1. Introduction and Scope

This Privacy Policy ("Policy") explains what personal data Skillful Sardine - Unipessoal Lda. ("we," "us," "our," or "Company") collects when you use the website skillfulsardine.com (the "Website"), why we collect it, how long we keep it, and the rights you have over it.

Governing Law: This Policy is governed by and construed in accordance with the laws of Portugal, without regard to its conflict of law provisions.

2. Data Controller

The data controller responsible for your personal data is:

Skillful Sardine - Unipessoal Lda.
Email: legal@skillfulsardine.com

3. Information We Collect

3.1 Contact Form

When you submit a contact form, we collect the following information:

  • Full name
  • Email address
  • Message content

Purpose: This information is collected solely to respond to your inquiry and facilitate communication.

3.2 Estimation Request Form

When you submit an estimation request form, we collect the following information:

  • Full name
  • Email address
  • Company name (optional)
  • Project details and description
  • Budget range and timeline preferences
  • Additional project requirements

Purpose: This information is collected solely to provide project estimations and facilitate business communication.

3.3 Comments

If you comment on an article, we collect:

  • Your comment text (required)
  • Name (optional; comments can be anonymous)
  • Email address (optional; never displayed publicly)

No IP address and no browser data are stored with a comment. Every comment is reviewed by a person before it appears on the Website, and we may decline to publish or may remove a comment at any time.

Purpose: To display your comment alongside the article and to moderate discussion.

3.4 Server Request Logs

Our servers keep a log of requests made to the Website. This log records:

  • IP address
  • Browser user agent
  • The page requested, the response status, and how long the request took
  • The referring page, if any
  • Standard request headers (never cookies, never authorisation headers)

Purpose: Security. These logs allow us to investigate abuse, automated scraping, and attacks against the Website.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in keeping the Website secure and available.

An IP address is personal data under the GDPR, and we treat these logs accordingly, even though we never link them to a name.

3.5 Information We DO NOT Collect

We do not collect, store, or process any of the following:

  • Payment information (no e-commerce functionality)
  • Newsletter subscriptions (this Website has no newsletter)
  • Device identifiers or advertising IDs
  • Cross-site tracking data

3.6 Information Collected via Umami Analytics

We use Umami, a privacy-focused analytics platform that collects anonymized usage data. Umami operates without cookies and does not track you across websites.

Data collected by Umami (anonymized):

  • Page views and page URLs visited
  • Referrer source (where you came from)
  • Browser type and version
  • Operating system
  • Device type (desktop, mobile, tablet)
  • Screen resolution
  • Country, region, and city (derived from the IP address; the IP address itself is not stored)
  • Session duration and timestamp of visit

What Umami does not do:

  • No cookies are set on your device
  • No IP address is stored
  • No cross-site tracking
  • We cannot identify individual visitors from this data

3.7 Theme Preference (Local Storage)

If you change the Website's theme (light/dark mode), your preference is stored locally in your browser's localStorage. This data:

  • Is stored exclusively on your device
  • Is never transmitted to our servers
  • Can be deleted by clearing your browser's local storage

4. Legal Basis for Processing (GDPR)

Under the EU General Data Protection Regulation (GDPR), we process data under the following legal bases:

  • Consent (Article 6(1)(a) GDPR): When you submit a contact form, an estimation request, or a comment, you provide explicit consent for us to process the personal data you include.
  • Legitimate Interests (Article 6(1)(f) GDPR): We have a legitimate interest in understanding how users interact with the Website to improve content quality, user experience, and Website performance through anonymized analytics.
  • Legitimate Interests (Article 6(1)(f) GDPR): Server request logs, including the IP address. We have a legitimate interest in keeping the Website secure, available, and free of automated abuse.

