How we use your data with complete transparency
PREÂMBULO
Whereas Studio58 (“Company”), a boutique architecture and design firm specializing in commercial interiors, design and build services, and visionary spaces for commercial clients, recognizes the fundamental importance of the right to privacy and protection of personal data of its clients, project stakeholders, vendors, employees and other individuals (“You” or “User”); whereas contemporary data protection legislation, including Brazil’s General Data Protection Law (LGPD), the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), establish complex and rigorous rights and obligations; whereas Studio58 collects, processes, stores and shares personal data through project management, client communications and business operations; the present Privacy Policy (“Policy”) establishes the terms, conditions, rights and obligations that govern the treatment of personal data by Studio58.
This Policy applies to all services and interactions with Studio58, including but not limited to: (a) its website at meetstudio58.com and associated domains; (b) direct client communications via email, phone and messaging; (c) project management platforms and design collaboration tools; (d) client proposals, contracts and project documentation; (e) video conferencing and virtual walkthroughs; (f) social media presence and marketing channels; and (g) any other means through which Studio58 collects, processes and shares personal data in its ordinary course of business.
By engaging with Studio58, providing personal data, or using our services, you explicitly accept and agree with all terms and conditions of this Privacy Policy. If you disagree with any provision contained herein, we request that you do not provide personal data to Studio58. Continued engagement following notification of changes to this Policy will constitute acceptance of the updated provisions.
1. DEFINITIONS AND INTERPRETATION
For purposes of this Policy, the following definitions apply throughout the document:
1.1 Personal Data means any information relating to an identified or identifiable natural person. A person is considered identifiable when they can be identified directly or indirectly, including by reference to name, identification number, contact information, online identifier, or one or more specific elements of their identity. Personal data includes: full names, business titles, email addresses, phone numbers, physical addresses, internet protocol addresses (IP), device identifiers, project preferences, financial information, identification documents and any other information that could reasonably identify an individual.
1.2 Sensitive Data or Special Category Data means personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health-related data, data relating to sexual life or sexual orientation, as well as criminal convictions. Sensitive data receives enhanced legal protection and its processing is subject to more severe restrictions.
1.3 Data Subject or Client means any natural person whose personal data is processed by Studio58, including project clients, design collaborators, vendors, stakeholders and other business contacts.
1.4 Data Controller or Responsible Party means the entity that determines the purposes and means of personal data processing. Studio58 acts as a data controller with respect to personal data collected in its ordinary business operations.
1.5 Data Processor means an entity that processes personal data on behalf of Studio58 under contract, acting solely under Studio58’s instructions.
1.6 Processing or Treatment means any operation performed on personal data, including collection, recording, organization, storage, use, disclosure, transmission, deletion or destruction.
1.7 Consent means a free, specific, informed and unambiguous manifestation of will through which a data subject agrees to the processing of their personal data, given in clear language and easily accessible form.
1.8 Legitimate Interest means a legal basis allowing an organization to process personal data for reasonable business purposes, provided such processing does not override fundamental rights and freedoms of the data subject.
1.9 Personal Data Breach means a security breach resulting in accidental or unlawful destruction, loss, alteration or unauthorized disclosure of personal data, creating significant risk to data subject rights and freedoms.
1.10 Project Data means personal data collected in connection with a specific architecture or design project, including client information, project stakeholders, vendor details and project-related communications.
2. LEGAL BASES FOR DATA PROCESSING
Studio58 processes personal data only when it has a valid legal basis compliant with applicable legislation. Legal bases vary according to the data subject’s jurisdiction.
2.1 Legal Bases Under Brazil's General Data Protection Law (LGPD)
LGPD establishes ten legal bases for lawful personal data processing, which Studio58 strictly observes:
Contract Execution: Processing is permitted when necessary to execute a contract with the data subject, including project agreements, design services contracts and related business arrangements.
Compliance with Legal Obligation: When required by applicable law, including tax obligations, employment law and regulatory requirements.
Protection of Vital Interests: When necessary to protect life, health or safety in emergency situations.
Legitimate Interest: Studio58 processes data when it has a legitimate business interest that does not override the data subject’s fundamental rights, including project management, vendor relations and business administration.
Pursuant to LGPD, Studio58 maintains documentation of the legal basis for each processing activity and can demonstrate such documentation to the National Data Protection Authority (ANPD) or the data subject upon request.
2.2 Legal Bases Under GDPR (European Union)
GDPR establishes six legal bases for lawful personal data processing:
Consent: Freely given, specific, informed and unambiguous consent, obtained prior to processing and presented in clear language.
