Privacy Policy

Please read the following text carefully to understand how the information you provide will be handled by Ana Filipa de Ribeiro Fiúza e Clemente Lélé, hereinafter referred to as the Provider.

The Provider reserves the right to amend this Privacy Policy and therefore recommends that you read this document regularly.

1. Protecting the privacy of personal data is a fundamental commitment we make to every data subject who uses our digital platforms and/or services.

2. This Privacy Policy explains which personal data are collected, the purposes for which they are used, how they are processed, with whom we share them and for how long we keep them, as well as how to contact us in order to exercise your rights.

3. The purpose of this page is to inform users of the general rules governing the processing of personal data. Personal data are collected and processed in compliance with the legislation in force, namely Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR), implemented in Portuguese law by Law No. 58/2019 of 8 August on the Protection of Personal Data.

4. To safeguard your privacy as far as possible, we uphold the following essential and fundamental values:

   • People's rights: We respect your rights under applicable privacy legislation (including the right to access, correct or delete your personal data in accordance with that legislation).

   • Limited collection: We limit the information we collect and use to what is strictly necessary for the sale of our products, digital products and/or services.

   • Information: We always inform you of why and how we use your personal data. This process is described in this Privacy Policy.

   • Security: We take appropriate measures to protect your personal data and we require the same of the parties we work with. The Provider continuously tests its websites.

5. Our Privacy Policy describes how we apply our core values, how we use users' data and how we respect and protect each Client's right to privacy. We recommend that you read this statement carefully, as it sets out the basis on which we use your personal data when you purchase our products, digital products and services in our online shop.

6. The party responsible for collecting and processing your personal data is the Provider, who offers you full support and decides which data are collected and the means and purposes for which they are used.

7. Information is retained only for as long as necessary to provide the service or information requested. When we store data, we protect it by commercially acceptable means to prevent loss and theft, as well as unauthorised access, disclosure, copying, use or modification.

8. The Provider is responsible for monitoring compliance of data processing with the applicable legal requirements and for providing clarification to the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese Data Protection Authority.

9. If you have any questions about how we handle your data and personal information, please contact us at info@filipalele.pt.

10. We do not share personally identifiable information publicly or with third parties, except where required by law.

11. The personal data processed include: name, postal address, email addresses, contact numbers, tax identification number and data on the client's visits to the website or on electronic communications exchanged.

12. The Provider's Privacy Policy covers certain rights that the user may exercise. These include the right to withdraw consent: at any time the user may object to the processing of their data or request that their consent be withdrawn.

13. The user may unsubscribe at any time and request the deletion of their data by email at info@filipalele.pt.

14. Personal data may be processed to comply with legal obligations and, where applicable, for the purposes of the prevention, detection, investigation or prosecution of criminal offences, under Law No. 59/2019 of 8 August.

15. Personal data may also be used for other purposes, such as sending complaints and suggestions or learning about new services and news regarding the Provider's offering.

16. Data will be stored and kept only for the minimum period necessary to fulfil the purposes for which they were collected or subsequently processed, as defined by law and as detailed below in the section "Personal Data Retention Periods".

17. The Provider respects the privacy of all users of its website and undertakes to protect the personal information that each user chooses to share, in accordance with the national and European legislation in force.

18. In compliance with Law No. 58/2019 of 8 August and the GDPR (Regulation (EU) 2016/679) on the Protection of Personal Data, we inform you that the processing of the personal data collected is the responsibility of Ana Filipa de Ribeiro Fiúza e Clemente Lélé, holder of Portuguese tax number (NIF) 222987502, with tax residence in Lisbon.

Rights of the Data Subject

Without prejudice to the conditions established in the applicable legislation, the user has the following rights regarding the processing of their personal data:

• Right of access: You have the right to request confirmation that the Provider processes your personal data and, if you wish, to access your personal data and additional information. Upon request, the Provider will also supply a copy of the personal data being processed at that date.

• Right to rectification: You have the right to ask the Provider to rectify, amend or complete your personal data where they are incorrect or incomplete. You may likewise rectify, adjust or complete your personal data by updating your profile. The Provider asks you to make sure that any changes in your personal circumstances are communicated so that your personal data can be kept up to date.

• Right to withdraw consent: You have the right to withdraw your consent to receiving commercial communications at any time, by following the instructions in any commercial communication or by sending an email to the Provider. If the Provider uses your personal data on the basis of your consent for purposes other than commercial communications, you may withdraw your consent by emailing us at info@filipalele.pt.

• Right to restriction of processing: You have the right to restrict the Provider's use of your data when:

  • the processing is unlawful but you do not want the data to be erased;

  • we no longer need the personal data for the relevant purposes but you need them for the establishment, exercise or defence of legal claims;

  • you have objected to the use of the data on the basis of our legitimate interests, pending verification of whether the Provider does in fact have compelling grounds to continue using the data.

