Privacy policy

1. Who handles the data

The controller of the personal data collected on this website is João Vieira, a sole trader with a place of business in the district of Setúbal, Portugal, working under the trade name JV Studio.

For any question about personal data, the address is geral@jvstudio.pt.

2. What is collected

The website has no accounts and no registration area. I build no profiles and make no automated decisions with the data collected. Analytics and advertising tools only load with consent, as set out in section 7.

The request form. Each request carries:

• the type of project chosen;
• the name;
• the email address;
• the language of the page and the address of the page the request is sent from, without any parameters that address may carry, such as those of campaigns or ads.

The name and the email are needed to reply: without them, the request cannot go ahead.

To stop automated submissions, the request also carries a computational challenge solved by the browser itself, a hidden field that only a robot fills in and the time that has passed since the page opened. None of this identifies the sender.

Submission goes through a function of the website itself, hosted by Vercel (below, “Hosting”). That function delivers the request by email, through Google Workspace, and sends an automatic confirmation to the address given. To prevent abuse, Vercel applies a request limit and, for that, processes the IP address of the sender and a code derived from the email address given, from which the address cannot be reconstructed. No other services and no cookies are involved along the way.

Emails. When someone writes directly by email, I process the data the email contains. JV Studio’s email is hosted on Google Workspace (Google Cloud EMEA Limited, Ireland), acting as a processor: direct emails, form requests and automatic confirmations arrive and are kept there. Google Cloud EMEA Limited may transfer this data to Google LLC, in the United States, under the EU-⁠U.S. Data Privacy Framework, in which Google LLC participates. Google Workspace’s privacy notice is at cloud.google.com.

Hosting. The website is hosted by Vercel (Vercel Inc., United States), acting as a processor. As with any hosting, each visit involves technical data, such as the IP address, the approximate location and the device configuration, used to deliver the pages and protect the service. Vercel participates in the EU-⁠U.S. Data Privacy Framework. Vercel’s privacy notice is at vercel.com.

3. What the data is for

Data from the form and from emails is used only to:

• reply to the request, including the automatic confirmation;
• prepare and send a proposal, where relevant;
• discuss the project that may follow;
• meet legal and tax obligations, if a contract follows.

Technical data from hosting and abuse protection is used only to deliver the website and keep it secure.

Data from the form and from emails is never sold, never used for advertising and never shared with third parties for marketing.

4. Legal basis

Processing follows the General Data Protection Regulation (GDPR), on these legal bases:

• Pre-⁠contractual steps: replying to a request made through the form or by email and preparing the proposal, at the request of the person writing. Article 6(1)(b).
• Performance of a contract: where processing is needed to provide a contracted service. Article 6(1)(b).
• Legal obligation: to meet tax and legal obligations. Article 6(1)(c).
• Consent: for the visit analytics and advertising measurement in section 7. Article 6(1)(a).
• Legitimate interest: to keep the website secure and protected against abuse. Article 6(1)(f).

5. For how long

Data is kept only as long as each purpose requires:

• requests and proposals: up to 24 months after the last message;
• contract and invoicing data: 10 years, as tax law requires;
• the cookie choice: 12 months in the browser, or until it is changed or cleared.

At the end of each period, the data is securely deleted.

6. Each person’s rights

The GDPR gives each person the right of:

• access: to know whether data concerning them is being processed and to access it;
• rectification: to correct inaccurate or incomplete data;
• erasure: to ask for the data to be deleted;
• restriction: to ask for the processing to be restricted;
• portability: to receive the data in a structured, commonly used and machine-⁠readable format;
• objection: to object to processing for certain purposes;
• withdrawing consent: at any time, without affecting the processing carried out before.

To exercise any of these rights, an email to geral@jvstudio.pt is enough.

There is also the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD), at www.cnpd.pt.

7. Cookies and local storage

Without consent, only the essentials load. On the first visit a notice appears and, until a choice is made, no third-⁠party tool is loaded.

There are three categories.

Essential. The choice is kept in the browser’s local storage, under the key “jv_consent”. It is not a cookie, it never goes to any server and it exists only so the question is not asked again. Without it, the website could not honour the choice made. After 12 months, or when the options change, the question comes back.

Analytics. With consent, I use Vercel Web Analytics to count visits and page views. It uses no cookies, does not link records to the IP address and does not follow anyone from website to website. For aggregated statistics, it records the page viewed and the filtered parameters of its address, the referring page, the approximate location, the browser, the operating system and the device type, and it tells visits apart with an identifier calculated from the request and deleted after 24 hours. It shows which pages are worth improving.

Advertising. With consent, the Google tag (Google Ads) loads, which shows whether a JV Studio ad led to a request. When a request is sent, the tag records that conversion, without the details written in the form. The tag uses the Google cookies listed below and involves sharing data with Google Ireland Limited, which may transfer it to Google LLC, in the United States. Google participates in the EU-⁠U.S. Data Privacy Framework and, for those transfers, applies the standard contractual clauses approved by the European Commission. Google’s privacy policy is at policies.google.com/privacy.

What may be kept in the browser:

Google’s cookies and local storage are only kept with advertising consent. Depending on the ad, the Google tag may keep others starting with “_gcl_” or “_gac_”, with the same purpose and duration. Vercel Web Analytics keeps nothing in the browser.

When advertising consent is withdrawn, the website deletes the Google cookies and local storage kept on jvstudio.pt. Those that Google keeps on its own domains can only be deleted in the browser settings or the Google account settings.

The choice can be changed at any time through the Cookies option in the footer. Declining changes nothing in how the website works.

The website is served as static files, and the typeface comes from its own domain, not from an outside service. There is no embedded content from social networks or other services. Without consent, nothing that identifies a visitor is kept in the browser.

8. Changes

This policy may change. Each version is published on this page, with the date of the last update.

9. Questions

Any question about personal data goes to:

JV Studio
João Vieira
geral@jvstudio.pt
Setúbal district, Portugal