5. Purpose and Use of Data

We use collected data exclusively for the following purposes:

  • Responding to contact form inquiries
  • Providing project estimations and consultations
  • Measuring Website traffic and popularity of content (anonymized)
  • Understanding user behavior patterns (anonymized)
  • Improving Website design, content, and performance
  • Publishing and moderating the comments you submit
  • Investigating abuse, automated scraping, and attacks against the Website

We will never use data for:

  • Unsolicited marketing or advertising
  • Selling or sharing data with third parties
  • Profiling or behavioral targeting
  • Any purpose not explicitly stated above

6. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with any third parties for marketing purposes.

Third-party services used:

  • Umami Analytics: Self-hosted analytics platform. Data is stored on our own servers and is not accessible to external parties.
  • Infrastructure Providers: Our hosting infrastructure may process data as part of providing services, but they have no independent right to use your data.

Legal Disclosure: We may disclose information if required by law, court order, or governmental authority, or to protect our legal rights, safety, or property.

7. Data Retention

Contact Form Submissions: personal data from contact forms is deleted automatically six months after submission. You may request deletion sooner at any time (see Section 8).

Estimation Requests: personal data from estimation requests (including your name, email, company and project description) is deleted automatically six months after submission. You may request deletion sooner at any time.

Comments: published comments remain on the Website alongside the article. You can ask us to delete a comment, or the name and email attached to it, at any time (see Section 8).

Server request logs (including IP addresses): retained for a maximum of seven months, then deleted automatically. Residual copies in our backups are deleted within a further 90 days. You can ask us to delete data relating to you at any time (see Section 8).

Umami Analytics Data: Anonymized analytics data is retained indefinitely for statistical and historical analysis purposes. It contains no personal data.

Theme Preference: Stored locally on your device until you manually clear your browser's local storage.

8. Your Rights

The following rights are granted by the GDPR. We extend them to all visitors, regardless of location.

  • Right to Access: You have the right to access the personal data we hold about you.
  • Right to Rectification: You may request correction of inaccurate data.
  • Right to Erasure: You may request deletion of your personal data ("right to be forgotten").
  • Right to Restrict Processing: You may request limitation of how we use your data.
  • Right to Data Portability: You may request a copy of your data in a structured format.
  • Right to Object: You may object to analytics tracking or data processing.
  • Right to Withdraw Consent: Where processing is based on your consent (forms, comments), you may withdraw it at any time. Withdrawal does not affect processing that happened before it.
  • Right to Lodge a Complaint: You may complain to a data protection authority. Our supervisory authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), and you may also complain to the authority in your own country.

Providing personal data on this Website is always voluntary. It is never a statutory or contractual requirement. The only consequence of not providing it is that the related feature (a reply, an estimate, a comment) cannot be provided.

We make no automated decisions about you and do not profile you (Article 22 GDPR).

To exercise your rights or ask questions, contact us at legal@skillfulsardine.com. We will respond within 30 days.

9. Data Security

We implement industry-standard security measures to protect data integrity and prevent unauthorized access:

  • HTTPS encryption for all Website traffic
  • Content Security Policy (CSP) to prevent XSS attacks
  • Regular security updates and server hardening
  • Access controls and authentication for server infrastructure
  • Secure credential management

Limitation of Liability: While we strive to protect data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Opt-Out and Do Not Track

You may prevent analytics tracking using the following methods:

  • Use browser extensions like uBlock Origin or Privacy Badger
  • Disable JavaScript (will affect Website functionality)

Do Not Track and Global Privacy Control: we do not act on these signals. Your browser may send a "Do Not Track" (DNT) or Global Privacy Control (GPC) header, but our analytics do not read it. The browser extensions listed above do block our analytics.

11. Children's Privacy

This Website is not directed at individuals under the age of 16. We do not knowingly collect data from children. If we become aware that a child under 16 has provided personal information, we will take steps to delete such data immediately.

12. International Data Transfers

Our servers are located within the European Union. All personal data described in this Policy is stored there and is not transferred outside the EU/EEA.

13. Changes to This Privacy Policy

We may update this Policy when our data practices change. The "Last Updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically.

14. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or your data, contact us at:

Email: legal@skillfulsardine.com

We will respond to all inquiries within 30 days.

15. Severability

If any provision of this Policy is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.