Privacy Policy

Last updated: July 2026

1. Data controller

The controller of personal data collected through alvashop.eu is Almanaque Fenomenal Unipessoal, Lda., company no. 518622045, registered office in Loulé, Portugal.
Privacy contact: info@alvashop.eu

2. Data we collect

  • Order data: name, delivery and billing address, email, phone, VAT number (when provided for invoicing);
  • Payment data: processed directly by payment providers (Shopify Payments, PayPal and similar) — we do not store card numbers;
  • Account data: if you create a customer account, your order history and preferences;
  • Browsing data: IP address, device type and pages visited, via cookies (see our Cookie Policy);
  • Communications: messages you send us by email or contact form.

3. Purposes and legal bases

  • Processing and delivering orders — performance of a contract;
  • Invoicing and tax obligations — legal obligation;
  • Customer support, returns and warranties — performance of a contract and legal obligation;
  • Newsletter and offers — consent, which you may withdraw at any time via the unsubscribe link;
  • Website improvement and statistics — legitimate interest and/or consent (cookies).

4. Data sharing

Data is shared only as necessary with: the store hosting platform (Shopify International Ltd.), payment providers, carriers and logistics operators responsible for delivery, email/newsletter service providers, and authorities where legally required. Some providers may be located outside the European Economic Area; in such cases transfers rely on adequacy decisions or the European Commission's standard contractual clauses.

5. Retention periods

Order and invoicing data is kept for the legally required periods (as a rule, 10 years for tax documents). Marketing data is kept until consent is withdrawn. Account data is kept while the account remains active.

6. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. To exercise these rights, contact us by email. You also have the right to lodge a complaint with the supervisory authority: CNPD — Comissão Nacional de Proteção de Dados (cnpd.pt).

7. Security

We adopt appropriate technical and organisational measures to protect data, including encrypted connections (HTTPS/TLS) and restricted access. No system is, however, completely infallible.

8. Changes

This policy may be updated. The version in force is the one published on this page, with the update date shown at the top.