Privacy policy.

1. Who we are

Only A Studio, Lda.
NIPC: 518959104
Registered office: Rua Farol 215, 2750-341 Cascais, Portugal
Email: contact@onlya.studio

Only A is the controller of personal data processed through this site, within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).

2. What we collect

Information you give us. When you submit the contact form on /contact, we collect:

• Your name
• Your email address
• The message content

We use this information solely to respond to your enquiry. The form is processed through Formspree (a third-party form service); the submission is then delivered to our inbox.

Information collected automatically. We use Google Analytics 4 to understand how visitors use the site. Google Analytics may collect:

• IP address (truncated by Google before storage)
• Browser type, version and language
• Pages visited, time on page, referrer
• Approximate geographic location (country / city level)
• Device type and screen resolution

Google Analytics sets cookies in your browser to perform this measurement. See section 4 below.

3. Legal basis for processing

We rely on the following legal bases under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)) — for analytics cookies. You may decline these without affecting your ability to use the site.
• Legitimate interest (Art. 6(1)(f)) — for replying to enquiries you initiate via the contact form. Our interest is to respond to prospective clients and partners.
• Contract (Art. 6(1)(b)) — where we proceed to work with you on a project, processing your contact details to perform the engagement.

4. Cookies

This site uses the following cookies, all set by Google Analytics 4:

• _ga — distinguishes unique visitors. Retained for 2 years.
• _ga_<container-id> — persists session state for GA4. Retained for 2 years.

We do not set our own first-party tracking cookies, advertising cookies, or social-media cookies. We do not use session cookies for purposes other than the analytics described above.

You can disable analytics cookies through your browser settings or browser extensions (such as the Google Analytics Opt-out Browser Add-on). Where a cookie consent banner is presented on this site, you can decline analytics there.

5. Third-party services

We rely on a small number of third-party services to operate the site. Each of these acts as an independent processor or controller of any data they receive:

• Formspree (Formspree, Inc., United States) — processes contact form submissions. Privacy policy: formspree.io/legal/privacy-policy.
• Google Analytics (Google Ireland Limited; Google LLC, United States) — usage measurement. Privacy policy: policies.google.com/privacy.
• Google Fonts — used on the CJNE case-study page only. Loads fonts from Google's CDN, which receives a request including the visitor's IP address.
• LottieFiles / unpkg — used on the About page to render a single Lottie animation. The CDN receives the request including the visitor's IP address.

Some of these providers are based outside the European Economic Area. Transfers of personal data outside the EEA are made under the EU–US Data Privacy Framework, Standard Contractual Clauses, or equivalent safeguards where applicable.

6. Data retention

• Contact form submissions — retained in our inbox while the conversation is active, and archived for up to 24 months for reference and accounting purposes, after which they are deleted.
• Google Analytics data — retained for 14 months under our GA4 configuration, after which Google deletes user-level and event-level data automatically.

7. Your rights

Under the GDPR (Regulation (EU) 2016/679) and Portuguese Law no. 58/2019, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your personal data ("right to be forgotten")
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Portuguese data protection authority (CNPD): cnpd.pt

To exercise any of these rights, email contact@onlya.studio. We aim to respond within 30 days, in accordance with Article 12(3) of the GDPR.

8. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. We work with reputable processors and follow industry-standard practices for transmission and storage. No transmission over the internet is fully secure, so we cannot guarantee absolute security.

9. Children

This site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page. The current version always lives at onlya.studio/privacy.

11. Contact

For any questions about this Privacy Policy or our handling of your data:

Only A Studio, Lda.
Rua Farol 215, 2750-341 Cascais, Portugal
contact@onlya.studio