Legal

Privacy Policy

What personal data this site collects, why, who it is shared with, how long it is kept and what rights you have over it.

Last updated:

Before you read

This text is a good-faith description of how this website actually works, checked against the code that runs it. It is not legal advice. Before it is treated as final it should be reviewed by a lawyer or a data protection specialist, and every point marked TODO-VERIFY has to be confirmed and filled in.

1. Who handles your data

The controller of the data collected on this site is DNAcrílicos, an acrylics workshop in Portugal.

  • Address: Rua Padre Ângelo Firmino da Silva 12A
  • Postal code and locality: 2800-017 Almada
  • Tax number (NIF): 206418647
  • Email: dnacrilicos2020@gmail.com
  • Phone: +351 916 954 090

2. What we collect, and when

This site has no user accounts, sells nothing online and takes no payments. We only collect personal data when you send it to us yourself, through the quote request form on the Bespoke project page.

Required fields: name, email, phone and project description.

Optional fields: approximate dimensions, desired deadline, approximate budget and a link to reference images or files (Google Drive, Dropbox or WeTransfer, for example).

You also have to tick the box authorising us to contact you. Without it the server refuses the submission and nothing is stored, so any recorded request is necessarily one where the box was ticked. The date and time of the record are stored with the request.

The project description is a free text field: you write whatever you want in it. Please avoid including anything that is not needed to quote the piece, such as health data, document numbers or other people's details.

When the form is submitted, the server reads the IP address of the request to apply a per-minute submission limit and block automated submissions. That address is used only at that moment, in memory, and is not written to the database. The technical logs of the services hosting the site may still contain the IP address and the date of the request.

3. If you contact us through another channel

Besides the form, the site lists a phone number, an email address and a WhatsApp button. If you use one of those, whatever you tell us in the conversation stays in that service: the workshop mailbox, the call log or the WhatsApp thread.

WhatsApp is a Meta service and follows Meta's own privacy rules, which we do not control. If you would rather not use WhatsApp, contact us by email or by phone.

4. What we use the data for, and on what basis

We use the data from a quote request for the following, and only for this:

  • Reviewing the request and replying with a proposal or with questions. Basis: pre-contractual steps taken at your request, Article 6(1)(b) GDPR, alongside the contact authorisation you tick on the form.
  • Contacting you by email, phone or WhatsApp about that request. Same basis.
  • Keeping the request in the workshop's internal system to track it, produce the piece and keep the customer history. Basis: performance of the contract once a proposal is accepted, and our legitimate interest in managing the requests we receive, Article 6(1)(b) and (f).
  • Protecting the form against automated submissions and abuse. Basis: legitimate interest, Article 6(1)(f).
  • Meeting legal obligations, in particular tax ones, when a request leads to an invoice. Basis: Article 6(1)(c).

5. What we do NOT use the data for

We send no newsletters and no advertising. We do not sell, rent or pass your data to third parties for marketing.

This site has no audience analytics and no advertising cookies: no Google Analytics, no social network pixels, no browsing tracking. We build no profiles and there is no automated decision-making affecting you.

6. What happens when you submit the form

The form is submitted to an address on this same site. It does not go through any external form service. From there, three things happen:

  • The data is validated on the server. If a required field is missing, or the authorisation box is not ticked, nothing is stored and nothing is sent.
  • The request is written to the workshop's database as a new request, with the name, email, phone, project description, dimensions and approximate budget you gave. The desired deadline and the reference link are kept in the request notes.
  • Two emails go out: a notification to the workshop mailbox, carrying the request and with your address set as the reply-to, and an automatic confirmation to the email you gave.

7. Who has access, and who it is passed to

Inside DNAcrílicos, the request is visible to whoever works at the workshop and has access to the internal system.

Outside DNAcrílicos, the data passes through the technical providers the site needs in order to work, which handle it on our behalf and on our instructions (processors):

  • Vercel: hosts the site and the endpoint that receives the form. It processes the request and keeps technical logs.
  • Supabase: the database where the request is stored.
  • Resend: sends the two emails, the notification and the confirmation.
  • Google: the workshop mailbox is a Google email account, so the notification carrying your request is stored there. The map on the Contact page is also loaded from Google, as explained in the Cookie Policy.

8. Transfers outside the European Union

TODO-VERIFY: the server location of each provider listed above, and the safeguards applying to any transfer of data outside the European Economic Area, have not yet been confirmed with each provider. This has to be closed before this policy is treated as final.

We may also disclose data to a public authority where the law requires it.

9. How long we keep it

Quote requests stay in the workshop's database and in the mailboxes for as long as they are needed to reply, produce the piece and keep the customer history.

TODO-VERIFY: no automatic deletion period has been set, and today nothing deletes old requests on its own. Deletion is done by hand, on request. Setting that period, and writing it down here, is one of the open points.

Where a request leads to an invoice, the data on that invoice is kept for the period required by Portuguese tax law, regardless of any deletion request.

10. Your rights

Over the data you sent us, you have the right to:

  • Access the data and obtain a copy.
  • Correct data that is wrong or incomplete.
  • Ask for the data to be deleted, where no legal obligation requires us to keep it.
  • Ask for processing to be restricted.
  • Object to processing that rests on our legitimate interest.
  • Receive the data you gave us in a commonly used format, or ask for it to be sent to another organisation.
  • Withdraw the contact authorisation at any time, without affecting the lawfulness of what was done before.

11. How to exercise those rights, and where to complain

Write to dnacrilicos2020@gmail.com, or call +351 916 954 090, saying what you want. We reply within one month at most. We may need to confirm your identity first, so that data is not handed to the wrong person.

If you believe your data is not being handled properly, you can complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

12. Security

The measures in place on this site are the following:

  • The site is served over an encrypted connection only (HTTPS).
  • The form is validated on the server, has a per-minute submission limit and an invisible trap field that blocks bots.
  • The database is not reachable from the browser: only the site's server talks to it, with a key that never leaves the server.
  • The workshop's private area is separate from the public site and requires a login.

13. Children

This site is not aimed at children and does not knowingly collect children's data. A quote request should be made by an adult.

14. Changes to this policy

If the way the site works changes, this page is updated and the last-updated date shown at the top changes with it.

WhatsApp