Privacy Policy
This is a translation for convenience. The Portuguese version prevails.
This policy explains what personal data we process when you use the Quinta shop, why, for how long, and what your rights are. It is governed by the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Portuguese Law 58/2019.
1. Data controller
[Denominação social], tax no. [NIPC], registered office at [Morada da sede]. For anything about your data, write to geral@exemplo.pt.
Given our size and activity, we are not required to appoint a data protection officer. Privacy requests are handled directly through the contact above.
2. What data we process, why, and on what basis
| Purpose | Data | Legal basis (art. 6 GDPR) |
|---|---|---|
| Processing and delivering orders, customer support | Name, address, email, phone, products ordered | Performance of contract |
| Payments | Transaction data, MB WAY number. Card details are handled only by the payment provider. | Performance of contract |
| Invoicing and tax obligations | Name, tax number (if given), address, order data | Legal obligation |
| Customer account (optional) | Email, encrypted password, addresses, order history | Performance of contract |
| Proof of acceptance of the Terms and of consent | Date, time and version accepted | Legal obligation and legitimate interest |
| Newsletter (optional) | Email, language | Consent, which you can withdraw at any time |
| Site security and fraud prevention | IP address, technical access data | Legitimate interest |
| Complaints and disputes | Complaint and order data | Legal obligation and legitimate interest |
We do not make automated decisions or profiling with legal effects on you.
3. How long we keep data
- Orders and invoices: 10 years, as required by tax and accounting law.
- Customer account: while the account is active. You can ask for it to be deleted at any time, except for documents we must keep by law.
- Newsletter: until you withdraw consent.
- Technical security logs: up to 12 months.
- Complaints: until the applicable limitation period ends.
4. Who we share data with
We only share the data needed with providers that process it on our behalf and on our instructions (processors), under a contract in line with article 28 GDPR:
- ifthenpay (Portugal): MB WAY, Multibanco and card payments. [VERIFY]
- Moloni (Portugal): certified invoicing software. [VERIFY]
- Courier (e.g. CTT or DPD): delivering orders. [VERIFY]
- Cloudflare: website hosting, content delivery and security.
- Server hosting provider: database hosting. [VERIFY: name and country]
- Email provider: order emails and newsletter. [VERIFY]
We may also disclose data to public authorities where the law requires it (for example, the tax authority).
5. Transfers outside the European Economic Area
Some providers, such as Cloudflare, may process data outside the EEA. Such transfers rely on the EU–US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
6. Your rights
You may, at any time and free of charge:
- access your data and get a copy;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten"), unless the law requires us to keep it;
- restrict processing;
- object to processing based on legitimate interest;
- receive the data you gave us in a structured format (portability);
- withdraw consent, without affecting processing already carried out.
To exercise these rights, write to geral@exemplo.pt. We will reply within one month. You also have the right to lodge a complaint with the Portuguese data protection authority, the CNPD, at www.cnpd.pt.
7. Security
We use encrypted connections (HTTPS), passwords stored with one-way hashing, restricted access and regular backups.
8. Minors
The shop is not intended for children under 16, and we do not knowingly collect their data.
9. Cookies
For the cookies we use, see our Cookie Policy.
10. Changes
We may update this policy. The current version, with its date, is always published on this page.
Version 2026-11-04