Privacypolicy

1. Who we are

Only A Studio, Lda.
NIPC: 518959104
Registered office: Rua Farol 215, 2750-341 Cascais, Portugal
Email: contact@onlya.studio

Only A is the controller of personal data processed through this site, within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).

2. What we collect

Contact form. When you send a message through the form on /contact, we collect:

• Your email address
• The message content
• The topic you choose, if you choose one ("What brings you here?" is optional)

We use this information solely to respond to your enquiry. The form is processed through Formspree (a third-party form service); the submission is then delivered to our inbox.

Notes by email. If you subscribe to our notes, we collect your email address, also through Formspree, and use it only to send you new notes.

Information collected automatically. We do not use analytics, advertising or tracking tools on this site. As with any website, the servers that deliver it receive technical data with each request — such as your IP address and browser type — in order to serve the pages and keep the site secure (see section 5).

3. Legal basis for processing

We rely on the following legal bases under Article 6 of the GDPR:

• Legitimate interest (Art. 6(1)(f)) — for replying to enquiries you initiate via the contact form, and for delivering and securing the site. Our interest is to respond to prospective clients and partners and to keep the site available.
• Consent (Art. 6(1)(a)) — for sending you our notes by email, when you subscribe. You can withdraw it at any time.
• Contract (Art. 6(1)(b)) — where we proceed to work with you on a project, processing your contact details to perform the engagement.

4. Cookies

This site does not set cookies — no analytics, advertising or social-media cookies, and no cookies of our own.

While a page is open, your browser's session storage may keep a few display settings of the site itself. They contain no personal data, are not used for tracking, and are cleared when you close the tab.

5. Third-party services

We rely on a small number of third-party services to operate the site. Each of these acts as an independent processor or controller of any data they receive:

• Formspree (Formspree, Inc., United States) — processes contact form submissions and notes sign-ups. Privacy policy: formspree.io/legal/privacy-policy.
• Cloudflare (Cloudflare, Inc., United States) — hosts and delivers the site, and receives the technical request data described in section 2. Privacy policy: cloudflare.com/privacypolicy.
• Google Fonts — used on some case-study pages, to show a client's own typefaces. Loads fonts from Google's CDN, which receives a request including the visitor's IP address.
• jsDelivr — the Stanford University Press case study shows published journal articles that load their typesetting libraries from the jsDelivr CDN, which receives a request including the visitor's IP address.

Some of these providers are based outside the European Economic Area. Transfers of personal data outside the EEA are made under the EU–US Data Privacy Framework, Standard Contractual Clauses, or equivalent safeguards where applicable.

6. Data retention

• Contact form submissions — retained in our inbox while the conversation is active, and archived for up to 24 months for reference and accounting purposes, after which they are deleted.
• Notes subscriptions — your email address is kept while you remain subscribed; ask us at contact@onlya.studio and we remove it.

7. Your rights

Under the GDPR (Regulation (EU) 2016/679) and Portuguese Law no. 58/2019, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your personal data ("right to be forgotten")
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Portuguese data protection authority (CNPD): cnpd.pt

To exercise any of these rights, email contact@onlya.studio. We aim to respond within 30 days, in accordance with Article 12(3) of the GDPR.

8. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. We work with reputable processors and follow industry-standard practices for transmission and storage. No transmission over the internet is fully secure, so we cannot guarantee absolute security.

9. Children

This site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page. The current version always lives at onlya.studio/privacy.

11. Contact

For any questions about this Privacy Policy or our handling of your data:

Only A Studio, Lda.
Rua Farol 215, 2750-341 Cascais, Portugal
contact@onlya.studio