Privacy Policy

Last updated: 26 August 2026 This Privacy Policy explains how Da Luz collects, uses, stores and shares users’ personal data when they visit https://daluznatal.pt, create an account, subscribe to communications or place an order. 1. Data Controller The entity responsible for processing personal data is: Mindscape, Lda. Portuguese Tax Identification Number: 517 980 258 Rua Cândido Guerreiro, Lote 24 8600-536 Lagos, Portugal Email: geral@daluznatal.pt The trade name used on the Website is Da Luz. Privacy-related questions or requests to exercise data protection rights should be sent to geral@daluznatal.pt. 2. Personal Data We Collect The data collected depends on how the user interacts with the Website. 2.1. Data Provided by the User We may collect the following data: - first and last name; - email address; - telephone number, when provided; - delivery address; - billing address; - country, district, town and postcode; - tax identification number, when requested; - customer account details; - products ordered, quantities and prices; - selected payment method; - selected delivery method and collection point; - delivery instructions; - content of communications sent to Da Luz; - return requests, complaints and customer support information; - preferences relating to marketing communications. 2.2. Order and Payment Data When the user makes or attempts to make a purchase, we collect the data required to: - register the order; - confirm and process the payment; - issue invoices and other billing documents; - prepare and deliver the products; - provide after-sales support; - process cancellations, returns and refunds; - prevent fraud and abusive use. Payments are processed by specialised external providers. Da Luz does not receive or store complete payment card details. Depending on the selected payment method, data may be processed by the payment provider responsible for MB WAY, Multibanco, card payments or PayPal. The identity and terms of the applicable provider are displayed during the payment process. 2.3. Technical and Usage Data When the user visits the Website, the following data may be collected automatically: - IP address; - browser type and version; - operating system; - device type; - language; - time zone; - date and time of access; - pages visited; - products viewed; - source of the visit; - actions performed on the Website; - session identifiers; - diagnostic, security and performance information; - data relating to cookies and similar technologies. This data may be collected through cookies, server logs, pixels, identifiers and other similar technologies. 2.4. Data from Third Parties We may receive data from: - the e-commerce platform; - payment providers; - carriers and collection points; - analytics providers; - fraud prevention services; - advertising platforms, where consent has been given; - authentication or payment services used by the customer. Where personal data is not collected directly from the data subject, it may be received from the providers and partners identified in this Policy, to the extent necessary for the provision of their services. We only process this data where there is a legal basis and to the extent necessary for the purposes described in this Policy. 3. Purposes and Legal Bases 3.1. Order Management We use customer data to: - receive and confirm orders; - process payments; - issue invoices; - prepare, dispatch and deliver products; - send order updates; - manage collection points; - process cancellations, returns and refunds; - provide customer support. Legal basis: performance of the contract and pre-contractual steps requested by the customer. 3.2. Compliance with Legal Obligations We process data to: - issue and retain tax documents; - comply with accounting and tax obligations; - respond to public authorities; - manage warranty and consumer rights; - comply with obligations relating to complaints and disputes. Legal basis: compliance with legal obligations. 3.3. Creation and Management of Customer Accounts We process the data required to create and manage an account, save addresses, display order history and provide associated features. Legal basis: performance of the contract or steps requested by the user. 3.4. Customer Support We use data to respond to questions, requests, complaints, returns and other communications. Legal basis: performance of the contract, compliance with legal obligations and Da Luz’s legitimate interest in providing appropriate service and maintaining communication records. 3.5. Security and Fraud Prevention We may use order, payment, account, device and IP address information to: - detect suspicious activity; - prevent fraudulent payments; - protect customer accounts; - protect the Website and our systems; - defend our rights. Legal basis: the legitimate interest of Da Luz and third parties in preventing fraud and protecting systems, as well as compliance with legal obligations where applicable. 3.6. Website Improvement and Statistical Analysis We may analyse Website usage to assess performance, correct errors and understand which pages and products are most popular. Where these activities use cookies or technologies that are not strictly necessary, they will be carried out with the user’s consent. Legal basis: consent, where required, or legitimate interest where processing may legally be carried out without optional cookies. 3.7. Marketing Communications Where the user has given consent, we may send: - news; - campaigns; - promotions; - product launches; - product recommendations; - communications relating to Da Luz. Consent may be withdrawn at any time through the unsubscribe link included in the messages or by contacting geral@daluznatal.pt. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Legal basis: consent. 