Privacy Policy

Last updated: August 2026

1. Identity of the data controller

This Privacy Policy applies to the processing of personal data carried out by Jorge Simão Photography Unipessoal, Lda., owner of the Simon Says Studio brand, with registered office at Rua Fernão de Magalhães 2, Lisbon, Portugal, tax number 510 889 590, telephone +351 211 946 846, email geral@simonsays.pt, and website simonsays.studio, acting as controller of the personal data collected through that website and the contact channels associated with it.

Whenever the law requires it or the organisation considers it appropriate, a data protection officer may be appointed, and their contact details published through the appropriate channels. In this version, as no data protection officer has been designated, questions relating to privacy and to the exercise of rights should be addressed to the contact details set out above.

2. Scope

This Privacy Policy is intended to inform website users, clients, prospective clients and anyone else who contacts Simon Says Studio about how their personal data may be collected, used, retained and, where applicable, shared in the course of our activity.

This policy applies, in particular, to browsing the website, sending contact or quote requests, requests relating to photography and video services, studio hire, workshops, training sessions and creative events, and to other contacts made digitally, by telephone or electronically in connection with the activity of Simon Says Studio. The general framework for this processing derives from the GDPR and from Portuguese Law no. 58/2019, which gives it effect in the Portuguese legal order.

3. Personal data that may be collected

Depending on the form of contact, the purpose in question and the functionality actually available on the website, the following personal data may be processed:

• identification data, such as name;
• contact details, such as email address and telephone number;
• professional or commercial data, such as company, job title, sector or information associated with the request;
• data contained in messages sent through forms, email or other means of contact;
• data required to prepare, manage and follow up quote requests, bookings, appointments, hires, workshops or the provision of services;
• billing data or other data strictly necessary to comply with legal and accounting obligations, where a contractual relationship exists;
• technical and browsing data, such as IP address, access logs, device type, browser, date and time of access, and information collected through cookies or similar technologies, where applicable.

As a rule, Simon Says Studio does not intentionally collect special categories of personal data through the website. Should a user spontaneously send data of that nature in exceptional circumstances, it will only be processed to the extent that this is strictly necessary, appropriate and legally permissible.

4. How data is collected

Personal data may be collected:

a) directly from the data subject, through forms available on the website, contact requests, quote requests, email communications, telephone calls, messages sent by electronic means or subsequent in-person contact;

b) automatically, through use of the website, including technical browsing data, system logs and cookies or similar technologies, where those features are active and are used in accordance with the applicable law;

c) in the course of pre-contractual, contractual or administrative steps relating to the provision of services, studio hire, the organisation of workshops, training sessions, events or other activities carried out by Simon Says Studio.

5. Purposes of processing

Personal data may be processed for the following purposes:

a) handling contact requests and responding to communications received;

b) preparing, sending and following up proposals, quotes or requested commercial information;

c) managing bookings, appointments, hires, registrations, meetings, workshops, training sessions or events;

d) performing contracts, providing services and handling communications associated with the professional or commercial relationship;

e) complying with legal, tax, accounting and administrative obligations;

f) internal management, operational organisation, administrative records and the defence of rights in the event of a dispute;

g) security, technical operation, maintenance and improvement of the website;

h) sending marketing communications, newsletters or promotional information, only where there is an appropriate lawful basis for doing so, in particular consent, where consent is required;

i) collecting usage metrics, analytics, website performance measurement or digital advertising activity, only where such tools are actually implemented and are used in accordance with the applicable law.

Whenever the services provided by Simon Says Studio involve capturing images, video, portraits or other content relating to the visual identity of those taking part, the applicable privacy framework may be supplemented by a proposal, contract, release, dedicated form or additional information provided in that specific context.

6. Lawful bases for processing

The processing of personal data carried out by Simon Says Studio rests, depending on the case, on the following lawful bases:

a) the data subject's consent, where that is the legally appropriate basis, in particular for sending certain marketing communications, newsletter subscriptions or the use of cookies that are not strictly necessary;

b) pre-contractual steps taken at the data subject's request, or performance of a contract, in particular to assess quote requests, bookings, hires, appointments and registrations, to provide services and to manage relationships with clients or partners;

c) compliance with a legal obligation, in particular in tax, accounting, administrative and billing matters, or in responding to legally imposed requirements;

d) legitimate interests pursued by the controller, provided that the data subject's rights and freedoms do not override them, in particular for administrative management, information security, internal organisation, responding to professional contacts, preventing misuse of the website and defending rights.

In each situation, Simon Says Studio will seek to rely on the lawful basis that best matches the specific purpose of the processing, and does not assume that consent is the appropriate legal basis for all processing of personal data.

7. Sharing data with service providers or third parties

Personal data may be disclosed to third parties where this is necessary to comply with legal obligations, to provide the services requested by the data subject, or for the ordinary operation of the website and of the activity of Simon Says Studio.

This may involve, among others, providers of web hosting, technical maintenance, web development, email management, productivity tools, billing, accounting, legal support, booking platforms, newsletter platforms, analytics tools, cloud storage providers and other technology and operational suppliers.

