Last updated: 24 September 2026. This policy applies when you visit this site, contact us, complete a survey or reflection tool, subscribe, book or use our services. We process personal data under the EU General Data Protection Regulation (GDPR) and applicable Portuguese data-protection and ePrivacy law.
1. Who is responsible for your data?
The controller is A Creative Block, operated by Mirco Fragomena, an independent professional based in Portugal. NIF / tax number: 309931843. Registered address: Rua Clemente Menéres 31, 2.º trás, 4050-202 Porto, Portugal (for legal and tax purposes; we work from Lisbon and online). Contact: [email protected].
2. Information we collect
- Contact information such as your name and email address.
- Your audience type, message and other information you submit through a contact form, email, booking or proposal process.
- The date, source and status of your enquiry and any optional newsletter consent.
- Contract, scheduling, payment and invoice information.
- Brief working notes and information you voluntarily share during a professional relationship.
- Survey responses where the purpose is explained at collection.
- Technical and usage information such as browser, device, pages visited, approximate location, referrer and performance data, depending on the service and your cookie choice.
Required form fields are marked or technically required because we need them to reply or provide the requested service. Optional fields and marketing consent may be left blank without affecting an enquiry or service.
3. Why we use information and our legal bases
- Enquiries: to reply and take steps you request before entering a contract, and for our legitimate interest in managing professional communications.
- Services: to arrange and deliver the agreed work, administer the relationship and process payment under a contract.
- Accounting and compliance: to meet tax, accounting and other legal obligations.
- Research and improvement: to understand patterns, improve our work and develop services, using consent where required or legitimate interests with proportionate safeguards.
- Marketing: to send occasional updates only when you actively give separate consent. An enquiry alone never subscribes you.
- Website operation and security: for our legitimate interests in delivering, protecting and diagnosing the site.
- Optional analytics and advertising: on the basis of your cookie consent.
- Legal claims: where necessary to establish, exercise or defend legal rights.
You may withdraw consent at any time without affecting processing that was lawful before withdrawal. You can unsubscribe from marketing without affecting an enquiry or service.
4. Sensitive information
Creative work can involve personal circumstances, anxiety, low mood, burnout or other health-related information. We do not need this information through a general enquiry form. During a professional relationship, you may choose to disclose it where it is relevant to the work.
Where information qualifies as special-category data under the GDPR, we process only what is necessary and only with an applicable legal condition, normally your explicit consent, or where processing is necessary to protect vital interests or establish, exercise or defend legal claims. You can decline to discuss a topic. A Creative Block does not diagnose or provide medical or psychotherapeutic treatment.
5. The Find your block reflection tool
The quiz is an exploratory, evidence-informed reflection tool, not a validated diagnostic instrument. Answers and results are calculated in your browser and are not sent to or stored by A Creative Block unless you choose to share the result with us. If you share it, we receive the result and your email so we can respond; it does not subscribe you to marketing.
6. Providers and sharing
We do not sell personal data. We use service providers only where needed:
- Web3Forms processes website contact submissions and forwards them by email. Web3Forms currently states that submissions may be retained in its systems for up to three years by default, with shorter retention controls available for a form account. We aim to use the shortest practical provider retention while keeping our own records under the periods below.
- Google Forms and Google Sheets hold a contact register containing the name (where provided), email, audience type, message or voluntarily shared quiz result, submission source and optional newsletter choice submitted through website forms.
- Email and cloud providers receive and store correspondence and working documents.
- GitHub privately stores the website source and provides the repository connection used for deployments.
- Cloudflare Pages hosts and delivers the website. Cloudflare also provides network security and privacy-focused aggregate web analytics and may process operational request information.
- Google Tag Manager, Google Analytics 4, Google Ads and Meta Pixel manage or provide analytics and advertising measurement according to your cookie choice.
Each provider receives only the information needed for its role. We may also disclose the minimum necessary information to confidential professional advisers, a court, regulator or public authority where authorised or required by law, to establish or defend a claim, or to address a serious and imminent danger.
7. International transfers
Some providers may process information outside Portugal or the European Economic Area. Where required, transfers rely on a European Commission adequacy decision, approved standard contractual clauses or another lawful safeguard. You may contact us for more information about the safeguard relevant to your information.
8. Organisation-funded services
If an organisation commissions work for its employees or participants, we explain beforehand what administrative information the organisation will receive. Personal session content is not shared merely because an organisation paid for the work.
Aggregated or anonymised themes are reported only where the number of participants and context make re-identification reasonably unlikely. Where a group is too small to protect anonymity, reporting is limited to agreed administrative facts unless every affected participant gives specific written permission for additional disclosure. We do not share personal difficulties, mental-health context, session notes, identifiable quotations or assessments of named individuals without specific permission, a legal requirement or a serious and imminent danger.
9. Confidential supervision, recordings and AI
We may discuss an anonymised situation with a suitably bound professional supervisor where this supports safe and competent work. We remove identifying details as far as reasonably possible.
We do not record or transcribe sessions and do not submit session content to an AI service by default. Any future recording, transcription or AI-assisted processing requires separate prior information and your express agreement, and this policy will identify any relevant provider.
10. How long we keep information
- Enquiries and related correspondence held by A Creative Block: normally up to two years after the last meaningful contact. A transient or provider-held submission copy may follow the provider setting described above until it is shortened or deleted there.
- Brief working notes and service correspondence: up to two years after the final session or service, then deleted or irreversibly anonymised.
- Newsletter details and consent evidence: until you unsubscribe, the address repeatedly fails, or the list is closed. We may retain minimal suppression information so we do not contact you again.
- Contracts, payments and invoices: for the period required by Portuguese tax and accounting law.
- Analytics and advertising information: according to the relevant provider controls and your cookie choice, as described in the Cookie Policy.
We may retain relevant information longer where reasonably necessary for an active dispute, legal claim or legal obligation. We use proportionate organisational and technical measures to protect confidentiality, but no online system can be guaranteed completely secure.
11. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. A Creative Block does not make such automated decisions.
We normally respond within one month. To exercise a right, email [email protected]. You may also complain to Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).
12. Adults only
Our services are intended for people aged 18 or over. Please contact us if you believe a child has submitted personal information.
13. Changes
We update this policy when our services, providers or legal obligations change. The current version and update date remain on this page.
14. Contact
For privacy questions or requests, email [email protected].