Contract Performance: Processing necessary for performance of a contract to which the data subject is a party or for pre-contractual measures at the data subject’s request.
Legal Obligation: Processing necessary for compliance with legal obligations under EU or Member State law.
Vital Interests: Processing necessary to protect vital interests of the data subject or another natural person.
Public Interest: When processing is necessary for tasks carried out in the public interest or official authority (when applicable).
Legitimate Interests: Processing necessary for legitimate interests pursued by Studio58, provided data subject rights do not outweigh such interests. Studio58 conducts privacy impact assessments before processing under this basis.
2.3 Legal Bases Under CCPA/CPRA (California)
CCPA/CPRA allows companies to collect and process personal data from California residents for multiple business purposes, provided the company clearly discloses data use and respects consumer rights.
Service Provision: Collecting personal data to provide requested services, including design consultations, project management and construction administration.
Business Operations: Processing data for business administration, vendor management, accounting and legal compliance.
Security and Fraud Prevention: Processing to detect and prevent fraud and security threats against Studio58 and its clients.
Compliance with Law: Processing as required by applicable laws, regulations and legal processes.
3. PERSONAL DATA COLLECTED
3.1 Data Provided Directly by You
Studio58 collects personal data you voluntarily provide through various business interactions:
When you inquire about our services or request a consultation, we collect your name, email address, phone number, business name, project description and communication preferences to facilitate project discussions and proposals.
When you engage Studio58 for a project, we collect comprehensive information including your legal name, title, company affiliation, contact information, project address, specific design requirements, budget parameters, timeline expectations and any special accessibility or design needs.
When you participate in project collaboration, we collect data about your project preferences, design decisions, feedback and communication history to effectively manage the design and construction process.
When you authorize payments or submit financial information for invoicing, we collect billing address, payment method information and financial transaction details. Payment information is processed through certified third-party providers and is never stored directly by Studio58.
When you attend project meetings, walkthroughs or presentations, we may collect attendance records, notes about your preferences and any additional project-related information you share.
3.2 Data Collected Automatically
Studio58 automatically collects certain data when you interact with our services:
Website and Communication Data: IP address, browser type, pages visited, time spent on our website, referring source, device information and any forms you submit through our website.
Project Management Data: Information about your interaction with project timelines, design files accessed, collaborative comments and communication frequency within our project management systems.
Communication Metadata: Email open rates, link clicks in communications and response times to project inquiries.
3.3 Data from Third Parties
Studio58 may receive personal data from third-party sources in the course of business:
Vendor and Contractor Information: When vendors or contractors work on your project, we may receive their professional information, credentials and contact details.
Professional References: Professional organizations, licensing authorities or previous clients may provide information relevant to your project.
Professional References: Professional organizations, licensing authorities or previous clients may provide information relevant to your project.
Legal or Regulatory Entities: Permitting authorities, building departments or other regulatory bodies may provide information necessary for project compliance.
Studio58 may receive personal data from third-party sources in the course of business:
4. PURPOSES OF PROCESSING
Studio58 processes personal data for the following specific business purposes:
4.1 Project Delivery and Client Service
The primary purpose of data processing is to deliver exceptional design and architecture services. We process data necessary to understand project requirements, develop design solutions, manage construction administration, facilitate client communication and ensure successful project completion.
This processing is based on contract performance (GDPR Article 6(1)(b), LGPD contract execution basis, CCPA service provision purpose) and legitimate business interest in serving our clients professionally.
4.2 Project Management and Communication
We process data to maintain effective communication throughout the project lifecycle, including sending design updates, construction schedules, change order notifications and project status reports.
This processing is based on contract performance and legitimate interest in managing projects efficiently and keeping clients informed.
4.3 Consultation and Proposal Development
When you request consultation about potential projects, we process your information to develop project proposals, provide design recommendations and assess project feasibility.
This processing is based on legitimate interest in responding to client inquiries and developing business opportunities.
4.3 Consultation and Proposal Development
When you request consultation about potential projects, we process your information to develop project proposals, provide design recommendations and assess project feasibility.
This processing is based on legitimate interest in responding to client inquiries and developing business opportunities.
4.4 Financial Administration
We process financial data including invoicing information, payment records and transaction details for billing purposes, accounting compliance and financial record-keeping.
This processing is based on contract performance and legal compliance (tax and accounting obligations).
We process financial data including invoicing information, payment records and transaction details for billing purposes, accounting compliance and financial record-keeping.
4.5 Legal Compliance and Regulatory Obligations
We process personal data when required by applicable laws, including tax compliance, employment law, building permits and regulatory requirements.
