Privacy Policy

Who is responsible

Operating by Design is responsible for the personal data collected through this website. For any question about this policy or to exercise your rights, write to the contact email shown in the footer.

What we collect

We collect the details you send us, the page and form from which you make an enquiry and, with your analytics consent, the campaign that brought you here. There is no account, no login and no profile.

• Operating Assessment form: name, email and company are required. Company website, company size, your main challenge and a description of the situation are optional.
• Enquiry origin: the page and form used, plus a random enquiry reference for matching delivery with a successful submission. With analytics consent, we also keep the entry page and campaign parameters for the current tab session and include them in the enquiry. No full query string is stored.
• Anti-spam signals: a verification token and the time taken to complete the form, used to distinguish people from bots. These are not used to profile you.
• Analytics, where enabled and accepted: pages viewed, interactions and events such as a form being started or submitted. Campaign measurement from the advertising platforms we use can also attribute a successful request to an ad, using limited click, browser and request data. Session replay masks form inputs. Form contents and contact details are not sent for analytics or campaign measurement.
• Server logs kept by our hosting provider, which may include IP address and user agent, kept for security and reliability.

Why we process it

• To respond to your enquiry and assess whether we can help. Legal basis: steps taken at your request prior to entering into a contract, and our legitimate interest in responding to business enquiries.
• To protect the forms from automated abuse. Legal basis: our legitimate interest in keeping the service available.
• To understand, in aggregate, which pages are useful. Legal basis: legitimate interest where measurement is cookieless, or your consent where a cookie-based provider is used.
• To understand whether an advertising campaign led to a successful request. Legal basis: your consent.

Free resource requests

When you request a free resource, we record your email address, the resource, language, request date and origin in our website submissions system. This lets us manage the access you requested. The file becomes available on the page once the request is recorded. This does not subscribe you to marketing or request a sales conversation, and no automatic email is sent.

A necessary, signed access cookie allows the requested resource and language to be downloaded for 30 minutes. It contains no email address. Resource views, form interactions and successful downloads are measured only with analytics consent, without contact details.

Who we share it with

We do not sell personal data or share it for another party’s own marketing. We use a small number of processors that handle data on our instructions:

• Our hosting provider, which serves this website.
• An email delivery provider, which delivers the notification generated by the form.
• A workspace tool (Notion), which records website enquiries and free resource requests so we can follow up.
• A spam protection provider, which runs the anti-bot check on the forms.
• A content management system, which stores the editorial content of the Insights section. It holds no data about site visitors.
• A product analytics provider, only where you accept analytics, which provides usage analytics, heatmaps and session replay with form inputs masked.
• Advertising platforms, only where you accept measurement, which attribute page views and successful requests to their campaigns. They may receive a click reference, a browser reference, IP address and browser user agent. Advanced matching is not enabled.
• A CRM system, only where one is configured for this deployment, storing the details you submitted so that we can follow up.

How long we keep it

• Enquiries and resource requests are kept only for as long as needed to respond and follow up on the enquiry.
• Where an enquiry leads to a commercial relationship, the related details are kept for the duration of that relationship and for as long as accounting and legal obligations require afterwards.
• Server logs are kept by our hosting provider for a short period, for security and reliability.

Where data is processed

We prefer processors that store data within the European Union. Where a processor operates outside the EU, the transfer relies on an adequacy decision or on Standard Contractual Clauses.

Your rights

Under the GDPR you can request access to your data, correction, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest. Write to us and we will respond within one month.

If you are not satisfied with our response, you can lodge a complaint with the Portuguese data protection authority (CNPD) or with the supervisory authority in your country of residence.

Contact

Questions about this policy, or a request relating to your data, can be sent to the contact email shown in the footer of this site.