1. Who we are
Firmitas is a web design and development studio. We are the controller of the personal data collected through this site.
For anything to do with privacy, including exercising your rights, write to geral@firmitas.pt. It is the same address for everything: there is no special form and no other channel.
2. The principle, in two lines
This site is static. It carries no advertising, no traffic analytics, no social buttons, and it sets no cookies of ours on your device. We only receive personal data when a visitor sends it: by filling in a form or by booking a call.
If you fill nothing in, nothing that identifies you stays with us.
3. What we collect, and when
Contact form. Name, email, phone and the message you write. Collected only at the moment you press send.
Job application form. Name, email, phone, city, the link to your CV and the motivation text you write. The CV file itself is not sent to us: we keep only the address it is hosted at, and whoever hosts it decides when it stops opening.
Call booking. We use Cal.com to schedule 15-minute calls. The calendar appears on two pages, the booking page and the home page, and on no others. On the home page it is closed until you press the button, but the browser may fetch it slightly before that so it opens without a wait; at that moment Cal.com receives your browser's request, and with it your IP address, even if you never book anything. When you confirm a booking, your name and email go to Cal.com.
Technical logs. The site is hosted and served by Cloudflare, which logs technical data for each request, including the IP address, in order to deliver the pages and protect the site.
Language preference. When you pick Portuguese or English in the language control, we store that choice in one localStorage key on your own device, so the site opens in the right language next time. That key never leaves your browser, never reaches us, identifies nobody and is used for nothing else. Because it is a preference you asked for and is strictly necessary to give you what you asked for, we do not show you a consent request for it (Article 5(3) of Directive 2002/58/EC, ePrivacy). You can delete it at any time by clearing this site's data in your browser.
4. What we use the data for, and on what legal basis
| Data | What it is for | Legal basis (GDPR) |
|---|---|---|
| Contact form | Replying to you and, where that is the case, preparing a quote or a project | Article 6(1)(b): steps taken at your request prior to entering into a contract, when you write about a project. Article 6(1)(f): our legitimate interest in replying to people who write to us, when the message has no contractual purpose |
| Job application | Reading and evaluating the application, and talking to you about it | Article 6(1)(a): your consent, given when you send the application. You may withdraw it at any time |
| Call booking | Scheduling, confirming and holding the call | Article 6(1)(b): pre-contractual steps at your request |
| Technical logs (Cloudflare) | Serving the pages, keeping the site available and protecting it from abuse | Article 6(1)(f): legitimate interest in security and operation |
We use none of this for marketing. We run no newsletter and no commercial mailing list, we do not sign you up to anything, and we neither sell nor pass your data to third parties for advertising. What you send us serves the matter that brought it, and nothing else.
5. Who else processes the data on our behalf
Four providers keep the site running. Each one handles only what its job requires.
- Web3Forms (provider based in the United States of America). Receives the content of both forms and delivers it to our mailbox. It is a delivery relay: what you write in a form passes through servers in the United States before it reaches us.
- Zoho Mail (data centre in the European Union). Hosts the geral@firmitas.pt mailbox, which is where your message or application is kept once delivered.
- Cal.com. Handles call bookings: it receives the name and email you give when booking, and sends the confirmations.
- Cloudflare. Hosts and serves the site's pages and handles the technical logs described above.
Transfer outside the European Economic Area. Because Web3Forms is a United States provider, the data you type into the forms is transferred outside the European Economic Area. If you want to know what safeguards apply to that transfer, ask us and we will tell you.
If you would rather your message did not pass through a United States provider, write to us directly at geral@firmitas.pt instead of using the form. It arrives in the same place.
6. How long we keep it
We keep each thing only as long as we need it to handle the matter that brought it. In concrete terms:
- Enquiries that do not lead to a project: for as long as the conversation is open. Once it is not, we delete the message from the mailbox.
- Enquiries that lead to a project: for the duration of the project and the relationship, and then for the legal retention period that applies to accounting and tax records.
- Job applications: 6 months from receipt. If you want them deleted sooner, just ask by email and we delete them. If you would rather we kept your application for future openings, just tell us.
- Call bookings: as long as it takes to hold the call and follow it up.
- Technical logs: these sit with Cloudflare and are kept for the periods that provider defines. We keep no server logs of our own and no visitor database.
If a legal obligation requires us to keep a particular document for longer, we keep it for that purpose alone and do not reuse it for anything else.
7. Your rights
The General Data Protection Regulation gives you these rights over your personal data:
- Access: find out what data of yours we hold and get a copy.
- Rectification: correct data that is wrong or incomplete.
- Erasure: ask us to delete your data.
- Restriction: ask us to pause the use of the data while a question is settled.
- Portability: receive the data you gave us in a format you can reuse.
- Objection: object to processing we carry out on the basis of legitimate interest.
- Withdrawal of consent: for job applications, you may withdraw it at any time, without affecting what was done on that basis beforehand.
How to exercise them: write to geral@firmitas.pt and say what you want. No set wording is needed and you do not have to justify the request. We answer within one month, as Article 12 GDPR requires, and we tell you what we did. If there is genuine doubt about who is asking, we may ask for one further element to confirm identity, purely so that we do not hand one person's data to somebody else.
Complaints: if you believe we have handled your data badly, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt. We would appreciate hearing from you first, so we can try to put it right.
8. Automated decision-making and profiling
There is none. No message, application or booking is evaluated, scored or filtered by an automated system that produces effects concerning you. Everything you send us is read by a person.
We also build no visitor profiles: we do not track your path through the site, or across sites, and we do not combine your data with other sources.
9. Security
The site is static and always served over an encrypted connection (HTTPS). There is no visitor database on this site, because there is nothing to put in one. Messages and applications sit in the studio mailbox, with access limited to whoever is working on them.
10. Changes to this policy
If the way the site handles data changes, for example if we add or swap a provider, we update this page and the date at the top. The version in force is always the one published here.