This processing is based on legal compliance obligations.
4.6 Security and Risk Management
We process data to protect Studio58 and our clients against fraud, unauthorized access and security threats, as well as to investigate security incidents.
This processing is based on legitimate interest in protecting the business and client data.
4.7 Marketing and Business Development
With appropriate consent or based on legitimate interest, we may process data about past clients and professional contacts for informing them about new services, completed projects and relevant updates.
This processing is based on consent or legitimate business interest in client relations.
5. DATA RETENTION PERIODS
Studio58 retains personal data only as long as necessary for project delivery, legal compliance and business purposes:
Active Project Data: During project engagement and for 7 years following project completion, retained for potential warranty claims, dispute resolution and compliance documentation.
Financial Records: Invoice and payment records retained for 7 years for tax and accounting compliance.
Communication Records: Project-related communications and correspondence retained for 7 years following project completion.
Consultation and Proposal Data: Information from consultations not resulting in projects retained for 2 years for potential future business development.
Marketing Data: Contact information for past clients retained until consent withdrawal or 5 years of no engagement, whichever occurs first.
Website Data: Analytical data retained according to platform policies (typically 14 months for Google Analytics).
When data is no longer needed, Studio58 applies secure deletion procedures including data overwriting or physical destruction of records.
6. DATA SHARING AND DISCLOSURE
6.1 Service Providers and Project Collaborators
Studio58 engages third parties essential to project delivery, who process personal data under contract:
Studio58 engages third parties essential to project delivery, who process personal data under contract:
Project Collaborators: Consultants, engineers, landscape architects and other design professionals collaborating on your project receive project-related information necessary for their contributions.
Contractors and Vendors: General contractors, specialty contractors and material vendors receive client information, specifications and project details necessary for construction delivery.
Professional Service Providers: Accountants, attorneys and insurance providers receive information necessary for financial, legal and insurance administration.
Project Management Tools: We may use cloud-based project management platforms that store project data and client information.
Communication Platforms: We use email, video conferencing and messaging platforms that process communications.
All service providers are required to maintain confidentiality and process data only as instructed by Studio58.
6.2 Legal Requirements
Studio58 discloses personal data when required by law, court order or governmental authority, or when necessary to protect legal rights and prevent fraud.
6.3 Business Transfer
If Studio58 is involved in merger, acquisition or sale of business assets, personal data may be transferred as part of such transaction. We will provide notice to affected individuals before data becomes subject to a different privacy policy.
6.4 Anonymized Data
Studio58 may share anonymized project data for case studies, portfolio documentation or industry publications without identifying clients, unless explicit consent is obtained.
7. DATA SUBJECT RIGHTS
7.1 Rights Under GDPR (European Residents)
European Union residents have the following rights under GDPR:
Right of Access: You may request confirmation of whether personal data is being processed and obtain a copy of your personal data with detailed processing information.
Right of Rectification: You may request correction of inaccurate or incomplete personal data.
Right of Deletion: You may request deletion of personal data under specific circumstances, including when data is no longer necessary or when you withdraw consent.
Right of Restriction: You may request restriction of processing under certain circumstances.
Right of Data Portability: You may request personal data in a structured format for transfer to another controller.
Right of Objection: You may object to processing based on legitimate interests, including for marketing communications.
Rights Regarding Automated Decision-Making: You have rights regarding decisions made solely by automated means.
Right to File a Complaint: You may file a complaint with your national data protection authority if you believe your rights have been violated.
To exercise these rights, contact [email protected] or visit https://meetstudio58.com/data-subject-requests.
7.2 Rights Under LGPD (Brazilian Residents)
Right of Access: You may request confirmation of data processing and access to your personal data.
To exercise these rights, contact [email protected] or visit https://meetstudio58.com/data-subject-requests.
Right to File a Complaint: You may file a complaint with ANPD at https://privacycenter.cytrio.com/studio58-jlv2a2.
Right of Objection: You may object to processing based on legitimate interests.
Right of Portability: You may request personal data in portable format.
Right of Blocking: You may request blocking of unnecessary or excessive data.
7.3 Rights Under CCPA/CPRA (California Residents)
California residents have the following rights under CCPA/CPRA:
Right to Know: You may request disclosure of the categories and specific pieces of personal data collected, sources of collection, purposes of processing and recipients.
Right to Delete: You may request deletion of personal data, with certain exceptions for legal obligations.
Right to Correct: You may request correction of inaccurate personal data.
Right to Opt-Out: You may opt out of any sale or sharing of personal data (Studio58 does not sell personal data).
