Privacy Policy

1. Who is responsible for your data

The data controller is [Legal entity name], tax number [NIF / tax number], with registered address at [Registered address].

For any question about your data, write to geral@taste-theos.pt.

2. What data we collect

• Orders: your name, contact details, delivery address and the products you order. [Confirm the exact fields collected when you request an order.]
• Order status: whether your order was approved or declined, and the reason if it was declined.
• Account: your name, e-mail address and password (stored securely, never in plain text), if you create an account.
• Newsletter: your e-mail address, if you subscribe.
• Messages: whatever you send us when you contact us, for example by e-mail.
• Technical data: like most websites, our servers record technical information such as IP address, browser and the pages requested, for security and to keep the website running.

3. Why we use your data

Each use of your data relies on a legal basis under the GDPR:

• To process and deliver your orders and to deal with your requests: performance of a contract (Article 6(1)(b)).
• To issue invoices and comply with tax and accounting obligations: legal obligation (Article 6(1)(c)).
• To send our newsletter: your consent (Article 6(1)(a)), which you can withdraw at any time.
• To keep the website secure and prevent fraud and abuse: our legitimate interest (Article 6(1)(f)).

4. Cookies

The website currently uses a single functional cookie that remembers your language choice (English or Portuguese). It does not track you and is needed for the website to behave as you chose.

[Update this section if analytics, advertising or other cookies are added; where required, we will ask for your consent first.]

5. Who we share your data with

We do not sell your personal data. We share it only with service providers who help us run the shop, under agreements that protect your data:

• Our hosting provider: [hosting provider and server location].
• [Delivery partners and e-mail or newsletter provider, if any.]
• Public authorities, when we are legally required to do so.

If a provider processes data outside the European Economic Area, the transfer relies on safeguards required by the GDPR, such as the European Commission’s standard contractual clauses.

6. How long we keep your data

• Order and invoice data: for the period required by tax and accounting law.
• Account data: while your account is active, and deleted when you ask us to close it, except for what we must keep by law.
• Newsletter: until you unsubscribe.
• Messages: [retention period].

7. Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where the law allows;
• restrict or object to certain uses of your data;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting what was done before.

To exercise any of these rights, write to geral@taste-theos.pt. We will reply within one month. If you believe your rights were not respected, you can lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

8. Security

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. No system is completely secure, so we cannot guarantee absolute security.

9. Children

The website is not aimed at children under 13, and we do not knowingly collect their personal data.

10. Changes to this policy

We may update this policy. The current version is always published on this page, with the date it was last updated.