1. Who we are

Cottonhat Software Unipessoal LDA, trading as Cottonhat Studio (“Cottonhat”, “we”, “us” or “our”), is the controller of the personal data described in this policy within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”).

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. Privacy questions go to info@cottonhat.net, where they are handled by the person responsible for data protection at Cottonhat.

2. Scope of this policy

This policy explains how we handle personal data when you visit cottonhat.net, contact us, or engage us for professional services. It applies to us acting as a controller — that is, when we decide why and how your data is processed.

When we build or operate software for a client, we usually handle end users’ personal data as a processor acting on that client’s documented instructions under a data processing agreement. In that case the client’s own privacy notice governs the processing, not this one, and you should direct your requests to them. We will forward any request we receive in error to the relevant controller.

3. What personal data we collect

Data you give us

• Contact form. Your name, email address and the content of your message. These three fields are required; anything else you choose to write in the message is up to you.
• Email and telephone. If you write or call us, we hold your contact details and whatever the correspondence contains.
• Client and prospect records. For clients and prospective clients we hold business contact details, job title, company, project correspondence and, where a contract is signed, the billing and invoicing details Portuguese tax law requires.
• Applications. If you apply to work with us, we hold your CV and the information in your application.

Data collected automatically

• Server and security logs. Our hosting provider records IP address, user agent, requested URL, referrer and timestamp for every request, as any web server does. These logs exist to keep the site available and to detect abuse.
• Analytics. Aggregated, non-identifying usage measurements — pages viewed, referring source, device type, country — as described in section 5.
• Advertising measurement. If you consent, Google advertising tags may set identifiers that let us see which campaigns lead to enquiries.

We do not knowingly collect special categories of data (Article 9 of the GDPR) such as health, biometric, religious or political data, and we ask you not to include such information in a contact form message.

4. Why we use it, and on what legal basis

Under Article 6 of the GDPR every use of personal data needs a legal basis. Ours are as follows.

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms and concluded that the processing is limited to what you would reasonably expect from a professional services website. You can object to it at any time — see section 10.

We do not sell personal data, and we do not send marketing email to people who have not asked for it.

5. Cookies and similar technologies

A cookie is a small file stored on your device. Under Article 5(3) of the ePrivacy Directive, as implemented in Portugal by Lei n.º 41/2004, we may only store or read non-essential cookies with your consent. You give or withdraw that consent through the cookie banner, which you can reopen at any time from the link in section 6.

Strictly necessary

These keep the site working and record the cookie choice you made, so we do not have to ask again on every page. They cannot be switched off and do not require consent.

Analytics

We use Plausible Analytics, which we host ourselves on our own infrastructure. Plausible is designed to be privacy-friendly: it sets no cookies, does not track you across websites, and reports only aggregated figures. Because we host it, the data does not leave our control.

Advertising and conversion measurement

We use Google Tag Manager to load Google advertising tags that tell us which campaigns produce enquiries. These tags may set cookies such as _ga and _gid and load only when you accept the analytics category in the cookie banner. If you reject it, or later withdraw consent, the relevant cookies are cleared.

Fonts

Typefaces are loaded from Google Fonts, which means your IP address is transmitted to Google in order to serve the font files. No cookie is set for this.

6. Changing your cookie choices

You can review or change your choices at any time using the cookie preferences panel:

Manage cookie preferences

You can also block or delete cookies through your browser settings, though parts of the site may then behave unexpectedly. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

7. Who we share data with

We do not sell or rent personal data. We share it only with service providers who process it on our behalf under a written contract meeting Article 28 of the GDPR, and only to the extent they need it:

We may also disclose data where we are required to by law, by a court or by a competent authority, and to a buyer or successor in the event of a merger, acquisition or transfer of our business — in which case this policy continues to apply to the transferred data.

8. International transfers

We keep personal data in the European Economic Area wherever we can. Some providers — Google in particular — may process data outside the EEA, including in the United States.

Where that happens, the transfer is protected by one of the safeguards in Chapter V of the GDPR: an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, where the recipient is certified), or the European Commission’s Standard Contractual Clauses together with supplementary technical and organisational measures where the assessment shows they are needed.

You can ask us for a copy of the safeguards that apply to a particular transfer by writing to info@cottonhat.net.

9. How long we keep it

We keep personal data only as long as it serves the purpose it was collected for, or as long as the law requires.

At the end of the applicable period data is deleted or irreversibly anonymised.

10. Your rights

Under Articles 15 to 22 of the GDPR you have the right to:

• Access — obtain confirmation of whether we process your data and receive a copy of it.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — have your data deleted, where one of the grounds in Article 17 applies.
• Restriction — have processing limited while, for example, a dispute about accuracy is resolved.
• Portability — receive data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Object — object at any time to processing based on our legitimate interests, and absolutely to processing for direct marketing.
• Withdraw consent — at any time, where the processing is based on consent, without affecting what was lawful beforehand.

To exercise any of these, email info@cottonhat.net. We answer within one month, which may be extended by two further months for complex requests — we will tell you if that happens. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting.

If you believe we have handled your data unlawfully, you may lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa, www.cnpd.pt, or with the supervisory authority where you live or work. We would appreciate the chance to address it first.

11. Security

We apply technical and organisational measures appropriate to the risk under Article 32 of the GDPR: encryption in transit (HTTPS), access control on a need-to-know basis, multi-factor authentication on administrative accounts, monitoring and logging, patching, and separation between client environments.

No system is perfectly secure, and we cannot guarantee the security of data in transit over the internet. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours as required by Article 33, and notify you directly where Article 34 requires it.

12. Automated decision-making and AI

We do not make decisions producing legal or similarly significant effects about you by automated means alone, and we do not carry out profiling of that kind, within the meaning of Article 22 of the GDPR.

We build AI systems for clients. Where that work involves personal data, we act as a processor under the client’s instructions, and we do not use client data or the content of your enquiries to train our own or any third party’s general-purpose AI models.

13. Children

This is a business website and is not directed at children. We do not knowingly collect data from anyone under 16, the age set for information society services in Portugal under Article 8 of the GDPR and Lei n.º 58/2019. If you believe a child has given us personal data, write to info@cottonhat.net and we will delete it.

14. Links to other sites

Our site and blog link to third-party websites we do not control. This policy does not cover them, and we are not responsible for their practices. Read their privacy notices before giving them your data.

15. Changes to this policy

We update this policy when our practices or the law change. The date at the top of the page shows when it was last revised. Material changes will be highlighted on the site, and where the change requires it we will ask for your consent again. Continuing to use the site after a change means you have seen the current version.

16. How to reach us

For anything in this policy, including a request to exercise your rights:

• Email: info@cottonhat.net
• Telephone: +351 927 344 725 (National mobile call)
• Post: Avenida D. João II, Edifício Infante 35, Piso 11A, Parque das Nações, 1990-083 Lisboa, Portugal

See also our Terms & Conditions.