Data Controller

Picchalham is the data controller for personal information collected through this website and our client services. Our registered studio address is Rua das Flores 42, 1200-195 Lisboa, Portugal. For privacy enquiries contact [email protected] or call +351 21 346 7890.

We process data in accordance with the EU General Data Protection Regulation (GDPR) and Portuguese Law 58/2019. This policy explains what we collect, why we collect it, and your rights regarding your personal data.

Information We Collect

We collect names, email addresses, phone numbers, and project details when you submit contact forms or sign design contracts. Website analytics collect anonymised page views and referral sources through privacy-respecting tools that do not use cross-site tracking.

Client projects may require property addresses, floor plans, and photographs of your home — stored securely and deleted seven years after project completion unless you request earlier erasure. We do not collect sensitive categories of data such as health or biometric information.

Legal Basis & Purpose

Contract performance is the legal basis for processing client project data. Legitimate interest covers responding to enquiries and improving our services. Consent is obtained for marketing emails and non-essential cookies, which you may withdraw at any time.

We use your data solely to deliver design services, communicate about projects, issue invoices, and — with consent — send studio news and event invitations. We never sell personal data to third parties.

Data Retention & Security

Enquiry data is retained for 24 months. Contract and invoice records are kept for seven years per Portuguese tax law. Cookie consent records are stored locally on your device and not transmitted to our servers.

Technical measures include encrypted email, access-controlled file storage, and staff training on data handling. In the event of a breach affecting your rights, we will notify you and the CNPD within 72 hours as required by law.

Your Rights

Under GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interest. You may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) at cnpd.pt.

To exercise any right, email [email protected] with 'Data Request' in the subject. We respond within 30 days at no charge unless requests are manifestly excessive.

International Transfers

Our primary systems are hosted within the European Economic Area. If we transfer data outside the EEA — for example to a cloud backup provider — we ensure adequate safeguards through Standard Contractual Clauses or equivalent mechanisms.

Sub-processors are listed on request. We conduct due diligence on all suppliers handling personal data and require GDPR-compliant agreements.