Privacy Policy

Personal data reaches us through one channel only, the contact form. Submitting it sends us:

• Your name
• Your work email address
• Your phone number, if you choose to add it
• Your company
• The discipline you are interested in and, optionally, a budget range
• Your message
• The date and time you sent it

Your name, email, company, discipline and message are needed for us to reply. Without them we cannot handle your enquiry. Phone and budget are optional.

This site shows no advertising and builds no visitor profiles. We do not sell your data or pass it to anyone for their own commercial use.

We use these details to reply to you and, if we end up talking about a project, to assess it and prepare a proposal. They are used for nothing else, and we will not subscribe you to newsletters or marketing lists.

We use the form data to reply to your enquiry and, where relevant, to prepare a proposal. These are steps taken at your request before a possible contract (Article 6(1)(b) GDPR). When a message is not about a project, we rely on our legitimate interest in replying to people who contact us (Article 6(1)(f) GDPR). The technical data described below is processed on the basis of our legitimate interest in keeping the site secure and working. You can object to any processing based on legitimate interest.

Nobody outside the Angry Panda Productions team reads your message. Three service providers process data on our behalf to run the site and handle the form:

• Vercel Inc.: hosts the website and serves its content.
• Resend (Plus Five Five, Inc.): sends the email that the form produces and keeps a copy of each one for up to 30 days.
• Proton AG: provides the encrypted mailbox in which we receive and answer your enquiry.

Vercel and Resend are US companies. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission found adequate in Implementing Decision (EU) 2023/1795, and our contracts with them also include the Commission's Standard Contractual Clauses. Resend sends the email from servers in Ireland. Proton is in Switzerland, which the European Commission recognises as offering an adequate level of data protection. You can ask us for a copy of the safeguards that apply.

Like any website, we receive your IP address and the data your browser sends with each request, such as browser type, the page requested, and the date and time. We use it to serve pages, stop abuse of the form and fix errors. From the IP address our host tells us your country, which we use only to suggest the site language and phone prefix. We do not store the country or link it to you. These logs stay with our host for a short period and are then deleted automatically.

We make no automated decisions and build no profiles from your data.

We keep contact messages for 12 months after our last exchange with you and then delete them. The copy held by our email delivery provider is deleted after 30 days. If you became a client in that time, we keep what the law requires for accounting and tax purposes, for as long as it requires.

No advertising or behavioural tracking cookies are used here, so you will not see a consent banner. We set at most one cookie, and only if you change the language:

• NEXT_LOCALE: stores the language you picked with the PT/EN switch, so the site stays in that language while you browse. It is set only when you use the switch, is a session cookie deleted when you close your browser, is read only by our site and contains nothing that identifies you.

You can ask us at any time for access to your data, to correct or delete it, to restrict or object to its processing, or to receive it in a portable format. Send us an email and we will reply within one month at most.

If you think we are mishandling your data, you can complain to Portugal's data protection authority, the Comissão Nacional de Protecção de Dados (CNPD), at www.cnpd.pt, or to the supervisory authority in the country where you live.

The whole site runs over HTTPS and enforces a strict content security policy. Form messages travel over encrypted connections and land in an encrypted mailbox that only our team can open.

When our handling of personal data changes, we revise this page and the date shown at the top.