Privacy
Policy.

Not That Simple is a technology studio based in Portugal, building custom software, automation, IoT and artificial intelligence solutions. For the purposes of data protection law, we are the controller of the personal data collected through this website.

You can reach us about this policy at any time at hello@notthatsimple.net.

We only collect the data we need to respond to you and deliver our services. Specifically:

• Data you give us through the contact form: your name, email address, company name (optional), project type and the message you write.
• Communication data: the content of the messages you exchange with us by email or phone.
• Limited technical data: information provided by your browser (such as IP address and device type) and security logs generated when you submit the form, including the anti-bot verification.

We process your personal data only for specific purposes, each with a legal basis:

• To respond to your enquiry and follow up on the conversation, based on our legitimate interest in replying to people who contact us and on pre-contractual steps taken at your request.
• To send you a confirmation email, so you know we received your request.
• To prevent spam and abuse through anti-bot verification, based on our legitimate interest in protecting the service.
• To comply with legal obligations, where applicable.

This website is intentionally lightweight. We don't use advertising or cross-site tracking cookies, and we never sell your data to anyone.

Strictly necessary technologies may be used for the site to work and stay secure, such as the form's anti-bot verification. These are not used to profile you.

We don't sell or rent your data. We share it only with trusted providers that help us run the service, and always limited to what is necessary:

• Email delivery providers, to send your confirmation and manage our correspondence.
• Infrastructure and hosting providers that serve this website.
• An anti-bot verification service that protects the form from automated submissions.
• Public authorities, only where required by law.

We keep your contact data only for as long as needed to respond and, if we move forward together, to manage the relationship. When it's no longer needed, we securely delete or anonymise it.

We may retain some information for longer where the law requires it.

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Ask us to delete your data ("right to be forgotten").
• Object to or request restriction of certain processing.
• Request portability of your data.
• Lodge a complaint with the competent supervisory authority, in Portugal the CNPD.

We take security seriously. We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure, including encrypted connections and restricted access to information.

No system is infallible, but we treat your data with the same care we put into everything else we build.

Some of our providers may process data outside the European Economic Area. When that happens, we ensure appropriate safeguards are in place, such as the Standard Contractual Clauses approved by the European Commission.

We may update this policy to reflect changes in our services or in the law. When we do, we'll update the date at the top of this page. Significant changes will be communicated clearly.