Privacy

Privacy policy

Draft. The sections below are the ones the policy will have and the facts are the ones that already hold today; the final text is reviewed before the first signed contract. In the meantime, any request about your data is answered in writing.

1. Who handles the data

The controller, with its office in Lisbon, Portugal. The full identification (company name, registration number and registered office) is published here as soon as the company is registered. Contact for anything to do with data protection: ola@turma.studio.

2. What we collect, and when

From this site: whatever you write in the preview form — studio, city, public address, name, email, phone and what you teach.
From the server logs: IP address, date and time, page requested — the minimum needed to serve and protect the site.
From the platform, where we are a processor for a studio that is a customer: that studio's student data, which is theirs and not ours. Handling it is governed by the data processing agreement (DPA), not by this policy.

3. Why, and on what basis

To answer your request and build the preview (steps taken before a contract, and your explicit consent, given in the box on the form), and to keep the service secure (legitimate interest).

4. Cookies and statistics

This site uses no advertising cookies, no cross-site tracking and no social pixels. The only cookie that may be created is the form's security token (CSRF), without which the form cannot be submitted safely. If we ever count visits it will be with a cookie-free tool and only after you allow it — and that choice is stored in your browser, not in a cookie of ours.

5. Who we share it with

With the sub-processors the service needs to run — hosting, email delivery, error monitoring — all of them in the European Union. We do not sell or hand data to anyone for marketing. The list of sub-processors is sent on request.

6. How long we keep it

A preview request that does not lead to a contract is deleted after 12 months. Previews built from public pages are deleted after 30 days, or the same day if you ask. The server logs last weeks, not years.

7. Your rights

Access, correction, deletion, restriction, objection and portability. We answer a deletion request within 72 hours and the rest within the legal deadline. You can also complain to the Portuguese data protection authority (CNPD).

8. Changes

When this policy changes in any way that matters we tell every customer by email and date the version on this page.

Questions about how your students' data is handled belong to the data processing agreement, which we send on request before anything is signed.