Privacy Policy

Who we are

Sparza Studio (“Sparza”, “we”, “us”) is an independent design studio based at Rua da Boavista 84, Lisbon, Portugal, registered in Portugal under company number COMPANY NUMBER. We are the data controller for the personal data described in this policy.

For any question about this policy or about how we handle your data, write to hello@sparza.co.

What this policy covers

This policy explains what personal data we collect through this website, why we collect it, how long we keep it, and what rights you have. It covers this website only. Work carried out for clients is governed by the separate agreement signed for that engagement, which takes precedence where the two differ.

What we collect

We keep data collection to the minimum needed to reply to you and to keep the site working.

• Enquiry details. When you submit the contact form we receive the name, email address, and message you provide. Supplying these is voluntary, but without them we cannot respond.
• Email correspondence. If you email us directly, we hold that correspondence and any details it contains.
• Server logs. Our hosting provider records standard technical data — IP address, browser type, requested page, and timestamp — as part of serving and securing the site.
• Analytics. ANALYTICS PROVIDER, OR 'NONE' Complete this section to name the analytics provider in use, what it measures, and whether it sets cookies. If no analytics are running, say so plainly instead.

What we do not collect

We do not collect special category data, we do not knowingly collect data from children, we do not buy contact lists, and we do not sell or rent personal data to anyone.

Why we use it, and our legal basis

Under the UK and EU General Data Protection Regulation we rely on the following bases:

• Legitimate interests — responding to enquiries, keeping records of our business conversations, and protecting the site from abuse.
• Consent — where you opt in to something specific, such as a mailing list. You can withdraw consent at any time.
• Legal obligation — retaining records we are required by law to keep, such as those relating to invoicing and tax.

How long we keep it

Enquiries that do not become projects are deleted within RETENTION PERIOD of our last exchange. Records relating to client engagements are kept for the period required by Portuguese accounting and tax law. Server logs are retained according to our host’s standard retention period.

We review what we hold periodically and delete what we no longer need.

Who else sees it

We share personal data only with service providers who process it on our behalf, under contract, and only as needed to run the studio:

• Our website host, HOSTING PROVIDER, which stores server logs.
• Our email provider, EMAIL PROVIDER, which delivers and stores correspondence.
• Professional advisers, such as our accountant, where required.
• Public authorities, where we are legally obliged to disclose.

Where a provider processes data outside the European Economic Area, we rely on an approved transfer mechanism such as Standard Contractual Clauses.

Cookies

COOKIE POSITION Confirm the cookie position before launch. If the site sets only strictly necessary cookies, state that and note that no banner is required. If any analytics, embedded media, or marketing cookies are added, a compliant consent mechanism must be in place before they load, and this section must list each cookie, its purpose, and its lifetime.

Your rights

Wherever the GDPR applies to you, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased where there is no overriding reason for us to keep it;
• restrict or object to our processing, including any direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, where consent is the basis we relied on.

To exercise any of these, email hello@sparza.co. We respond within one month. If you are unhappy with our response you may complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the supervisory authority in your own country.

Security

The site is served over HTTPS and access to enquiry data is limited to the people in the studio who need it. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the small volume of data we hold, and we will notify you and the relevant authority of a breach where the law requires it.

Changes to this policy

If we change how we handle personal data we will update this page and the date shown at the top. Material changes will be flagged clearly rather than made quietly.