• Right to data portability: Insofar as we use your personal data to perform a contract with you and the personal data are processed by automated means, you have the right to receive all the personal data you provided to the Provider in a structured, commonly used and machine-readable format. You may also ask us to transfer them to another controller, where technically feasible.

• Right to object: You have the right to object to the use of your data. In that case the Provider will immediately stop using your data, except where there are compelling legitimate grounds for its use or where the Provider needs the data for the establishment, exercise or defence of legal claims.

• Right to lodge a complaint: You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), as the supervisory authority, or through the electronic Complaints Book at www.livrodereclamacoes.pt, if you believe that the collection and use of your personal data breach this Privacy Policy or the applicable legislation.

Processing of Minors' Personal Data

Under Article 8 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR) and Article 16 of Law No. 58/2019 of 8 August, the processing of a minor's personal data is lawful only if the minor is aged 13 or over and has given their consent or if such consent is given or authorised by the holders of parental responsibility.

The Provider does not knowingly collect personal data from children under 13 without the express, free, informed and verifiable consent of their legal representatives.

If the processing of personal data of children under 13 without the legally required consent is detected, those data will be promptly deleted as soon as the situation is identified or reported to the Provider.

Where the processing concerns minors aged 13 or over, consent will be requested directly from the minor, unless the law also requires authorisation from the holder(s) of parental responsibility.

If you have any questions regarding the processing of minors' data, please send us a message at info@filipalele.pt.

Transfer of Personal Data

The Provider may transfer data to a country outside the EU/EEA in order to improve the operation of its digital platforms and/or the provision of its services. In such cases, the Provider will ensure that data transfers are carried out in strict compliance with the applicable legal rules, namely through standard contractual clauses approved by the European Commission or another safeguard mechanism provided for in Chapter V of the GDPR.

Where applicable, your personal data will also be transferred to the partner responsible for processing each of your orders, under a data processing agreement that ensures that partner's compliance with its GDPR obligations.

Security of Personal Data

This website is designed so that whenever personal information is collected or used, the data are encrypted using a secure protocol (HTTPS/TLS). This technology protects the data, notably against fraudulent interception, and thus minimises the associated risk.

Personal Data Retention Periods

Under Article 5(1)(e) of the GDPR, personal data are kept only for the period strictly necessary to fulfil the purposes for which they were collected.

Notwithstanding the above, data may be kept for longer periods in the following cases:

a) Compliance with legal obligations: Where processing is necessary to comply with legal obligations to which the Provider is subject, namely tax and accounting obligations. In these cases, personal data may be kept for a period of 10 (ten) years, in accordance with Article 123 of the Portuguese Corporate Income Tax Code (Código do IRC) and Article 52 of the Portuguese VAT Code (Código do IVA).

b) Establishment, exercise or defence of rights: Where processing is necessary for the establishment, exercise or defence of rights in judicial, administrative or arbitration proceedings, data may be kept until the judgment becomes final and the obligations arising from it have been fulfilled.

c) Prevention and prosecution of criminal offences: Where data are processed for the purposes of the prevention, detection, investigation or prosecution of criminal offences under Law No. 59/2019 of 8 August (which transposes Directive (EU) 2016/680), data may be kept for the period necessary to achieve those purposes, including throughout criminal proceedings and until a conviction has been fully enforced.

Once the above retention periods have expired, personal data will be securely deleted or, whenever possible and appropriate, irreversibly anonymised, without prejudice to the legal obligations in force.

Personal Data Breach

In the event of a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed, the Provider undertakes to:

a) Assess, without undue delay, the nature of the breach and its impact on the data subjects;

b) Notify the Comissão Nacional de Proteção de Dados (CNPD) within 72 hours of becoming aware of the breach, under Article 33 of the GDPR;

c) Communicate the breach to the data subjects whenever it is likely to result in a high risk to their rights and freedoms, under Article 34 of the GDPR, describing in clear and plain language the nature of the breach, its likely consequences and the measures taken or proposed to mitigate its effects;

d) Keep an internal record of all personal data breaches, including the facts relating to them, their effects and the remedial measures taken.

The Provider adopts appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure or access and to ensure a level of security appropriate to the risk associated with the processing.

Changes to the Privacy Policy

This Privacy Policy may be updated at any time in line with any changes in the law, with the aim of protecting the client and keeping their data secure and accessible.

Contact Us

If you have any questions about this Privacy Policy or about the processing of your personal data in general, please send us an email at info@filipalele.pt and make sure to state the nature of your enquiry.