Back to Home
On This Page
  • Who we are
  • Scope of this policy
  • Information we collect and why
  • Third-party services
  • Cookies and Tracking Technologies
  • How long we keep your data
  • Your rights
  • Security
  • Changes to this policy

Privacy Policy

Last updated: April 2026  ·  Applies to sampaiostudio.com and all associated tools and services

1. Who We Are

Sampaio Studio ("we", "us", "our") is a systems design and consultancy practice based in Portugal, European Union. This Privacy Policy explains how we collect, use, and protect personal data across all services and tools operated through sampaiostudio.com.

Data Controller: Sampaio Studio
Website: sampaiostudio.com
Contact for data matters: privacy@sampaiostudio.com
Location: Portugal, European Union
Supervisory Authority: CNPD — Comissão Nacional de Proteção de Dados (cnpd.pt)

2. Scope of This Policy

This policy covers all personal data processed in connection with:

  • Studio — the consultancy and systems design practice, including all enquiries, client communications, and project engagements.
  • Releases — independently developed tools made available through sampaiostudio.com.

It applies to all individuals whose personal data we process, including website visitors, enquiry senders, service clients, and users of any Releases tool.

3. Information We Collect and Why

3.1 Website visitors

When you visit sampaiostudio.com, we automatically collect certain technical information, including your IP address, browser type and version, pages visited, time spent on pages, and referring URLs. This data is collected via analytics tools under a legitimate interest basis to understand how the site is used and to improve it. No personally identifiable information is collected from visitors who do not submit a form or make a request.

3.2 Enquiry and contact forms

When you contact us via a form on the site, we collect your name, email address, and the contents of your message. This data is used solely to respond to your enquiry. The legal basis is your consent (by submitting the form), or the pursuit of a pre-contractual relationship where your enquiry relates to services.

3.3 Studio service engagements

When you engage Sampaio Studio as a client, we collect and process the personal data necessary to deliver the agreed services. This may include your name, contact details, professional context, and any information you share during the course of the engagement. The legal basis for this processing is performance of a contract.

3.4 Releases — tool submissions

When you submit a request through any tool in the Releases section, we collect your name, email address, and any additional information you provide through the intake form. This data is used to process your request, validate the submission, deliver the output by email, and communicate with you about its status. The legal basis is performance of a contract, or pre-contractual steps taken at your request.

We do not use any submitted data for any purpose other than fulfilling your request. We do not sell, share, or otherwise exploit this data.

4. Third-Party Services

We use trusted third-party services to operate this site and its tools. These service providers act as data processors on our behalf, bound by their own privacy terms and, where required, data processing agreements. We do not sell your data to any third party.

Where these services involve the transfer of personal data outside the European Economic Area, we rely on the European Commission's adequacy decisions or Standard Contractual Clauses as the applicable transfer mechanism.

5. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to support site functionality and gather analytics data.

Essential cookies

Required for the website to function correctly. These cannot be disabled and do not require consent.

Analytics cookies

We use analytics tools to understand how visitors interact with our site — pages visited, session duration, and traffic sources. This data is aggregated and used solely to improve the site. IP anonymisation is enabled where available.

We do not use marketing or advertising cookies. No third-party advertisers place cookies through this site.

You can manage or disable cookies at any time through your browser settings. Note that disabling certain cookies may affect site functionality.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. In some cases, we may be required to retain data for longer periods to comply with legal or accounting obligations. When data is no longer needed, it is securely deleted or anonymised.

  • Enquiry data: Retained for 6 months from the date of last contact, unless a client relationship begins.
  • Client engagement data: Retained for the duration of the engagement and for 3 years thereafter for legal and business record-keeping purposes.
  • Releases submission data: Retained for 3 months from the date of delivery. Delivered outputs may expire sooner, as noted at the time of delivery.
  • Analytics data: Subject to the retention settings of the analytics provider in use (typically up to 14 months).

7. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

  • Access — request a copy of the data we hold about you
  • Rectification — ask us to correct inaccurate or incomplete data
  • Erasure — request deletion of your data where there is no legitimate reason for us to continue holding it
  • Restriction — limit how we use your data in certain circumstances
  • Portability — receive your data in a structured, machine-readable format
  • Object — object to processing based on legitimate interests
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@sampaiostudio.com. We will respond within 30 days. You also have the right to lodge a complaint with the CNPD at cnpd.pt.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, disclosure, or misuse. These include encrypted data transmission, secure access-controlled platforms, and regular operational reviews. No method of transmission over the internet is completely secure; we cannot guarantee absolute security but are committed to addressing any incidents promptly and transparently.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the date at the top of this page. Continued use of our services after any update constitutes acceptance of the revised policy.

This document was last reviewed in April 2026. It is intended as a good-faith statement of our data practices. If you have questions or concerns, write to privacy@sampaiostudio.com.