Privacy Policy
Portuel respects your privacy and handles personal data with care and transparency, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Portuguese Law no. 58/2019 of 8 August.
1. Who is the data controller
This website is operated by:
Musa dos Sabores, Lda.
Tax number (NIF): 519294939
Address: Avenida Dom Rodrigo da Cunha 22, 2nd floor left, Apt. D, 1700-141 Lisbon, Portugal
Email: info@portuel.com
Musa dos Sabores, Lda. is the controller of the personal data collected through portuel.com and in our stores. For any question about privacy or to exercise your rights, contact us at info@portuel.com.
2. Data we collect
We may collect the following categories of personal data:
● Name
● Email address
● Phone number
● Billing and delivery address
● Tax number, when you ask for an invoice with your tax details
● Order details and purchase history
● Payment confirmation details (we do not store full card data, which is handled directly by the payment providers)
● Website usage data, including IP address, device type, browser and pages visited
● Marketing preferences
● Your communications with us, by email, WhatsApp or social media
We do not intentionally collect special categories of data within the meaning of Article 9 GDPR.
3. Purposes and legal bases
The GDPR requires every processing activity to have a legal basis. Ours are as follows.
To process orders, arrange deliveries and pickups, and handle returns and refunds, the basis is performance of a contract, under Article 6(1)(b).
To issue invoices and meet tax and accounting obligations, the basis is compliance with a legal obligation, under Article 6(1)(c).
To provide customer support and respond to enquiries, the basis is performance of a contract or our legitimate interest, under Article 6(1)(b) and (f).
To send marketing communications by email, SMS or WhatsApp, the basis is consent, under Article 6(1)(a). For existing customers, and for products similar to those already purchased, the basis is legitimate interest, under Article 13-A of Portuguese Law no. 41/2004.
For non-essential cookies and similar technologies, including analytics and advertising, the basis is consent, under Article 6(1)(a).
For fraud prevention, website security and defending legal claims, the basis is legitimate interest, under Article 6(1)(f).
To improve the website, the product range and the shopping experience, the basis is likewise legitimate interest, under Article 6(1)(f).
Wherever processing relies on legitimate interest, we have first balanced that interest against your rights and freedoms. You can ask us about that assessment at info@portuel.com.
Providing billing and delivery data is necessary to complete an order. Without it we cannot accept or ship your order. Providing data for marketing purposes is optional.
4. Retention periods
We keep data only for as long as necessary for the purposes above:
● Invoices and accounting records: 10 years, as required by tax law
● Customer account data and order history: while the account is active and for up to 5 years after the last interaction
● Customer support communications: up to 3 years after the matter is closed
● Marketing data: until you withdraw consent or object, and after that only the minimum record needed to honour your objection
● Cookies and analytics data: as set out in our cookie information, normally up to 24 months
Once these periods end, the data is deleted or anonymised.
5. Processors and data sharing
We use service providers who process personal data on our behalf, as processors, under data processing agreements pursuant to Article 28 GDPR. These include:
● Shopify, e-commerce platform and hosting of the online store
● Easypay and other payment providers, for payment processing
● Moloni, invoicing
● Klaviyo and other email marketing and CRM tools
● Google Analytics, website usage analytics
● Meta Pixel, measurement and advertising
● WhatsApp, customer communication
● Carriers and delivery partners, for shipping orders
● Accountants and legal advisors, where necessary
We may also disclose data to public authorities where legally required.
We do not sell customer data, and we do not share it for third-party purposes unrelated to the service we provide to you.
6. International transfers
Some of the providers listed above are established outside the European Economic Area, in particular in the United States and Israel. In those cases, transfers rely on one of the safeguards set out in Chapter V of the GDPR:
● An adequacy decision of the European Commission, applicable to Israel and to US entities certified under the EU-U.S. Data Privacy Framework
● Standard contractual clauses approved by the European Commission, together with supplementary measures where needed
You can request a copy of the applicable safeguards at info@portuel.com.
7. Your rights
Under Articles 15 to 22 GDPR, you have the right to:
● Access: find out what data we hold about you and obtain a copy
● Rectification: correct inaccurate or incomplete data
● Erasure: ask for your data to be deleted, where it is no longer necessary or where you withdraw consent, without prejudice to legal retention obligations
● Restriction: ask us to suspend processing in certain situations
● Portability: receive the data you provided in a structured, commonly used format, or ask for it to be transmitted to another controller
● Object: object to processing based on legitimate interest, including, at any time and without giving reasons, to direct marketing
● Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand
To exercise any of these rights, write to info@portuel.com. We respond within one month, extendable by a further two months in complex cases, in which case we will inform you. We may ask for additional information to confirm your identity.
If you believe your data is not being handled properly, you have the right to lodge a complaint with the supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º, 1200-651 Lisbon, Portugal
Phone: +351 213 928 400
Email: geral@cnpd.pt
www.cnpd.pt
8. Marketing
We only send marketing communications with your consent or, if you are a customer, about products similar to those you have already purchased. You can unsubscribe at any time, using the unsubscribe link in every email or by writing to info@portuel.com. Unsubscribing is free of charge.
9. Cookies and similar technologies
We use cookies and similar technologies to run the website, to analyse usage and for advertising. Strictly necessary cookies do not require consent. All others are only set once you accept them in the cookie banner, and you can change your choices at any time in the website's cookie settings or in your browser.
10. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or improper disclosure, including encrypted connections, access controls and careful selection of service providers. In the event of a personal data breach likely to result in a high risk to your rights, we will notify the CNPD and, where applicable, the individuals affected, under Articles 33 and 34 GDPR.
11. Minors
This website is not intended for minors. We do not knowingly collect data from children. Alcoholic beverages are sold only to persons aged 18 or over.
12. Changes to this policy
We may update this policy whenever necessary. The date of the last update appears at the top of the page. Material changes will be announced on the website.
For any privacy question, contact info@portuel.com.
https://www.portuel.com
