- Responsible entity
- Marcos Oliveira (Studio 4:41)
1. Identity of the controller
Studio 4:41 is a brand dedicated to design, development of digital solutions, technology and strategy.
Controller: Marcos Oliveira
Brand: Studio 4:41
Website: https://441.studio
Email: info@441.studio
Location: Portugal
For any question about the protection of personal data, you can contact us at the email address above.
2. Personal data we collect
We only collect the personal data needed to provide our services, answer your requests and improve how the website is used. Depending on how you interact with us, we may process the following information:
- Name and email address.
- Company or organisation name, when provided.
- Type of project or service requested.
- Content of the messages sent through the forms.
- Communication and language preferences.
- Technical browsing data, when needed for security or for the website to work.
- Information related to your newsletter subscription.
We do not ask for special categories of personal data through our forms. We recommend that you do not include sensitive information in the messages you send.
3. Contact form
When you use the contact form, the data you provide is used to receive, review and answer your request. The information may include name, email, company, project type, message and the selected language. The form works through a secure sending system run from the website’s server. After you submit it:
- Studio 4:41 receives your message at contacto@441.studio.
- You receive an automatic confirmation email with a copy of the message you sent.
- The request is recorded in a Supabase database hosted in a European Union region, allowing the team to follow up and reply properly.
The records include the data submitted, the date of the request, the language and a non-reversible technical identifier derived from the IP address. Requests are kept for a planned period of up to 24 months, subject to confirmation, unless there is a legal basis for a different retention period or an applicable right to erasure is exercised.
To prevent abuse and automated submissions, the system may temporarily keep technical security data for a maximum of one hour.
If sending through the form is not available, the website may offer an alternative through the visitor’s email application. In that case, the message is only sent after the user confirms it.
Submitting a contact form does not automatically subscribe you to newsletters or promotional communications.
4. Purposes and legal bases
Personal data is processed only for legitimate and specific purposes.
Answering contact requests. We use the information you provide to answer questions, clear up doubts and follow up on the requests received.
Preparing proposals and providing services. When you ask for a quote or a commercial proposal, the processing of the necessary data is based on pre-contractual steps taken at your request.
Compliance with legal obligations. Some data may be processed and kept when necessary to comply with legal, tax or contractual obligations.
Marketing communications. The Studio441 Insights newsletter is sent on the basis of the subscriber’s consent.
Security and abuse prevention. Some technical data may be processed on the basis of the legitimate interest in protecting the website, its systems and its users, respecting the rights and freedoms of data subjects.
Statistical analysis. Non-essential analytics tools are only used with consent, as set out in the Cookie Policy.
5. Newsletter — Studio441 Insights
Studio 4:41 offers the Studio441 Insights newsletter, dedicated to content about design, web development, technology, artificial intelligence, digital strategy and innovation. Subscribing is voluntary and independent from any contact request or purchase of services. To manage the subscription we may collect:
- Email address.
- Name, when provided.
- Selected areas of interest.
- Preferred language.
- Date and version of the consent.
- Technical data needed to prove the subscription.
- Technical events related to message delivery.
We use a double opt-in system: the subscription only becomes active after the user confirms the email address through the link sent. The data is stored through Supabase, in a European Union region, and emails are sent through the Resend service. Unconfirmed subscription requests are deleted after 30 days.
You can unsubscribe at any time through the link in the footer of every newsletter. After unsubscribing, we may keep the email address on a suppression list, solely to prevent unwanted future emails, together with the elements needed to demonstrate compliance with the applicable legal obligations.
We do not sell contact lists and we do not use newsletter data for third-party campaigns.
6. Cookies and analytics technologies
The website uses technologies needed for it to work and may use statistical analysis tools. The language preference may be stored locally in the browser, so the visitor’s choice is kept between pages and sessions.
We use Google Analytics 4 to understand, in aggregate form, how visitors interact with the website. Non-essential analytics cookies depend on the visitor’s prior consent; visitors can accept, refuse or change their preferences through the tools provided on the website.
For more information, see our Cookie Policy.
7. External services and platforms
To keep the website running and to provide our services, we may use specialised technology providers. The services in use include:
Supabase. Database and infrastructure platform used to store and manage information related to contacts and subscriptions.
Resend. Service used to send transactional emails and newsletter communications.
Google Analytics 4. Statistical analysis tool used with consent.
OpenStreetMap. Map service embedded on the contact page. When the map loads, the browser may connect to the provider’s servers, transmitting technical data, including the IP address.
Access to external websites through links on our website is subject to the privacy policies of their respective controllers. Providers that process personal data on our behalf must be bound by the applicable data protection contractual obligations. The actual location of the processing, any international transfers and the corresponding safeguards will be verified according to the services engaged.
8. Storage and security
We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or improper destruction. These measures may include:
- Communications protected by HTTPS/TLS.
- Access control to administrative systems.
- Restricted permissions on databases.
- Validation of data submitted through the forms.
- Mechanisms to prevent abuse and automated use.
- Management of credentials and access to external services.
Despite the measures in place, no digital system can guarantee absolute security. We aim to keep security practices proportionate to the risks of the processing we carry out.
9. Data retention
Personal data is kept only for the period needed to fulfil the purposes for which it was collected. In principle, the following criteria apply:
Contact requests: planned period of up to 24 months, subject to confirmation.
Active newsletter: while the subscriber keeps the subscription.
Unconfirmed subscriptions: deleted after 30 days.
Temporary technical abuse-prevention records: up to one hour.
Contractual and tax data: for the periods required by law.
Proof of consent and suppression lists: for the period needed to demonstrate compliance with the applicable obligations and to respect communication preferences.
When data is no longer needed, it will be deleted or anonymised, unless there is a legal obligation to keep it.
10. Sharing of personal data
We do not sell, rent or trade the personal data of visitors, customers or subscribers. Data may be shared with technology providers that supply services essential to the operation of the website, always within the limits needed to provide those services. It may also be disclosed to public authorities when required by law.
Internal access to data is limited to the people who need that information to do their work.
11. Rights of data subjects
Under the GDPR, where applicable, you may exercise the following rights:
- Access: find out whether we process your personal data and obtain a copy.
- Rectification: ask for incorrect or incomplete information to be corrected.
- Erasure: ask for your data to be deleted under the conditions provided by law.
- Restriction: ask for certain processing operations to be restricted.
- Portability: receive your personal data in a structured format, where applicable.
- Objection: object to certain processing, including direct marketing.
- Withdrawal of consent: withdraw, at any time, a consent previously given.
To exercise your rights, send an email to info@441.studio. We will respond within the periods set by the applicable law, as a rule within one month, without prejudice to legally permitted extensions.
You may also lodge a complaint with the Portuguese data protection authority (CNPD). Website: www.cnpd.pt
12. Privacy of minors
The Studio 4:41 website is mainly aimed at professionals, companies and organisations interested in our services. We do not intentionally seek to collect personal data from minors through the forms or the newsletter. If we identify an improper collection of data from minors, we will take the appropriate measures to review and, where applicable, delete that information.
13. Changes to this Privacy Policy
Studio 4:41 reserves the right to update this Privacy Policy to reflect legal, technological or operational changes. The latest version will be available on this page, with its update date. Whenever a change legally requires it, the necessary information or consent procedures will be followed.
14. Contact
For clarification about this policy, about the processing of your personal data or to exercise your rights, you can contact us through:
Studio 4:41
Controller: Marcos Oliveira
Website: https://441.studio
Email: info@441.studio
Portugal
We create digital experiences with purpose. We handle your data responsibly.
