Privacy Policy
Last updated: 1 October 2026
This policy explains how Ostra, a design studio based in Lisbon, collects and uses personal data when you visit our site or work with us, and the rights you hold under the EU GDPR.
The data we collect
We collect what you send us, such as your name, email, company and brief, plus basic usage data like pages viewed, browser type and rough location, gathered by cookies.
How we use your data
We use it to answer briefs, run projects, send invoices and improve the site, relying on contract, consent or our legitimate interests.
Cookies and site stats
Essential cookies keep the site working. Analytics cookies, which show us which pages are useful, load only after you agree, and you can change that choice anytime.
Who we share it with
We share data only with processors that help us run the studio, such as hosting, email and invoicing tools, under contract. We never sell it.
Storage periods
Enquiries are deleted after 24 months of silence. Project and billing records are kept as long as tax law requires.
Protection
Only people who need personal data can reach it. Accounts use two-factor sign-in, and our providers encrypt data at rest and in transit.
Your rights
You can ask to see, correct, export or delete your data, or complain to the CNPD, Portugal's data regulator.
Transfers outside the EU
Some of our tools sit outside the EU. When data leaves the EEA, we rely on adequacy decisions or Standard Contractual Clauses.
Children's data
Our services are for businesses. We do not knowingly collect data from children, and we delete any that reaches us.
If this policy changes
If we change how we handle data, we will update this page and its date. Bigger changes get a notice on the site.
Questions?
Email [email protected] with any privacy question or data request.