Privacy Policy

Last updated: 9 April 2026

This Privacy Policy explains how Curious Souls ("we", "us", or "our") collects, uses, and protects your personal data when you visit our website at curioussouls.io and use our contact form.

Curious Souls is operated by Amber Sutera, based in Portugal. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Portuguese data protection law (Lei n. 58/2019).

1. Data Controller

The data controller responsible for your personal data is:

Curious Souls
Amber Sutera
Portugal
Email: hello@curioussouls.io

2. Data We Collect

We collect only the personal data you voluntarily provide through our contact form:

Name - to address you personally in our response
Email address - to reply to your inquiry
Message content - to understand your inquiry and provide a relevant response

We do not use cookies, analytics trackers, or any third-party tracking scripts on this website. We do not collect data automatically beyond what is technically necessary for the website to function (e.g., server logs maintained by our hosting provider).

3. Legal Basis for Processing

We process your personal data based on:

Your consent (Article 6(1)(a) GDPR) - by voluntarily submitting the contact form, you consent to us processing your data for the purpose of responding to your inquiry.
Legitimate interest (Article 6(1)(f) GDPR) - to respond to business inquiries and evaluate potential client engagements.

4. How We Use Your Data

Your personal data is used exclusively to:

Respond to your inquiry
Evaluate potential business engagements
Maintain records of our business communications

We will never sell, rent, or share your personal data with third parties for marketing purposes.

5. Data Processors

Your contact form submissions are processed through the following service:

Netlify, Inc. (San Francisco, USA) - website hosting and form processing. Netlify processes form submissions on our behalf under a Data Processing Agreement. Netlify's privacy policy: netlify.com/privacy

Data transfers to the United States are conducted in compliance with appropriate safeguards under GDPR Chapter V, including Standard Contractual Clauses (SCCs).

6. Data Retention

We retain your personal data for the following periods:

Contact form submissions: retained for up to 12 months after your last communication with us, unless a business relationship is established, in which case data is retained for the duration of the engagement plus any legally required retention period.
Server logs: maintained by Netlify according to their retention policy, typically no more than 30 days.

After the retention period, your data is permanently deleted.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15) - request a copy of your personal data
Right to rectification (Art. 16) - request correction of inaccurate data
Right to erasure (Art. 17) - request deletion of your data ("right to be forgotten")
Right to restriction (Art. 18) - request limitation of processing
Right to data portability (Art. 20) - receive your data in a structured, machine-readable format
Right to object (Art. 21) - object to processing based on legitimate interest
Right to withdraw consent (Art. 7(3)) - withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal

To exercise any of these rights, contact us at hello@curioussouls.io. We will respond within 30 days.

8. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Portuguese supervisory authority:

CNPD - Comissao Nacional de Protecao de Dados
Av. D. Carlos I, 134, 1.o
1200-651 Lisboa, Portugal
Website: www.cnpd.pt

9. Security

We take appropriate technical and organizational measures to protect your personal data, including:

SSL/TLS encryption for all data in transit
Hosting on Netlify's secure, enterprise-grade infrastructure
Spam protection via honeypot fields (no CAPTCHA or third-party tracking)

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

11. Governing Law and Jurisdiction

This Privacy Policy is governed by Portuguese law. Any disputes arising from or in connection with this policy shall be submitted to the exclusive jurisdiction of the courts of Lisbon, Portugal.

12. Contact

For any questions about this Privacy Policy or your personal data, contact us at:

Email: hello@curioussouls.io
Website: curioussouls.io