Legal

Privacy Policy

Last updated: 15 October 2026

We keep this simple. Our website doesn’t use tracking cookies or analytics, and we only handle your personal data when you choose to contact us. This page explains what we collect, why, and the rights you have under the EU General Data Protection Regulation (GDPR).

Who we are

The data controller for this website is:

We are a small company and have not appointed a Data Protection Officer. For any privacy question, write to us at the address above.

What we collect, and why

When you contact us. The contact form asks for your name, work email, company, sector and a short message. When you press “Send message”, these details are sent to us by email through our form provider, Formspree (see below). You can also write to us directly instead.

We use these details to reply to you and, if you wish, to discuss and prepare a possible project. The legal basis is the steps you ask us to take before entering into a contract (GDPR Article 6(1)(b)) and our legitimate interest in answering business enquiries (Article 6(1)(f)).

When you simply visit the site. We don’t use analytics, advertising or tracking cookies, and we don’t build profiles of visitors. Some technical data is processed automatically, as explained below.

Third-party services the site loads

To display the page, your browser connects to a couple of outside services. Like any web request, this shares your IP address and basic browser information with them:

• Google Fonts (Google Ireland Ltd.) provides the typefaces used on the site. See Google’s privacy policy.
• Netlify (Netlify, Inc., United States) hosts this website. It may keep standard server logs, such as IP address, date and page requested, for security and to keep the site running. See Netlify’s privacy policy.

The legal basis for this is our legitimate interest in displaying a working, secure website (Article 6(1)(f)).

Cookies and local storage

We don’t set any cookies. If you switch between the light and dark theme, your browser remembers that choice in its local storage on your own device. It’s never sent to us, and you can clear it at any time in your browser settings.

Who we share your data with

We don’t sell or rent your personal data. Messages sent through the contact form pass through Formspree (Formspree, Inc., United States), which delivers them to our inbox and processes them on our behalf; see Formspree’s privacy policy. Emails are then stored by our email provider, email provider, which also processes them on our behalf. We only share your details with anyone else if the law requires it.

Some of the providers above may process data outside the European Economic Area. When that happens, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

How long we keep it

We keep your messages for as long as we need them to answer you and follow up on a possible project. If no business relationship follows, we delete them after retention period, e.g. 24 months. If you become a client, we keep the related correspondence for as long as the law requires, for example for accounting and tax purposes.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have it corrected if it’s wrong, or deleted;
• restrict or object to how we use it;
• receive it in a portable format.

To use any of these rights, email contact@m2hl.net. We’ll reply within one month.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

Changes to this policy

If we change how we handle personal data, we’ll update this page and the date at the top.