Right to Limit: You may request limitation of use of sensitive personal information.
Right to Non-Discrimination: You cannot be discriminated against for exercising your privacy rights.
Right to File a Complaint: You may file a complaint with the California Privacy Protection Agency (CPPA) or the California Attorney General.
To exercise these rights, contact [email protected] or visit https://meetstudio58.com/data-subject-requests.
8. COOKIES AND TRACKING TECHNOLOGIES
Studio58 uses cookies and tracking technologies primarily for website analytics and security:
Strictly Necessary Cookies: Essential for website functionality, including security features and session management.
Analytics Cookies: Google Analytics to understand website traffic patterns and user behavior.
Preference Cookies: To remember your language and browsing preferences.
You may control cookie settings through your browser. However, disabling certain cookies may impact website functionality.
Studio58 complies with cookie consent requirements by obtaining explicit consent from European Union and Brazilian residents before implementing non-essential cookies.
9. SECURITY AND DATA PROTECTION
9.1 Technical Security Measures
Studio58 implements security measures to protect personal data against unauthorized access, alteration or disclosure:
Encryption: Data in transit is encrypted using TLS protocol version 1.3 or higher. Data in storage is encrypted using industry-standard algorithms.
Access Controls: Personal data access is restricted to authorized employees on a need-to-know basis. Multi-factor authentication is required for sensitive systems.
Firewalls and Network Protection: Infrastructure is protected by firewalls and intrusion detection systems.
Security Updates: All systems are regularly updated with security patches.
Vulnerability Testing: Third-party security assessments are conducted regularly.
9.2 Administrative Measures
Data Protection Policies: Detailed internal policies govern data handling and security procedures.
Employee Training: Employees handling personal data receive security and privacy training.
Confidentiality Agreements: All employees and contractors sign confidentiality agreements.
Vendor Management: Third-party processors are required to maintain appropriate security standards and execute data processing agreements.
10. DATA BREACH NOTIFICATION
If Studio58 discovers a personal data breach resulting in significant risk to data subjects, we will notify affected individuals and regulatory authorities as required by applicable law, typically within 72 hours of discovery.
11. THIRD-PARTY LINKS AND SERVICES
Studio58’s website may contain links to third-party websites and services. This Privacy Policy does not apply to third parties. We recommend reviewing their privacy policies before providing personal data to third parties.
12. JURISDICTION-SPECIFIC INFORMATION
12.1 Information for GDPR Residents (European Union)
Studio58 processes personal data of European residents only with valid legal bases. European residents have extensive rights under GDPR including access, correction, deletion, portability and objection rights detailed in Section 7.1 above.
Studio58 provides transparency information including data controller identity, processing purposes, legal basis, data recipient categories and data retention periods when collecting data from European residents.
12.2 Information for LGPD Residents (Brazil)
Studio58 processes personal data of Brazilian residents according to LGPD requirements. Brazilian residents have rights under LGPD detailed in Section 7.2 above.
Studio58 maintains documentation of the legal basis for each processing activity and can provide this documentation to ANPD or the data subject upon request.
12.3 Information for CCPA/CPRA Residents (California)
Studio58 complies with CCPA/CPRA requirements including consumer rights disclosed in Section 7.3 above.
Studio58 does not sell or share personal data for cross-context behavioral advertising. Studio58 honors “Do Not Track” signals and Global Privacy Control (GPC) requests.
13. POLICY UPDATES
Studio48 may update this Privacy Policy to reflect changes in business practices, legal requirements or technology. When significant changes are made, Studio58 will provide notice through email or website notification.
Continued engagement with Studio58 following notification of policy changes constitutes acceptance of the updated Policy.
14. CONTACT INFORMATION
For questions or requests regarding this Privacy Policy:
Email: [email protected]
Data Request Portal: https://meetstudio58.com/data-subject-requests
Website: https://meetstudio58.com
Studio58 will respond to inquiries within 5 business days and process data requests according to legal timelines (30-45 days for GDPR/CCPA; 15-30 days for LGPD).
If you are unsatisfied with Studio58’s response, you may file a complaint with your relevant data protection authority.
ACCEPTANCE
By engaging with Studio58 or providing personal data, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.
This Policy is a legally binding document. Rights under GDPR, CCPA/CPRA and LGPD cannot be waived or limited through contractual agreement.
Studio58 Privacy Policy Version 1.0
Last Updated: November 7, 2025
Effective Date: January 1, 2025
Studio58 | Architecture & Design
[email protected] | https://meetstudio58.com