
  • Referral source (how you found Likha)
  • Date and time of access
  • Cookies and similar tracking technologies (see Section 8)

3.3 Information from Third Parties

We may collect information from:

  • Social media platforms (when you connect your accounts)
  • Payment processors (transaction confirmation and status)
  • Identity verification services (for KYC compliance)
  • Analytics providers (aggregated usage data)

4. How We Use Your Personal Information

We process your personal information for the following lawful purposes under the Data Privacy Act:

4.1 Contract Performance (RA 10173, Sec. 12)

  • To create and manage your account
  • To facilitate creator-brand collaboration requests
  • To process payments and payouts
  • To enforce our Terms of Use
  • To provide customer support

4.2 Legitimate Interest (RA 10173, Sec. 13)

  • To improve Platform functionality and user experience
  • To detect and prevent fraud, security threats, and illegal activity
  • To conduct analytics and research
  • To send service updates and administrative notices

4.3 Consent (RA 10173, Sec. 11)

  • To send marketing communications (you may opt out anytime)
  • To share your creator profile with brands (for Creators)
  • To display your brand profile publicly (for Brands)

4.4 Legal Obligation (RA 10173, Sec. 14)

  • To comply with BIR tax reporting requirements
  • To respond to lawful requests from government authorities
  • To comply with court orders and legal processes
  • To meet NPC, SEC, DTI, and other regulatory requirements

5. Data Sharing and Disclosure

We share your personal information only as described below:

5.1 Within the Platform

  • Creators: Your public profile (name, photo, portfolio, social media handles, rates) is visible to Brands when they search for creators.
  • Brands: Your company name and general information may be visible to Creators when you send collaboration requests.

5.2 Third-Party Service Providers

We share personal information with trusted service providers who assist us in operating the Platform:

  • Payment processors (e.g., Paymongo, Maya, GCash) — for payment processing
  • Cloud hosting providers (e.g., Supabase, AWS) — for data storage
  • Email service providers (e.g., Resend, SendGrid) — for transactional emails
  • Analytics providers (e.g., Google Analytics) — for usage analytics
  • Identity verification services — for KYC and fraud prevention

All service providers are contractually required to protect your data and use it only for the purposes we specify.

5.3 Legal Requirements

We may disclose personal information when required by law:

  • In response to court orders, subpoenas, or lawful government requests
  • To comply with BIR, SEC, NPC, DTI, or other regulatory requirements
  • To enforce our Terms of Use or protect our legal rights
  • To prevent fraud, security threats, or harm to users

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. You will be notified via email and Platform notice before any such transfer.

5.5 With Your Consent

We may share your information with third parties when you explicitly consent (e.g., sharing your creator profile with a specific brand for a collaboration opportunity).

6. Cross-border Data Transfer

As Likha expands to Southeast Asia, your personal information may be transferred to and processed in countries outside the Philippines, including:

  • Singapore
  • Malaysia
  • Indonesia
  • Thailand

We ensure that cross-border data transfers comply with NPC Circular No. 16-03 and other applicable regulations. We implement appropriate safeguards, including:

  • Data Processing Agreements with Standard Contractual Clauses
  • Adequacy determinations (where applicable)
  • Encryption and security measures during transfer

By using the Platform, you consent to the transfer of your personal information to these countries for the purposes described in this Privacy Policy.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

Retention Periods:

  • Active accounts: Data retained while your account is active
  • Closed accounts: Personal information deleted within 90 days of account closure, except where retention is required for legal, tax, or regulatory purposes
  • Transaction records: Retained for 5 years (BIR requirement for tax records)
  • Government-issued IDs: Deleted after identity verification is complete
  • Logs and analytics: Retained for 12 months

You may request deletion of your personal information at any time by contacting us (see Section 11).

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience on the Platform.

Types of Cookies We Use:

  • Essential cookies: Required for Platform functionality (cannot be disabled)
  • Performance cookies: Track usage and improve performance
  • Functional cookies: Remember your preferences and settings
  • Analytics cookies: Measure traffic and user behavior (e.g., Google Analytics)

You can control cookies through your browser settings. Note that disabling essential cookies may prevent you from accessing certain Platform features.

For more information on how we use cookies, please refer to our Cookie Policy [link to be added].

9. Data Security

We implement industry-standard security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction:

  • Encryption: Data in transit is encrypted using TLS/SSL protocols; sensitive data at rest is encrypted
  • Access controls: Role-based access restrictions for internal personnel
  • Regular security audits: Periodic vulnerability assessments and penetration testing
  • Incident response plan: Procedures for detecting, responding to, and reporting data breaches

In the event of a personal data breach that may harm your rights and freedoms, we will notify you and the NPC within 72 hours of becoming aware of the breach, as required by NPC Circular No. 16-03.

10. Third-Party Links

The Platform may contain links to third-party websites, services, or social media platforms. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

11. Your Data Privacy Rights

Under the Data Privacy Act (RA 10173), you have the following rights:

11.1 Right to Be Informed

You have the right to know how your personal information is collected, used, and shared.

11.2 Right to Access

You may request a copy of the personal information we hold about you.

11.3 Right to Object

You may object to the processing of your personal information for direct marketing or other purposes.

11.4 Right to Erasure or Blocking

You may request deletion or blocking of your personal information when:

  • It is no longer necessary for the purpose it was collected
  • You withdraw consent (where processing is based on consent)
  • Processing is unlawful

11.5 Right to Rectification

You may request correction of inaccurate or incomplete personal information.

11.6 Right to Data Portability

You may request a copy of your personal information in a structured, commonly used, and machine-readable format.

11.7 Right to Lodge a Complaint

If you believe we have violated your data privacy rights, you may file a complaint with the National Privacy Commission (NPC) at:

  • Website: https://www.privacy.gov.ph
  • Email: info@privacy.gov.ph
  • Hotline: (+63 2) 8234-2228

To Exercise Your Rights:
Email us at [legal@joinlikha.com] with the subject line “Data Privacy Request.” We will respond to your request within 15 days.

12. Children’s Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected personal information from a person under 18, we will delete such information immediately.

If you are a parent or guardian and believe your child has provided personal information to us, please contact us at [legal@joinlikha.com].

13. Changes To This Privacy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. When we make material changes, we will:

  • Update the “Last Updated” date at the top of this policy
  • Notify you via email or Platform notice at least 30 days before the changes take effect
  • Obtain your consent for changes that expand how we use your personal information

Your continued use of the Platform after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Oscar Oganiza (Sole Administrator)
Operating as: Likha
Entity Registration: Crealabs (SEC registration in process)
Email: [support@joinlikha.com]
Phone: [To be provided]
Address: [To be provided upon SEC registration]

Data Protection Officer (DPO):
Oscar Oganiza (Interim)
Email: [support@joinlikha.com]

Note: Upon completion of SEC registration and formal entity incorporation, the legal entity Crealabs will assume all rights and obligations under this Privacy Policy, and contact details will be updated accordingly.

15. Governing Law

This Privacy Policy is governed by the laws of the Republic of the Philippines, including:

  • Republic Act No. 10173 (Data Privacy Act of 2012)
  • Republic Act No. 8792 (E-Commerce Act of 2000)
  • Relevant NPC Circulars and Advisories

Any disputes arising from this Privacy Policy shall be resolved in accordance with Philippine law and subject to the exclusive jurisdiction of the courts of [City], Philippines.

By using Likha, you acknowledge that you have read, understood, and agree to this Privacy Policy.

Last Updated: April 21, 2026
Version: 1.0