Privacy Policy

IMPERVIOUS CIRCLE - LDA, trading as The Kitchen Projects, at Avenida da República 13, 2825-399 Costa de Caparica, Portugal, is the controller for personal data processed in connection with this website and enquiries addressed to the company. Privacy requests can be sent to the email address below.

The current public website has no contact form, account registration, newsletter signup, checkout or file-upload feature. It does not ask visitors to submit personal data through the website.

When you email us separately, your message may include your email address, name, message content and any attachments or other information you choose to provide. Please avoid sending unnecessary sensitive personal data.

Loading the website, its images and its externally hosted fonts involves network requests that disclose technical information such as your IP address and browser request headers to the relevant service. The hosting provider may process access or security logs; its exact logging configuration has not been confirmed.

Enquiries are processed to respond to your request. Where an enquiry concerns entering into or performing a contract with you, the legal basis is Article 6(1)(b) GDPR. For other business correspondence, the basis is our legitimate interest in responding to communications under Article 6(1)(f), subject to your rights and interests.

Technical processing necessary to deliver and protect the website is based on the legitimate interest in providing a functioning, secure website under Article 6(1)(f). Processing required by a specific legal obligation relies on Article 6(1)(c) where that obligation applies.

The company must review whether the current external-font setup requires consent or an alternative configuration. No consent-based marketing or analytics feature was identified in the current website code.

Personal data should be kept only as long as necessary for the relevant purpose, subject to applicable statutory retention duties and the establishment, exercise or defence of legal claims. Data should then be deleted or anonymised.

Exact retention periods for correspondence, hosting logs and diagnostic records have not been supplied or verified. The company must confirm its actual deletion practices and relevant statutory periods; no specific retention period is asserted here.

Google Fonts: the website loads Instrument Serif and JetBrains Mono through fonts.googleapis.com and fonts.gstatic.com. Your browser connects directly to Google to obtain these files, exposing technical request data such as your IP address. Google's own privacy information is linked below.

Image delivery: photographs use same-origin asset paths managed through Lovable Assets rather than direct links to third-party image websites. The company must confirm the underlying delivery provider, contractual role, processing location and technical logging practices.

Hosting and email: the website's production hosting arrangements and the provider handling company email must be confirmed. These providers may process technical requests or correspondence on the company's behalf.

The code contains error-reporting hooks for Lovable's editor preview, which may report an error message, stack trace and page path when preview tooling is present. No separate public-site analytics integration was identified. The company must confirm whether any diagnostics or additional scripts operate on the published website.

Provider legal identities, processor agreements, sub-processors, international transfers and any applicable transfer safeguards have not been verified. Where data leaves the EEA, the company must establish an applicable GDPR transfer mechanism and explain how to obtain information about the safeguards.

No advertising, analytics or cookie-setting integration was identified in the current application code. A check of the local website found no cookies or local/session storage entries. This check does not establish the behaviour of a future published version or of independent linked websites.

External font and image requests still transmit technical request information even without cookies. Any non-essential tracking introduced later must be assessed and this policy updated, with consent obtained where required.

The Complaints Book link opens an independent website in a new tab only when selected. Its own privacy and cookie policies then apply.

Subject to the conditions in the GDPR, you may request access to your personal data, rectification of inaccurate data, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation.

Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. No solely automated decision-making producing legal or similarly significant effects was identified in the current website functionality.

To exercise your rights, contact us below. We may request proportionate information to verify your identity. Requests are normally answered within one month; where the GDPR permits an extension, we will explain the reason within that initial period.

You may also lodge a complaint with a supervisory authority, including Portugal's Comissão Nacional de Proteção de Dados (CNPD), or the authority in the EU country where you live, work or believe an infringement occurred.

Please address privacy questions and rights requests to IMPERVIOUS CIRCLE - LDA at the email below or at Avenida da República 13, 2825-399 Costa de Caparica, Portugal.

Before publication, the company should confirm hosting and email providers; image-delivery arrangements; access and diagnostic logs; retention and deletion schedules; provider contracts; international transfers and safeguards; and the legal basis for external font delivery. It should also assess whether a data protection officer is required and, if one is appointed, provide their contact details.

This policy reflects the functionality inspected on 20 October 2026. Unconfirmed operational details are explicitly identified above. It is not a certification or verification of legal compliance.