Privacy Policy

Last updated: 22 April 2026

This Privacy Policy explains how Benjamin Wegener, trading as ghosted.studio ("we", "us"), collects, uses, and protects personal data in connection with the website ghosted.studio and related services (the "Services"). It applies to visitors and users worldwide.

1. Data controller

The data controller responsible for the processing of your personal data is:

Benjamin Wegener (ghosted.studio)
AV DO INFANTE, N 8 — 2K
9000-015 Funchal, Madeira, Portugal
VAT ID: PT311119131
Contact: legal@ghosted.studio

2. Scope

This policy describes processing carried out directly by ghosted.studio. Where the Services link to or embed third-party services, the privacy practices of those third parties apply to their processing of your data.

3. Personal data we collect

We process the following categories of personal data:

a. Data you provide to us

  • Contact enquiries. When you contact us via email or any contact form, we process the information you submit, typically your name, email address, and the content of your message.
  • Project enquiries. When you enquire about paid or contract work, we additionally process any project information you provide, such as company name, scope, budget, and timelines.
  • Newsletter subscription. When you subscribe to our newsletter, we process your email address and the timestamp of your subscription. A double opt-in procedure is used where required by law.

b. Data collected automatically

  • Server logs. When you access the Services, our hosting provider automatically records technical information including IP address, user agent, referrer, requested URL, and timestamp. These logs are used to ensure security and operational integrity.
  • Cookies and similar technologies. The Services use strictly necessary cookies required for the site to function. Any non-essential cookies or analytics technologies will only be set after you have given prior consent via the applicable mechanism.

4. Purposes and legal bases of processing (GDPR)

Where the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") applies, we rely on the following legal bases:

  • Responding to your enquiries — Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in communicating with prospects and contacts).
  • Performing and administering contracts — Art. 6(1)(b) GDPR (performance of a contract).
  • Newsletter — Art. 6(1)(a) GDPR (your consent), which you may withdraw at any time with effect for the future.
  • Server logs and security — Art. 6(1)(f) GDPR (our legitimate interest in the security and operational integrity of the Services).
  • Legal compliance — Art. 6(1)(c) GDPR (compliance with a legal obligation), such as tax, accounting, or statutory record-keeping requirements.

5. Recipients and processors

We do not sell or rent personal data. Personal data may be shared with the following categories of recipients, under appropriate contractual safeguards (including data processing agreements where required):

  • Hosting and infrastructure providers operating the Services;
  • Email and newsletter delivery providers;
  • Professional advisors (accountants, lawyers) where legally necessary;
  • Public authorities where required by law.

6. International transfers

Where personal data is transferred outside the European Economic Area (EEA), we rely on transfer mechanisms recognised under the GDPR, including European Commission adequacy decisions or Standard Contractual Clauses (SCCs), and we implement supplementary measures where appropriate.

7. Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

  • Enquiry correspondence: up to 24 months after the last contact, unless a contract is concluded;
  • Contract-related data: for the duration of the contract and the statutory retention periods under Portuguese tax and commercial law (typically up to 10 years);
  • Newsletter data: until you unsubscribe or withdraw consent;
  • Server logs: typically up to 30 days, unless longer retention is necessary to investigate a security incident.

8. Your rights under the GDPR

Subject to the conditions of the GDPR, you have the right to:

  • Access your personal data (Art. 15 GDPR);
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR);
  • Erasure of your personal data (Art. 17 GDPR);
  • Restriction of processing (Art. 18 GDPR);
  • Data portability (Art. 20 GDPR);
  • Object to processing based on legitimate interests, including direct marketing (Art. 21 GDPR);
  • Withdraw consent at any time, without affecting prior lawful processing (Art. 7(3) GDPR).

To exercise any of these rights, please contact legal@ghosted.studio. You also have the right to lodge a complaint with a supervisory authority, in particular the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD) or the authority of the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

9. California residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), grants you certain rights, including the right to know what personal information is collected about you, the right to request deletion or correction of your personal information, the right to opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising these rights.

We do not sell or share personal information as those terms are defined under the CCPA. To exercise your rights, please contact legal@ghosted.studio.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage, however, is completely secure, and we cannot guarantee absolute security.

11. Children

The Services are not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available at this URL. Where the changes are material, we will take reasonable steps to notify you, for example by a prominent notice on the website or by email where we have a suitable address.

13. Contact

For any questions concerning this Privacy Policy or our processing of your personal data, please contact:

Benjamin Wegener (ghosted.studio)
AV DO INFANTE, N 8 — 2K
9000-015 Funchal, Madeira, Portugal
legal@ghosted.studio