Wherever such third parties act on behalf of Simon Says Studio, they must act as processors, on appropriate instructions and on the terms required by the applicable law, without prejudice to the controller retaining overall responsibility for the processing of personal data.

8. International data transfers

In principle, personal data will be processed within the European Economic Area. However, given the nature of the digital services currently used in the market, certain technology providers and platforms for communications, hosting, email, cloud, analytics or marketing may involve remote access, storage or sub-processing outside the European Economic Area.

Whenever an international transfer of personal data takes place, Simon Says Studio will seek to ensure that it only occurs where there is an adequate legal basis for it, in particular an adequacy decision of the European Commission, standard contractual clauses, appropriate supplementary measures or another legally permissible mechanism, as applicable to the specific case. Where legally required, additional information will be provided about the relevant safeguards.

9. Data retention periods

Personal data will be retained only for as long as is strictly necessary for the purposes that justified its collection and processing, without prejudice to legally imposed retention periods or to the period needed to establish, exercise or defend rights in judicial, administrative-offence, arbitration or administrative proceedings.

By way of example and without being exhaustive:

a) data associated with contact or quote requests may be retained for the period reasonably necessary to follow up the request and to take subsequent commercial steps compatible with its nature;

b) data relating to contractual relationships, billing or accounting obligations may be retained for the legally applicable periods;

c) data processed on the basis of consent will be retained until that consent is withdrawn, without prejudice to the lawfulness of processing carried out beforehand;

d) technical and browsing data, or data associated with cookies, will follow the retention periods applicable to the technical settings actually adopted, and that information should be reflected, where applicable, in the Cookie Policy.

Once data is no longer necessary, it will be deleted or anonymised, wherever that is legally and technically appropriate.

10. Rights of data subjects

Under the applicable law, the data subject may exercise, depending on the case, the following rights:

a) the right of access to their personal data and to information about how it is processed;

b) the right to rectification of inaccurate or incomplete data;

c) the right to erasure of the data, in the cases provided for by law;

d) the right to restriction of processing;

e) the right to data portability, where applicable;

f) the right to object to processing, where it rests on a legal basis that allows such an objection;

g) the right to withdraw, at any time, consent previously given, where the processing is based on that consent, without affecting the lawfulness of processing carried out up to that date;

h) the right not to be subject to decisions based solely on automated processing, including profiling, where that applies under the law.

Rights should be exercised through the contact details given in this policy. The data subject also has the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados, CNPD), as the competent national supervisory authority.

11. Security and confidentiality

Simon Says Studio will seek to adopt appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, disclosure, unauthorised access or any other unlawful or improper form of processing, taking into account the nature of the data, the context of the processing, the risks involved and the state of the art.

Depending on the situation, those measures may include access control, segregation of user profiles, use of appropriate passwords, authentication mechanisms, backups, system updates, restriction of internal access, careful selection of service providers, confidentiality obligations and incident management procedures.

That said, no security measure completely eliminates the risks inherent in transmitting or processing data in a digital environment, so absolute security cannot be guaranteed. The measures adopted should be reviewed and updated whenever necessary.

12. Use of cookies

The website may use cookies or similar technologies that enable it to function technically, improve the browsing experience, measure performance, analyse usage statistics or, where applicable, provide personalisation and advertising features.

Under the law applicable in Portugal, storing information or accessing information stored on the user's terminal equipment generally requires prior, informed and freely given consent, except where the storage or access is strictly necessary to transmit a communication over an electronic communications network or to provide a service expressly requested by the user. Where applicable, detailed information about cookie types, purposes, duration and preference management mechanisms should be set out in a separate Cookie Policy or equivalent mechanism.

13. Links to third-party websites or platforms

The website may contain links to third-party websites, platforms, social networks, external portfolios, video services, forms or applications. Providing those links does not imply any assumption of responsibility for the content, privacy practices, terms of use or processing of personal data carried out by those entities.

Whenever users access third-party websites or services, they should consult the relevant privacy policies and other applicable terms before providing any personal data.

14. Processing of children's data

In principle, the website and the services of Simon Says Studio are not specifically directed at children in the context of the direct offer of information society services on the basis of consent. Even so, should processing of children's personal data occur in that context, Simon Says Studio will seek to ensure compliance with the applicable legal rules.

Under Portuguese law, where processing depends on consent and concerns the direct offer of information society services, that consent may only be given independently from the age of 13; below that age, consent must be given by the child's legal representatives.

15. Changes to this Privacy Policy

Simon Says Studio reserves the right to update or amend this Privacy Policy at any time, in particular whenever there are relevant legislative, regulatory, operational, technological or functional changes.

The most recent version will be made available on the website, stating the date it was last updated. Whenever a change is material and the law so requires, additional means of informing users may be adopted.

16. Contacts for exercising rights or seeking clarification

For any question relating to this Privacy Policy, to exercise data protection rights or to request further clarification, the data subject may contact:

Jorge Simão Photography Unipessoal, Lda.

Address: Rua Fernão de Magalhães 2, 1170-126 Lisbon, Portugal

Email: geral@simonsays.pt

Telephone: +351 211 946 846

Website: simonsays.studio

If you consider that the processing of your personal data breaches the applicable law, you may also lodge a complaint with the CNPD.