Privacy and Data Protection Policy
25 August 2026
Document under review. This base text needs legal validation and the controller details filled in before final publication.
1. Who controls the data
KOJASTUDIO.CO is the controller of personal data processed through this site. [CONFIRM: legal entity, registration and data protection contact.]
2. What we collect
We collect only what you enter in the forms: name, company, email and, optionally, phone, plus the message itself. We do not request sensitive data and ask that it not be included in messages.
We also collect browsing data through analytics tools, such as pages visited, traffic source and technical device information. [CONFIRM: list the tools actually installed and the matching cookie policy.]
3. Why we use it
Data is used to:
- Respond to enquiries and prepare proposals
- Deliver contracted services
- Understand site usage and improve its structure and content
- Meet applicable legal obligations
4. Legal basis
Processing relies on the consent given when submitting the form, on performance of a contract or pre-contractual steps, and on legitimate interest for site analysis and improvement. We handle requests from data subjects under both GDPR and Brazil’s LGPD.
5. Sharing and international transfers
Data may be shared with providers required to run the operation, such as hosting, analytics tools and customer relationship systems, always limited to the stated purpose. Some of these providers are located outside the data subject’s country, which constitutes an international transfer. [CONFIRM: list the processors used and the safeguards applied.]
6. How long we keep it
Contact data is kept for as long as needed to handle the enquiry and, where a contract exists, for the period required by applicable law. Once the purposes end, data is deleted or anonymised. [CONFIRM: define concrete retention periods.]
7. Your rights
You may request confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about sharing, and withdrawal of consent. To exercise any of these rights, use the channel listed on the contact page.
8. Security
We apply technical and organisational measures to protect data against unauthorised access, loss or improper alteration, including access control to tools and encrypted transmission on this site.
9. Changes
This policy may be updated. The date at the top indicates the current version.