3.8. Personalised Advertising Where the user has given consent, we may use browsing data, interaction data and device-related identifiers to: - measure the performance of our advertising campaigns; - understand whether a purchase or other action resulted from a campaign; - create audiences for advertising campaigns; - display personalised or relevant advertising; - limit the repetition of advertisements; - carry out statistical analyses relating to campaigns and Website usage. For these purposes, third-party tools may be used, including Google Analytics, Google Ads and Meta Pixel, as well as other advertising technologies identified in the Website’s cookie management tool. Where legally required, these technologies will only be used after the user has given consent. Consent may be refused or withdrawn at any time through the cookie settings tool available on the Website. Legal basis: consent. 4. Mandatory Data Fields identified as mandatory are necessary to enter into or perform the contract, comply with legal obligations or provide the requested functionality. If the customer does not provide this data, it may not be possible to: - complete the order; - process the payment; - issue the invoice; - deliver the products; - create an account; - respond to certain requests. Optional data is identified as such and, as a general rule, its absence will not prevent the purchase from being completed. 5. Cookies and Similar Technologies The Website uses cookies and similar technologies. 5.1. Necessary Cookies These are essential for features such as: - navigation; - shopping cart; - checkout; - login; - security; - privacy preferences; - order processing. These cookies cannot be disabled through the consent tool when they are strictly necessary for the requested functionality. 5.2. Analytics Cookies Analytics cookies help us understand how visitors use the Website, measure audiences and improve performance. With consent, Da Luz may use tools such as Google Analytics 4 (GA4) to collect statistical information about Website usage. These cookies and technologies will only be used after the user’s consent where legally required. 5.3. Advertising Cookies Advertising cookies and technologies allow us to measure campaign performance, attribute conversions, create audiences and, where applicable, display personalised advertising. With consent, Da Luz may use tools such as Google Ads and Meta Pixel from Meta Platforms. These technologies will only be used after the user has given consent. 5.4. Managing Preferences Users may accept, refuse or change their preferences through the cookie settings tool available on the Website. Users may also delete or block cookies through their browser settings. Blocking necessary cookies may prevent certain features from working correctly. 6. Who We Share Data With Da Luz does not sell personal data. We may share strictly necessary data with the following categories of recipients. 6.1. E-commerce Platform The Website uses Jumpseller, which provides hosting, store management, customer account, shopping cart and order services. 6.2. Payment Providers Payments made on the Website are processed by external payment service providers. Depending on the selected payment method, the data required to process the transaction may be transmitted to: - EuPago, for payment methods provided through this provider; - Stripe, for card payments; - PayPal, for PayPal payments; - other payment service providers displayed to the customer at checkout. Da Luz does not receive or store complete payment card details. These providers may process certain personal data as independent data controllers, in accordance with their own privacy policies and legal obligations. Only the data necessary to process, confirm and secure the transaction and, where applicable, issue a refund is transmitted. 6.3. Billing For issuing and managing billing documents, Da Luz uses Moloni. The data strictly necessary for this purpose is transmitted to Moloni, including the customer’s identification and billing details and the order information. 6.4. Carriers and Collection Points Data required for delivery may be shared with: - CTT; - DPD; - logistics partners; - collection point operators; - shipment tracking providers. This data normally includes the customer’s name, contact details, address, selected collection point and information necessary for delivery. 6.5. Technology Providers With the user’s consent, data may be shared with or collected through analytics and advertising tools, including: - Google Analytics 4, for statistical analysis and measuring Website usage; - Google Ads, for campaign measurement, conversion tracking, audience creation and advertising; - Meta Pixel, provided by Meta Platforms, for campaign measurement, conversion tracking, audience creation and advertising on Meta platforms, including Facebook and Instagram. The data processed may include online identifiers, IP address, device and browser information, pages and products viewed, interactions carried out on the Website and information relating to conversion events. The use of these tools is subject to the user’s consent preferences and the privacy policies of the respective providers. 6.6. Technology Providers We may use providers of: - hosting; - maintenance and development; - security; - email delivery; - customer support; - storage; - backups; - fraud prevention; - statistical analysis. 6.7. Accounting and Professional Support Necessary data may be shared with accountants, auditors, lawyers, consultants or insurers, all of whom are subject to legal or contractual confidentiality obligations. 6.8. Public Authorities We may disclose data where necessary to: - comply with a legal obligation; - respond to a valid order; - cooperate with tax, judicial, law enforcement or regulatory authorities; - protect the rights of Da Luz or third parties; - prevent or investigate fraud. 