Privacy Policy
Last updated: November 14, 2026
Applies to: visitors in the European Economic Area, the United Kingdom and Switzerland, and any visitor whose location we cannot determine
This policy gives you the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP).
1. Controller
- Controller: Daniel Corrêa (individual, trading as Lucca Studio), based in Brazil
- Contact: dan.souza.correa@gmail.com
- EU representative (Art. 27 GDPR): not appointed. Our processing of data from people in the EU is occasional (mainly replying to people who contact us), does not involve special categories of data on a large scale, and is unlikely to result in a risk to your rights (Art. 27(2)(a)). The same applies under the UK GDPR and the Swiss FADP.
We have not appointed a Data Protection Officer, as we are not required to.
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Name, email, company and service of interest (both optional), message from the contact form; emails you send us | Reply to your inquiry, prepare a quote or proposal | Steps prior to entering a contract at your request (Art. 6(1)(b)); our legitimate interest in answering inquiries (Art. 6(1)(f)) | 24 months after last contact; longer if a contract follows, as required by law |
| IP address, browser, pages requested, date/time (server logs) | Deliver the site, security, troubleshooting | Legitimate interest (Art. 6(1)(f)) | 30 days online, archived up to 13 months (Netlify) |
| Approximate country (from IP, not stored by us) | Show the correct privacy notice and banner | Legitimate interest / legal obligation (Art. 6(1)(f), 6(1)(c)) | Not stored |
Your consent choices (ls_consent cookie + timestamp, version) | Remember and prove your choices | Legal obligation (Art. 6(1)(c), Art. 7(1)) | 6 months, then we ask again |
| Analytics / marketing cookies | Measure site use / advertising | Consent (Art. 6(1)(a); ePrivacy rules) | None active today |
Where we rely on legitimate interest, our interest is answering people who contact us and running a secure website; we have balanced this against your rights and keep the data to a minimum. You can object at any time (see Section 7).
Providing your data through the form is voluntary, but without an email address we cannot reply. We do not make decisions based solely on automated processing, including profiling. We do not ask for special categories of data; please do not send them.
The contact form has no captcha: spam is filtered with a hidden field and by Web3Forms' own filters.
3. Cookies
We only use strictly necessary cookies without consent. All other cookies are off until you opt in, and you can reject all as easily as you accept all.
| Category | Status | Examples |
|---|---|---|
| Essential | Always on | ls_consent (stores your choices, 6 months) |
| Analytics | Off until you consent | None in use today |
| Marketing | Off until you consent | None in use today |
Portfolio previews: some portfolio items can display a client's live website in a frame. Those third-party sites may set their own cookies, so previews load only after you click them. The third party is responsible for its own cookies.
Portfolio videos: Some portfolio videos play through YouTube (in privacy-enhanced mode, youtube-nocookie.com) or Adobe's Behance video player. They load only when you press play, except the header video on the Ana Castela case page, which plays automatically only if you turned on "Third-party previews". Once a player loads, YouTube or Adobe receive your IP address and may store data on your device under their own privacy policies.
You can change or withdraw consent at any time via "Privacy choices" in the footer; withdrawing does not affect processing before withdrawal.
4. Recipients (processors)
| Recipient | Role | Location |
|---|---|---|
| Netlify, Inc. | Hosting, CDN, server logs | USA |
| Web3Forms (operated by Web3Creative) | Contact form delivery; its spam filters (CleanTalk, Akismet) receive the sender's IP and email | India; servers in the USA (AWS); some sub-processors in the EU |
| Google LLC (Gmail) | USA | |
| Google LLC (YouTube) | Plays some portfolio videos in privacy-enhanced mode (youtube-nocookie.com), only after you press play (receives IP) | USA |
| Adobe Inc. (Behance video player) | Plays some portfolio videos, only after you press play (receives IP) | USA |
We may disclose data where required by law. Links to Instagram, LinkedIn and Behance lead to those platforms; we do not embed their trackers.
5. International transfers
We are based in Brazil, and our providers are mainly in the United States, so your data is transferred outside the EEA/UK/Switzerland.
- United States: Netlify, Google and Adobe are certified under the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. DPF), so transfers to them rely on the Commission's adequacy decision for the DPF.
- India / United States (Web3Forms): covered by the Standard Contractual Clauses (with the UK Addendum where applicable) in Web3Forms' data processing agreement (Art. 46(2)(c)).
- Brazil: the European Commission recognised Brazil as providing an adequate level of protection (Commission Implementing Decision (EU) 2026/179 of 26 January 2026), so transfers from the EEA to Brazil need no further safeguards (Art. 45 GDPR). For UK and Swiss visitors, sending your message to us in Brazil is necessary for the pre-contractual steps you ask for (UK GDPR Art. 49(1)(b); FADP Art. 17(1)(b)).
You can ask us for a copy of the relevant safeguards at dan.souza.correa@gmail.com.
6. How long we keep data
See the table in Section 2. When the period ends, we delete or anonymize the data.
7. Your rights
You have the right to: access your data (Art. 15); rectification (Art. 16); erasure (Art. 17); restriction (Art. 18); data portability (Art. 20); object to processing based on legitimate interest (Art. 21); and withdraw consent at any time (Art. 7(3)).
Write to dan.souza.correa@gmail.com. We reply within one month (extendable by two months for complex requests, with notice).
Complaints: you can lodge a complaint with the supervisory authority where you live, work or where the alleged infringement occurred. The list of EU authorities is at https://edpb.europa.eu/about-edpb/about-edpb/members_en. UK: Information Commissioner's Office (https://ico.org.uk). Switzerland: Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch).
8. Security
HTTPS, reputable providers, and access restricted to Daniel Corrêa.
9. Changes
We will post updates here with a new date.
10. Contact
Daniel Corrêa · dan.souza.correa@gmail.com