Privacy policy

SAVAGESIMPLICITY, UNIPESSOAL LDA, company number (NIPC) 519393520, registered office Rua Paul Harris, 11, 8.º A, 1600-251 Lisboa, Portugal, is the controller of the personal data collected in the Patchito shop. For any privacy question: ola@patchito.pt.

• Order details: name, delivery address, email and phone number, entered by the Customer on the payment page.
• The piece ordered: product, colour, chosen patches and their positions.
• Payment details: the method used and the transaction reference. Card details are handled only by Stripe: we never receive them.
• Messages the Customer sends us by email.
• Technical data needed to run the website, such as the IP address in server logs.
• Anonymous visit statistics: pages viewed, where the visit came from, country and device type. They use no cookies and cannot identify the Customer.

While the Customer designs a piece, we store only a random identifier used to hold stock. An order that is never paid keeps no name, address or contact details.

We do not ask for any details of the children who will use the pieces.

• Making, shipping and following up the order, and handling guarantee claims or complaints: performance of the contract (GDPR art. 6(1)(b)).
• Issuing invoices and meeting tax and accounting obligations: legal obligation (art. 6(1)(c)).
• Preventing fraud and keeping the website secure: legitimate interest (art. 6(1)(f)).
• Counting visits anonymously, to see which pages are useful and improve the shop: legitimate interest (art. 6(1)(f)).

We do not use the data for advertising and never sell it. If we ever start a newsletter, it will only go to people who opt in.

We share only what is needed with providers working on our behalf, under contracts that require them to protect it:

• Stripe Payments Europe Ltd. (Ireland): payments.
• Supabase Inc.: database, hosted in the European Union (Paris).
• Vercel Inc.: website hosting and anonymous visit statistics (Vercel Web Analytics).
• CTT – Correios de Portugal, S.A.: delivery (name, address and phone number).
• A certified invoicing program and an email provider, to issue and send invoices and confirmations.

Some of these providers belong to groups based in the United States. Any transfer of data outside the European Economic Area relies on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

We may also have to disclose data to the authorities where the law requires it.

• Orders and invoices: 10 years, as required by Portuguese tax and accounting law.
• Emails with the Customer: as long as needed to deal with the matter and for the guarantee period.
• Server logs: a few weeks.

The Customer may ask for access to their data, rectification, erasure, restriction, portability, or object to processing based on legitimate interest, by writing to ola@patchito.pt. We reply within one month. Some data cannot be erased before the legal period ends, such as the data on invoices.

Complaints can also be made to the Portuguese data protection authority (CNPD): www.cnpd.pt.

The shop uses no advertising or analytics cookies, so we do not ask for cookie consent. We use only what is strictly needed for the website to work:

• Temporary storage of the design in the browser, so it is not lost if the Customer goes back from the payment page. It is cleared when the tab is closed.
• On the payment page, Stripe uses its own cookies, needed to process the payment and prevent fraud.

Visit statistics (Vercel Web Analytics) use no cookies and store nothing in the browser: each visit is counted anonymously and is not followed across days or websites.

If we ever use cookies that are not essential, we will ask for consent first.

Data always travels encrypted (HTTPS). The database can only be reached by the shop's server, and the management area requires a login.

If we change this policy, we publish the new version here with its date.