Privacy Policy
1. Who We Are
This Privacy Policy explains how take-two, NIF [NIF number], with registered address at Cascais, Portugal ("Studio", "we", "us"), collects, uses, stores, and protects your personal data when you use our services or interact with our website.
The Studio is the data controller for the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Portuguese Law n.º 58/2019.
For any questions about this policy or your personal data, contact us at:
Email: [email protected]
WhatsApp: (+351) 967 735 631
2. What Data We Collect
We collect and process the following categories of personal data, depending on how you interact with us:
When you enquire about our services: name, email address, phone number or WhatsApp contact, and the details of your enquiry (description of the part or project, photographs you share with us).
When you become a client: the above, plus delivery address, billing information (name, NIF if applicable, address), project specifications, photographs of objects to be scanned or replicated, and any communication exchanged during the course of the job (WhatsApp messages, emails).
When you visit our website: basic usage data (page views, referral source, country, device type, browser). We collect this in two ways: through cookieless, privacy-focused analytics that run for all visitors, and, only if you consent via our cookie banner, through Google Analytics, which uses cookies. See Section 6 for details.
When you leave a review or testimonial: your name and the content of the review, as published on Google Business Profile or other public platforms.
We do not collect sensitive personal data (health data, biometric data, political opinions, etc.) and we do not process data of minors.
3. Why We Collect Your Data and Our Legal Basis
We process your personal data for the following purposes:
To provide our services (legal basis: contract performance). Processing your name, contact details, project specifications, and photographs is necessary to provide you with quotes, carry out scanning, modelling, and printing work, deliver finished parts, and communicate with you about your order.
To issue invoices and comply with tax obligations (legal basis: legal obligation). Portuguese tax law requires us to issue invoices with your name and NIF (if applicable) and to retain these records for the legally mandated period.
To manage warranty claims and defect reports (legal basis: contract performance). If you report a defect under our Terms and Conditions, we process relevant project and communication data to assess and resolve the claim.
To build and maintain our parts library (legal basis: legitimate interest). We retain anonymised engineering data (dimensions, material specifications, print settings) from completed jobs to improve our services and build a reference library. No personally identifiable information is stored in this library.
To create portfolio content (legal basis: legitimate interest). We may photograph the production process and finished parts for use on our website, social media, and marketing materials. If you do not wish your project to appear in our portfolio, let us know in writing before work begins and we will respect your request.
To respond to enquiries (legal basis: legitimate interest). When you contact us with a question or request, we process your contact details and message to respond.
To understand website usage, cookieless analytics (legal basis: legitimate interest). We use privacy-focused, cookieless website analytics to understand how visitors find and use our website, so we can improve it. This data is aggregated and does not identify individual visitors.
To understand website usage, Google Analytics (legal basis: consent). If, and only if, you accept analytics cookies via our cookie banner, we additionally use Google Analytics 4 to measure how visitors use the site. You can decline without any effect on your use of the website, and you can withdraw your consent at any time (see Section 6).
4. How Long We Keep Your Data
We retain your personal data only for as long as necessary for the purposes described above:
Client project data (quotes, communications, project details): retained for the duration of the project plus 3 years after completion, to cover any warranty, dispute, or follow-up needs.
Invoicing and financial records: retained for the minimum period required by Portuguese tax law (currently 10 years for tax-relevant documents).
Enquiry data (if no job resulted): deleted within 12 months of the last communication, unless you ask us to keep your details on file.
Parts library data: retained indefinitely, but this data is anonymised and contains no personally identifiable information.
Website analytics data: cookieless analytics data is aggregated and non-identifying, retained according to our analytics provider's standard retention period. Google Analytics event data (collected only with your consent) is retained for a maximum of 14 months and then automatically deleted; the associated cookies expire as described in Section 6.
5. Who Has Access to Your Data
Your personal data is accessible to the Studio owner/operator for the purposes described in this policy.
We may share your data with the following third parties, only to the extent necessary:
Certified accountant (contabilista certificado): for invoicing and tax compliance purposes, as required by Portuguese law.
Invoicing software provider: to issue AT-certified invoices. These providers process data on our behalf under their own GDPR-compliant terms.
Cookieless analytics provider: our privacy-focused website analytics tool processes aggregated, non-identifying usage data. No personal data is shared.
Google (Google Analytics): if you consent to analytics cookies, usage data (pages viewed, approximate location derived from your IP address, device and browser information, traffic source, and a cookie-based identifier) is processed by Google Ireland Limited and Google LLC on our behalf as our processor, under the Google Ads Data Processing Terms. See Sections 6 and 9 for details, including the transfer of data to the United States.
Communication platforms (WhatsApp, email): messages exchanged with you are processed by the respective platform providers under their own privacy policies.
We do not sell, rent, or trade your personal data to any third party. We do not use your data for automated decision-making or profiling.
If we are legally required to disclose your data (for example, by a court order or tax authority request), we will comply with the applicable legal obligation.
7. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
Right of access. You can request a copy of the personal data we hold about you.
Right to rectification. You can ask us to correct any inaccurate or incomplete data.
Right to erasure. You can ask us to delete your personal data, subject to any legal retention obligations (such as tax records that must be kept for the legally mandated period).
Right to restrict processing. You can ask us to limit how we use your data in certain circumstances.
Right to data portability. You can request your data in a structured, commonly used, machine-readable format.
Right to object. You can object to processing based on legitimate interest. We will stop processing unless we have compelling legitimate grounds that override your interests.
Right to withdraw consent. Where processing is based on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.
8. Data Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include secure storage of digital files, password-protected devices, and limiting access to personal data to the Studio operator only.
However, no method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
9. International Transfers
Your data is generally processed and stored within the European Economic Area (EEA). If any third-party service we use processes data outside the EEA (for example, if a communication platform has servers outside Europe), we ensure that appropriate safeguards are in place as required by the GDPR (such as Standard Contractual Clauses or an adequacy decision by the European Commission).
Google Analytics (with your consent only): analytics data is processed by Google Ireland Limited and may be transferred to and stored by Google LLC on servers in the United States. This transfer is safeguarded by the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework, under which Google LLC is certified, supplemented by Standard Contractual Clauses.
10. Complaints
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Portuguese data protection authority:
Comissão Nacional de Proteção de Dados (CNPD)
Avenida D. Carlos I, n.º 134, 1.º andar
1200-651 Lisboa, Portugal
cnpd.pt
We would appreciate the opportunity to address your concerns directly before you contact the CNPD. Please reach out to us first at [email protected].
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be published on our website with the revision date noted. We encourage you to review this page periodically.
12. Contact
For any questions about this Privacy Policy or to exercise your data protection rights:
Email: [email protected]
WhatsApp: (+351) 967 735 631
Address: Cascais, Portugal