7. Analytics and Advertising Tools With consent, Da Luz may use services provided by Google and Meta Platforms for analytics, measurement and advertising. These services may include Google Analytics 4, Google Ads and Meta Pixel. Depending on the settings and services used, data such as IP address, online identifiers, device and browser characteristics, pages and products viewed, visit source, session duration, interactions and events relating to purchases or other conversions may be processed. The use of these tools depends on the settings adopted by Da Luz and the consent preferences selected by the user. For more information about how these providers process data, please consult: Google: policies.google.com/privacy Meta: facebook.com/privacy/policy/ 8. International Transfers Some providers may process data outside the European Economic Area. Where an international transfer takes place, we endeavour to ensure that an appropriate legal mechanism is used, such as: - an adequacy decision by the European Commission; - standard contractual clauses approved by the European Commission; - another legally recognised mechanism; - supplementary measures, where necessary. Users may request further information about the applicable safeguards by contacting geral@daluznatal.pt. 9. Data Retention Data is retained only for as long as necessary for the purposes for which it was collected, without prejudice to applicable legal retention periods. In particular: - data and documents relevant for tax and accounting purposes are retained for the periods legally required; - order data is retained for the period necessary to perform the contract, manage warranties and complaints and comply with legal obligations; - account data is retained while the account remains active or until deletion is requested, unless there are legal grounds for retaining it; - customer support communications are retained for the period necessary to resolve the request and defend legal rights; - marketing data is retained until consent is withdrawn or the data is no longer necessary; - data relating to disputes may be retained until the applicable limitation periods expire or the proceedings are concluded; - cookies are retained for the periods indicated in the cookie management tool. When data is no longer necessary, it will be deleted or anonymised unless there is a legal obligation to retain it. 10. Security Da Luz adopts appropriate technical and organisational measures to protect data against: - loss; - destruction; - alteration; - disclosure; - unauthorised access; - misuse. Despite these measures, no transmission or storage system is completely secure. Users must protect their passwords and must not share them with third parties. If they suspect unauthorised access to their account, they should contact us immediately. 11. Data Subject Rights Under applicable legislation, data subjects may exercise the following rights: - access: obtain confirmation that their data is being processed and access that data; - rectification: correct inaccurate or incomplete data; - erasure: request the deletion of data where legally applicable; - restriction: request temporary restriction of processing; - data portability: receive certain data in a structured format and transmit it to another controller; - objection: object to processing based on legitimate interests, including direct marketing; - withdrawal of consent: withdraw consent at any time; - complaint: lodge a complaint with the supervisory authority. These rights may be subject to legal limitations. For example, certain data cannot be immediately deleted where its retention is necessary to comply with tax, accounting or other legal obligations. 12. How to Exercise Your Rights To exercise a right, the data subject should contact: geral@daluznatal.pt The request should include: - name; - email address associated with the account or order; - the right the person wishes to exercise; - information necessary to identify the relevant data. We may request additional information to verify the requester’s identity and prevent unauthorised access to third-party data. We will respond within the applicable legal time limit. 13. Complaints to the CNPD Data subjects have the right to lodge a complaint with the Portuguese data protection authority: Comissão Nacional de Proteção de Dados — CNPD Avenida D. Carlos I, 134, 1st Floor 1200-651 Lisbon Portugal Website: https://www.cnpd.pt We recommend contacting us first at geral@daluznatal.pt so that we can try to resolve the matter directly. Prior contact does not limit the right to lodge a complaint with the CNPD. 14. Automated Decision-Making Da Luz does not carry out exclusively automated decision-making that produces legal effects or significantly affects customers. Some external providers may use automated systems for fraud prevention, security or payment processing, in accordance with their own privacy policies. 15. Direct Marketing Receiving marketing communications is optional and is not a condition for making purchases. Users may unsubscribe from these communications: - through the unsubscribe link included in emails; - by changing their account preferences, where this option is available; - by contacting geral@daluznatal.pt. Even after marketing communications have been cancelled, essential communications relating to orders, payments, deliveries, security or legal obligations may still be sent. 16. Minors The Website is not specifically intended for persons under 18 years of age. Purchases must be made by persons with legal capacity to enter into contracts or with the appropriate authorisation and supervision of their legal representative. If we become aware that data belonging to a minor has been collected without an appropriate legal basis, we will take the necessary steps to delete it. 17. External Links and Social Media The Website may contain links to social media platforms or external pages. When accessing these links, users become subject to the privacy policies and terms of the respective entities. The existence of a link does not mean that Da Luz controls the processing of data carried out on those pages. 18. Changes to This Privacy Policy This Policy may be updated to reflect changes in: - legislation; - regulations; - technology; - operations; - the services or providers used. The most recent version will always be available on the Website, together with the date of the latest update. Where changes are significant, we may display a notice on the Website or contact affected users directly. 19. Contact For questions relating to this Policy or the processing of personal data: Da Luz — Mindscape, Lda. Email: geral@daluznatal.pt Website: https://daluznatal.pt