This policy explains what personal data we process when you visit the website, ask us for a review, work with us or receive an email from us: why, on what legal basis, for how long and how to exercise your rights. The Portuguese version prevails in case of doubt.
1. Who is the controller
The controller is André Silva, a sole trader (empresário em nome individual), tax number (NIF) 243172869, trading as Himura Creative Studio in Lisbon, Portugal.
For any privacy matter: andre@himuracreativestudio.pt, with "Privacy" in the subject line, or +351 918 522 032. No data protection officer has been appointed, as one is not required for a business of this size: the controller answers directly.
2. In short
- We do not sell data or use it for advertising.
- The website has no advertising, social media pixels or third-party tracking tools.
- Measurement in your browser only happens if you allow it in the cookie notice, and you can change your mind at any time.
- We only ask for what we need to answer your request.
3. What data we process and where it comes from
- Review requests and enquiries: name, business name, email or mobile number, the website or profile you mention, an optional message, the service you chose and the page you sent the request from. It comes from you: through the form, the quick request window, email, phone or WhatsApp.
- Request origin: the page through which you entered the site, the site you came from and the campaign named in the address (for example, utm_source).
- Website visits: pages viewed, date and time, referring page, browser, operating system, device type, language, approximate country and city, and IP address.
- Browser measurement, only with your permission: clicks on contact buttons, form start and submission, scroll depth and page load times (Web Vitals). It never includes what you type in the fields.
- Cookie choice: the option you chose in the cookie notice, the date and a random identifier, so that we can demonstrate consent.
- Clients: the contract, billing and communication data needed to provide the service.
- Reviews: the text and the author name of public reviews left on the Himura Creative Studio profile on Google, when we show them on the website.
- Emails exchanged: the messages you send us and the ones we send you. Messages sent by the studio may include a small measurement image and tracked links, which record opens and clicks, so we know whether a proposal arrived and whom to answer first.
- Business contacts: to introduce our services, we may use professional contact details published by businesses themselves, for example on their website or public business profile.
- Demonstrations: test bookings, appointments and sign-ups stay in your browser and are not sent to us (section 9).
- Security: IP address, browser, requested page and logs of abuse attempts, blocks and access to the restricted area.
We do not ask for special categories of data, such as health data; please do not include them in your messages. Our services are aimed at businesses and professionals, and we do not knowingly collect data from children under 16.
To choose the language, the website reads your device time zone in the browser. That information is used on the spot and is neither sent nor stored.
4. Why we use data and on what legal basis
| Purpose | GDPR legal basis |
|---|---|
| Answering your request and preparing proposals | Steps taken at your request before a contract (Article 6(1)(b)) |
| Providing the contracted service and communicating with you | Performance of the contract (Article 6(1)(b)) |
| Billing and tax obligations | Legal obligation (Article 6(1)(c)) |
| Counting website visits, on the server and without cookies | Legitimate interest in keeping the website useful and easy to understand (Article 6(1)(f)) |
| Browser measurement: clicks, forms and performance | Consent given in the cookie notice (Article 6(1)(a)) |
| Recording your cookie choice | Legal obligation to demonstrate consent (Article 6(1)(c) and Article 7(1)) |
| Protecting the website and preventing abuse and fraud | Legitimate interest (Article 6(1)(f)) |
| Introducing our services to businesses and following up on proposals sent | Legitimate interest (Article 6(1)(f)), with the right to object at any time |
| Showing public client reviews on the website | Legitimate interest in showing the opinion of people who have worked with us (Article 6(1)(f)), with the right to object at any time |
Where the legal basis is legitimate interest, we have assessed that the processing is necessary, proportionate and expected by the people who visit or contact us. You may object at any time (section 8).
5. Who has access to the data
Data is processed by the controller and stored with providers acting on his behalf (processors), bound by confidentiality and security obligations:
- Hosting: the website, database and email are hosted with a web hosting provider contracted for this purpose.
- Approximate location: to estimate the country and city of a visit, the IP address may be looked up with the ip-api.com service; the result is stored so the lookup is not repeated.
- Payments: purchases in the template shop, when available, are paid through Stripe, which processes the payment data. We never see card details.
- WhatsApp: if you contact us through WhatsApp, the conversation is also processed by WhatsApp, under its own privacy policy.
We do not sell data or share it for advertising. We may disclose it to the authorities where the law requires it, and to accounting services when needed to meet tax obligations.
6. Transfers outside the European Economic Area
When a provider processes data outside the European Economic Area (for example, Stripe or WhatsApp, in the United States), the transfer relies on the mechanisms set out in the GDPR: adequacy decisions, including the EU-US Data Privacy Framework, or standard contractual clauses approved by the European Commission.
7. How long we keep data
| Data | Period |
|---|---|
| Requests that do not lead to a project | Up to 24 months after the last contact |
| Client, contract and billing data | The legal periods, generally 10 years |
| Website visits, including the IP address | 180 days, deleted automatically |
| Browser measurement | 180 days, deleted automatically |
| Record of your cookie choice | 24 months, deleted automatically |
| Security logs | 12 months, deleted automatically |
| Emails exchanged | For the duration of the relationship and up to 24 months after |
| Business contacts | Up to 24 months without a reply; if you object, we keep only what is needed not to contact you again |
| Old tests from the restaurant demonstrations (section 9) | 12 months, deleted automatically |
| Reviews shown on the website | While they remain published on Google, or until you ask us to remove them |
These periods may be extended when the data is needed to defend legal claims or to meet a legal obligation.
8. Your rights
At any time and free of charge, you may:
- access your data and receive a copy;
- correct inaccurate or incomplete data;
- ask for your data to be erased;
- ask for processing to be restricted;
- receive the data you gave us in a commonly used format (portability);
- object to processing based on legitimate interest, including visit counting and business contacts;
- withdraw the consent given in the cookie notice, using the Cookie settings button at the end of every page, without affecting what was done before.
To exercise these rights, write to andre@himuracreativestudio.pt. We reply without undue delay and within one month at the latest. If we need to confirm your identity, we only ask for what is strictly necessary.
If you believe your data has not been handled correctly, you may lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).
9. Demonstrations
The demonstration projects shown under Work feature fictional businesses. The bookings, appointments, sign-ups and other choices you make in a demonstration are simulated: they stay only in your browser, are not sent to our server and never reach a real business. You can delete them in your browser settings, and you do not need to enter real data.
In an earlier version of the website, bookings and newsletter sign-ups in the restaurant demonstrations (NAMI 38 and PÁTIO 1755) were sent to our server. Those tests are deleted automatically 12 months after they were made.
10. Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects. The order in which requests are answered may be supported by a simple internal score, which never decides on its own whether a request is answered.
11. Security
We use encrypted connections (HTTPS), two-factor authentication for the restricted area, rate limiting, our own firewall, backups and restricted access to data. No system is infallible: a data breach is assessed immediately and, where the law requires it, reported to the CNPD within 72 hours and to the people affected.
12. Cookies
What the website stores in your browser, and how to change your choice, is explained in the Cookie Policy.
13. Changes to this policy
This policy may be updated when features, providers or the law change. The date of the last update is at the top of the page, and important changes are flagged on the website.