Privacy Policy

Who is responsible

People by Design is the controller for personal data collected through this website. For any question about this policy or to exercise your rights, contact us at the address in the Contact section below.

What we collect

We collect only what you send us. There is no account, no login and no profile.

• Diagnostic request form: name, work email, company, job title, company size, growth stage, current People team, selected challenges, urgency and any message you write.
• Anti-spam signals: a Cloudflare Turnstile token and the time taken to complete the form, used to distinguish people from bots. These are not used to profile you.
• Aggregate analytics, where enabled: pages viewed and events such as a form being started or submitted. This is measured in aggregate and is not used to identify individuals.
• Server logs kept by our hosting provider, which may include IP address and user agent, retained for security and reliability.

Why we process it

• To respond to your enquiry and assess whether we can help. Legal basis: steps taken at your request prior to entering into a contract, and our legitimate interest in responding to business enquiries.
• To protect the form from automated abuse. Legal basis: our legitimate interest in keeping the service available.
• To understand, in aggregate, which pages are useful. Legal basis: legitimate interest where measurement is cookieless, or your consent where a cookie-based provider is used.

Who we share it with

We do not sell personal data and we do not share it for advertising. We use a small number of processors that handle data on our instructions:

• Our hosting provider, which serves this website.
• Resend, which delivers the notification email generated by the form.
• Cloudflare, which provides the Turnstile anti-spam check.
• Sanity, which stores the editorial content of the Insights section. It holds no data about site visitors.
• A CRM system, only where one is configured for this deployment, storing the details you submitted so that we can follow up.

How long we keep it

• Enquiries that do not lead to a conversation are deleted within 12 months.
• Enquiries that lead to a commercial relationship are retained for the duration of that relationship and for as long as required afterwards by accounting and legal obligations.
• Server logs are retained by our hosting provider for a short period, typically no more than 30 days.

Where data is processed

We prefer processors that store data within the European Union. Where a processor operates outside the EU, the transfer relies on an adequacy decision or on Standard Contractual Clauses.

Your rights

Under the GDPR you can request access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest. Write to us and we will respond within one month.

If you are not satisfied with our response, you can lodge a complaint with the Portuguese data protection authority (CNPD) or with the supervisory authority in your country of residence.

Contact

Questions about this policy, or a request relating to your data, can be sent to the email address published in the footer of this site.