In short
- We only collect the data you send us: through the contact form or the website check report request.
- We only use that data to reply to you. We do not use it for marketing, we do not sell it and we do not share it with third parties for their own purposes.
- This website does not use cookies or tracking tools.
Who is responsible for your data
Lumbra Creative is responsible for the data collected on this website. For any privacy question, write to us at geral@lumbracreative.pt.
What data we collect and why
Contact form
When you write to us, we receive the name, email, subject, budget and timeline you choose, how you found us (if you tell us), your message and the page language. We use this data to reply to your request and, where relevant, prepare a proposal. The request reaches us by email and is also recorded in an internal database on our hosting, accessible only to us.
Legal basis: steps taken at your request before a possible contract (Article 6(1)(b) GDPR).
Website check
When you check a website on Website check, the address you enter is sent directly from your browser to Google PageSpeed Insights, which runs the analysis. As with any request on the internet, Google also receives your IP address and technical browser details. We do not store the results of Google’s analysis.
In the same check, our server visits the homepage of the website you entered and looks up the domain’s public records (DNS and certificate) to show its technology, security, domain email and trackers. The result is cached for 24 hours so the check is not repeated. To prevent abuse, we keep an anonymous code derived from your IP address for one hour — we do not store the IP itself.
If you request the explained report, we receive your name, email, the website address, the check results and any note you write. We use this data to send you the report and answer your questions.
Legal basis: steps taken at your request (Article 6(1)(b) GDPR).
Visitor statistics
We use Cloudflare Web Analytics to know how many people visit the website and which pages they view. It works without cookies, builds no profiles and does not follow visitors across websites. We only see aggregated numbers.
Legal basis: legitimate interest in understanding how the website is used and improving it (Article 6(1)(f) GDPR).
Server logs
Like any website, the server automatically logs the requests it receives (IP address, date and time, page requested and browser) to keep the website secure and working properly.
Legal basis: legitimate interest in website security (Article 6(1)(f) GDPR).
Who we share data with
Only with the providers we need to run the website, and only for that purpose:
| Provider | Purpose |
|---|---|
| Hostinger | Website hosting and sending contact form emails |
| Proton Mail | Mailbox where we receive messages |
| Google (PageSpeed Insights) | Analysis in the website check tool |
| Cloudflare (Web Analytics) | Visitor statistics, without cookies |
Some of these providers may process data outside the European Union (for example in the United States or Switzerland). In those cases, transfers rely on the mechanisms provided for in the GDPR, such as European Commission adequacy decisions or the EU-US Data Privacy Framework.
Clients and contracts
If you become a client, we keep your billing and contact details and the record of your contract acceptance (name of the person accepting, date, IP address and browser), as proof of what was agreed. In the client area we also keep the requests, messages and approvals we exchange with you, and the date of your last sign-in. The client area uses a session cookie, essential to keep you signed in — it is used for nothing else.
Legal basis: performance of the contract and compliance with legal obligations (Article 6(1)(b) and (c) GDPR).
How long we keep data
We keep messages for as long as needed to reply to and follow up on your request. If you become a client, we keep what is necessary for as long as the law requires (for example, for tax purposes). You can ask us to delete your data at any time.
Your rights
At any time, you can:
- access the data we hold about you;
- ask for it to be corrected or deleted;
- object to processing or ask for it to be restricted;
- ask for a copy of your data in a commonly used format (portability).
Just write to geral@lumbracreative.pt. We reply within one month at the latest.
If you believe your data is not being handled properly, you can also lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).
Cookies
The public pages of this website do not use cookies, first-party or third-party, and store nothing in your browser (the client area only uses the session cookie mentioned above). That is why we do not ask for cookie consent.
Changes
If we change how we handle data, we will update this page and the date at the top.