Privacy policy
Last updated:
This policy explains what personal data Messagency Design handles, why, and how you can have it corrected or deleted. It covers this website and the demo websites we build.
Who is responsible
Messagency Design is a studio operated by Messagency, based in Porto, Portugal. For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679) we are the data controller for the processing described here.
You can reach us at info@messagency.net. We do not have a statutory data protection officer, and messages sent to that address are read by the people who run the studio.
What we collect from visitors to this website
Very little. This website sets no analytics cookies, no advertising pixels and no third party trackers. Our server keeps standard access logs.
- Access logs: IP address, page requested, time, browser identification. Kept for 30 days for security and troubleshooting, then deleted.
- Enquiry form: the name, email address, business name, website and message you type in. Nothing is pre filled and nothing else is read from your device.
- Security cookie: our network provider Cloudflare may set a short lived cookie to tell humans from automated traffic. It carries no advertising or profiling function.
Where the business details in a demo website come from
When we prepare a demo website for a business, the details in it come from the public business listing of that company: the trading name, the address, the telephone number, the category, the opening hours, the public rating and the number of public reviews. This is the same information any customer sees when they search for the business.
We do not buy contact lists, we do not scrape private accounts, and we do not process special categories of data. Where a listing shows a personal name, for example a sole trader trading under their own name, that name is personal data and everything in this policy applies to it.
Our legal basis
For preparing a demo and contacting a business about it, we rely on legitimate interests under Article 6(1)(f) GDPR: our interest in offering a relevant service, and the interest of a business in knowing that a ready made website exists for it.
We have weighed that against the rights of the people concerned. The data used is already public and business related, the volume held per business is small, the demo is not indexed by search engines, and there is a one step removal route described below. Where a person asks us to stop, we stop, and we record that request so it is not repeated.
For the enquiry form we rely on Article 6(1)(b), taking steps at your request before entering into a contract.
How long we keep things
- Server access logs: 30 days.
- Demo website and the business details inside it: until the business tells us to remove it, or 12 months after it was built without any response, whichever comes first.
- Enquiry messages: 24 months, so we can follow up a conversation you started.
- Objection and removal requests: kept indefinitely as a short suppression record, so we do not contact you again by mistake.
Who else sees the data
We keep the number of parties small and all of them process data on our instructions.
- Our hosting provider, on servers located in the European Union.
- Cloudflare, which sits in front of the website for security and delivery.
- An email delivery provider, used only to send and receive messages you send us.
- We do not sell data, and we do not share it for advertising.
Transfers outside the European Economic Area
Our servers are in the European Union. Where a provider we use processes data outside the EEA, that transfer is covered by the European Commission standard contractual clauses.
Your rights
Under the GDPR you can ask us to do any of the following, free of charge, and we answer within 30 days.
- Tell you what we hold about you or your business.
- Correct anything that is wrong.
- Delete it, including taking down a demo website.
- Object to our use of legitimate interests, which we accept without asking for a reason.
- Receive a copy of what you gave us in a portable format.
- Complain to the Portuguese supervisory authority, the Comissao Nacional de Proteccao de Dados, or to the authority in your own country.
Removing a demo website
Send one line to info@messagency.net with the link or the business name. We take the demo offline within one working day, delete the business details behind it, and confirm by email. No reason is required and nothing else is asked of you.
Changes to this policy
If we change how we work, we update this page and change the date at the top. Material changes are also sent by email to anyone who has an open enquiry with us.
Questions about this document go to info@messagency.net and are answered by a person.