Privacy Policy

 

Last updated: January 23, 2026

 

This Privacy Policy applies to the processing of personal data by Carte Creme, LDA, with registered office at Rua da Ribeira 20, 2460-812 Turquel, Alcobaça, Portugal ("we", "us", "our"). We act as the data controller for the purposes of applicable data protection laws.

 

This Privacy Policy describes how we collect, use, disclose and otherwise process your personal information when you visit, use, or make a purchase through our webshop. Where this Privacy Policy conflicts with our Terms & Conditions, this Privacy Policy prevails with respect to personal data.

 

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Portuguese data protection legislation.

 

1. Personal Data We Collect

We may collect and process the following categories of personal data:

- identification and contact data (name, billing and shipping address, email address, phone number);

- payment and transaction data (payment method, transaction details, order history);

- account data (username, preferences, settings);

- communications (customer service correspondence);

- technical and usage data (IP address, browser type, device information, cookies, interaction data).

 

2. Sources of Personal Data

We collect personal data:

- directly from you when you place an order, create an account or contact us;

- automatically through your use of the webshop and cookies;

- from service providers acting on our behalf (including Shopify);

- from partners or third parties, where legally permitted.

 

3. Purposes of Processing

We process personal data to:

- perform and manage orders, payments, deliveries, returns and refunds;

- manage customer accounts and provide customer support;

- communicate with you regarding orders and services;

- improve and personalise the webshop and user experience;

- conduct marketing and promotional activities;

- prevent fraud, misuse and security incidents;

- comply with legal and tax obligations.

 

4. Marketing & Advertising

We may use your personal data for marketing and advertising purposes, including sending promotional communications and displaying advertisements based on your interactions with our webshop.

 

Where required by law, such activities are carried out based on your consent. You may opt out of marketing communications at any time using the unsubscribe option or by contacting us.

 

Depending on your location, you may have the right to opt out of the sharing or use of your personal data for targeted advertising.

 

5. Legal Bases for Processing

We process personal data based on:

- performance of a contract;

- compliance with legal obligations;

- legitimate interests (such as improving services, fraud prevention and security);

- your consent, where required.

 

6. Sharing of Personal Data

We may share personal data with:

- Shopify as our e-commerce platform provider;

- payment service providers;

- logistics and fulfilment partners;

- IT, analytics and marketing service providers;

- public authorities where legally required.

 

We do not sell personal data.

 

7. Shopify Services & Enhanced Features

Our webshop is hosted by Shopify. Shopify may process personal data to provide, improve and secure its services, including enhanced features such as personalised advertising and analytics. In certain cases, Shopify acts as an independent data controller for these processing activities.

 

For more information on how Shopify processes personal data and how you can exercise your rights with Shopify, please visit: https://privacy.shopify.com.

 

8. International Data Transfers

Personal data may be transferred outside the European Economic Area. Where this occurs, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, unless the destination country has been recognised as providing an adequate level of protection.

 

9. Data Retention

We retain personal data only for as long as necessary for the purposes described above or as required by law.

 

10. Data Security

We implement appropriate technical and organisational measures to protect personal data. However, no method of transmission or storage is completely secure.

 

11. Children’s Data

Our webshop is not intended for children and we do not knowingly collect personal data from individuals under the age of 16.

 

12. Your Rights

Depending on your location, you may have the right to:

- access your personal data;

- correct inaccurate data;

- request erasure of data;

- restrict or object to processing;

- data portability;

- withdraw consent at any time;

- opt out of targeted advertising or data sharing where applicable.

 

You may also exercise rights via Shopify where Shopify acts as an independent controller.

 

13. Complaints

You have the right to lodge a complaint with your local data protection authority. For the EEA, supervisory authorities can be found via the European Data Protection Board.

 

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.

 

15. Contact

If you have questions or wish to exercise your rights, please contact:

concierge@cartecreme.com

or via https://cartecreme.com/pages/contact