Privacy Policy

1. Who is responsible for the processing

The controller of your personal data is:

For any question about personal data, including exercising your rights, write to the email above.

2. What data we collect, why and on what legal basis

We process four sets of data. Each purpose has a single legal basis (Article 6 GDPR).

2.1 Contact form

• Data: name, email, WhatsApp number and the type of service you want (required) and a message (optional).
• Purpose: to reply to your contact or quote request.
• Legal basis: steps taken at your request before entering into a contract — Article 6(1)(b).

2.2 Contact by email or WhatsApp

• Data: your email address or phone number, your profile name and the content of the messages you send us, when you choose these channels instead of the form.
• Purpose: to reply to your request and follow the conversation.
• Legal basis: steps taken at your request before entering into a contract — Article 6(1)(b).

2.3 Server access logs

• Data: IP address, browser identification (user agent), date and time of the request and the address (URL) requested. They are created automatically whenever a page is opened.
• Purpose: site security, detecting abuse and diagnosing errors.
• Legal basis: Bee Lab Studio’s legitimate interest in keeping the site secure and working — Article 6(1)(f).

2.4 Loading fonts and icons

• Data: when you open a page, your browser requests the typeface from Google Fonts (fonts.googleapis.com and fonts.gstatic.com) and the icons from Cloudflare (cdnjs.cloudflare.com). These requests expose your IP address to those companies, which receive it directly from your browser.
• Purpose: to display the site correctly.
• Legal basis: legitimate interest — Article 6(1)(f).

We do not collect special categories of data (such as health data) and we do not ask you to share them with us.

3. How long we keep the data

• Server access logs: 30 days, after which they are deleted.
• Contact and quote requests (form, email, WhatsApp) that do not lead to a contract: 24 months after the last communication.
• If you become a client: the data needed for invoicing and accounting is kept for 10 years, the period required by Portuguese tax and commercial law; the rest until the end of the contractual relationship and for 24 months afterwards.

4. Who else receives your data

We use the providers below. We do not sell your data or hand it over for advertising.

• Hetzner Online GmbH (Germany, European Union) — hosts the site and stores the server access logs.
• Google — (a) Google Fonts (Google Ireland Limited, with Google LLC in the US): supplies the typeface and receives your IP when the page loads; (b) Google Workspace: Bee Lab Studio’s email service, so Google processes the content of the messages you send to [email protected].
• Cloudflare, Inc. (US) — supplies the site’s icons (Font Awesome) through cdnjs and receives your IP when the page loads. Cloudflare does not proxy the site’s traffic: we use it only for domain name registration (DNS), with no access to what visitors view.
• Meta Platforms (Meta Platforms Ireland Limited, with Meta Platforms, Inc. in the US) — only if you click the links to WhatsApp or Instagram. From that click you are on Meta’s service, subject to Meta’s privacy policy; we load no Meta resource while you browse this site.

5. Transfers outside the European Union

Google, Cloudflare and Meta operate in the United States. These transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, which these companies have joined, and, where applicable, on standard contractual clauses. The site’s hosting (Hetzner) remains in the European Union.

6. Cookies and tracking

This site does not use analytics, advertising or tracking cookies and does not build visitor profiles. The only cookie it may store is bls_lang, a functional cookie created only if you manually choose a language in the site menu: it remembers that choice for 1 year, contains no personal data, does not identify the visitor and is not shared with third parties. To show you the site in your language, the server reads the language your browser sends with each request, without storing it.

If we start using analytics or other tools that use non-essential cookies or identifiers, we will ask for your consent before any collection and update this policy.

7. Your rights

Under the GDPR (Articles 15 to 22), you have the right to:

• Access: know whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Restriction: ask us to pause the processing in certain cases.
• Objection: object to processing based on legitimate interest.
• Portability: receive the data you gave us in a structured, commonly used format.

To exercise any of these rights, send an email to [email protected] with the subject “Personal data”, saying what you want. We reply within one month at most. For your security, we may ask you to confirm your identity.

Where processing is based on your consent, you can withdraw it at any time, without affecting the lawfulness of the earlier processing.

8. Complaints to the CNPD

If you believe the processing of your data breaches the law, you can lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt.

9. Automated decisions and minors

We do not take decisions based solely on automated processing that affect you and we do not carry out profiling.

The site is not aimed at children under 16 and we do not knowingly collect data from minors of that age.

10. Changes to this policy

We may update this policy, for example when the site starts using new tools. The date and version at the top of the page always show the current revision.