Privacy Policy

Who this policy covers

This policy explains how arcdesignlabs collects, uses and protects your personal data when you visit this website, buy a package, or contact us. arcdesignlabs is based at Rua da Bainharia 148, Porto, Portugal, and operates as arcdesignlabs.

For any question about this policy or your data, contact us at support@arcdesignlabs.com or by post at the address above.

What personal data we collect

We collect only what we need to run this site and deliver what you've bought:

• Contact details — name, email address, and phone number, if you provide it, when you submit the enquiry form or check out.
• Billing details — billing address, company name (if applicable), and EU VAT number (if applicable), collected at checkout.
• Project details — whatever you tell us about your project in the enquiry form or the checkout's project step.
• Order details — the packages and add-ons you buy, order reference, and order date.
• Usage data, only after you consent — pages visited and how you use the site, collected through Google Analytics 4, and only once you accept analytics cookies through the consent banner. See our Cookie Policy for full detail.

We do not collect payment card data. The checkout on this site currently uses a demo payment step that does not transmit or store card details — see the Payment step notice at checkout for what that means in practice.

Why we collect it (legal basis)

• To deliver a project you've bought or enquired about — processing necessary to perform a contract, or to take steps at your request before entering one (Art. 6(1)(b) GDPR).
• To reply to an enquiry — our legitimate interest in responding to people who contact us (Art. 6(1)(f) GDPR).
• To meet our invoicing and tax obligations — a legal obligation under Portuguese and EU tax law (Art. 6(1)(c) GDPR).
• To run analytics — only with your consent (Art. 6(1)(a) GDPR), given or withheld through the cookie consent banner, and withdrawable at any time from the footer's "Cookie settings" link.

Who we share data with

We do not sell personal data, and we do not share it with third parties for their own marketing purposes. Data may be shared with:

• Google, as the provider of Google Analytics 4, but only after you consent to analytics cookies, and only in the form Google's own service requires to function.
• Service providers who help us run the site or deliver a project (for example, hosting or email delivery), acting only on our instructions and only for that purpose.
• Authorities, where we're legally required to disclose data (for example, tax authorities).

The site's cart, checkout and enquiry form are currently connected to no third-party lead or order destination — submissions are processed locally in your browser and are not transmitted to an external inbox, CRM or database at this time. This is stated plainly, not as a technical footnote, because it's a real limitation of the current build: no data you submit through these forms leaves your device until the studio connects a live destination.

International transfers

Google Analytics 4 may process data outside the EU/EEA, under Google's own standard contractual clauses and applicable adequacy mechanisms. No other processor used by this site transfers personal data outside the EU/EEA.

How long we keep data

• Enquiry and order data: for as long as needed to deliver the project, plus the period required by Portuguese tax and accounting law for invoicing records.
• Analytics data: per Google Analytics 4's own retention settings, only collected after consent.
• We delete or anonymise data once it's no longer needed for the purpose it was collected for, unless a legal obligation requires us to keep it longer.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data, where there's no legal reason for us to keep it
• Restrict or object to processing
• Data portability, for data you've provided to us
• Withdraw consent at any time, for anything processed on the basis of consent (this doesn't affect processing carried out before withdrawal)

To exercise any of these rights, email support@arcdesignlabs.com. We'll respond within one month, as required by the GDPR.

If you believe your data has been mishandled, you can lodge a complaint with CNPD — Comissão Nacional de Proteção de Dados, Portugal's data protection supervisory authority (www.cnpd.pt), or with the supervisory authority in your own EU country of residence.

Children

This site is not directed at children, and we do not knowingly collect personal data from anyone under 16.

Changes to this policy

If this policy changes, we'll update the "last updated" date above. Material changes will be reflected clearly on this page.