Privacy policy

Privacy and Cookie Policy

Last updated: 2 September 2026

This Privacy and Cookie Policy explains how personal data is collected, used, retained and shared for users of the Oporto Amigurumi online shop, available at https://oportoamigurumi.pt/.

1. Data controller

The controller responsible for processing personal data is:

Luís Márcio Pinheiro Moita
Operator of the Oporto Amigurumi brand
Rua Adelino Amaro da Costa 46 – 3.2
4435-829 Baguim do Monte — Porto
Portugal
Email: geral@oportoamigurumi.pt
Telephone: +351 960 413 221 — Calls to the Portuguese national mobile network. For calls from abroad, your operator's international rate applies.

For any privacy questions or to exercise your rights, you can contact us at geral@oportoamigurumi.pt.

2. Personal data we collect

Depending on how you use the shop, we may collect the following categories of data:

Identification and contact details

  • First and last name;
  • Billing address;
  • Delivery address;
  • Email address;
  • Telephone number;
  • Tax identification number, when provided;
  • Country or region of residence.

Order data

  • Products viewed or purchased;
  • Quantities, prices and discounts;
  • Order history;
  • Delivery and tracking details;
  • Cancellation requests;
  • Returns, refunds and complaints;
  • Order-related communications.

Payment data

Payments are processed by external providers, including Shopify Payments, Ifthenpay and other methods displayed at checkout.

Oporto Amigurumi does not receive or store full payment card numbers. We may receive limited information, such as:

  • Selected payment method;
  • Payment status and confirmation;
  • Transaction amount, date and reference;
  • Last digits of the card, when provided by the provider;
  • Information needed to process refunds or resolve payment issues.

Account data

When a customer creates or uses an account, we may process:

  • Email address;
  • Customer identification;
  • Saved addresses;
  • Preferences;
  • Order history;
  • Authentication data managed by Shopify.

Communications

We collect the data you provide when you:

  • Send an email;
  • Use a contact form;
  • Request support;
  • Make a complaint;
  • Report a return or lack of conformity;
  • Interact with us through other channels provided by the shop.

Technical and usage data

When you visit the website, information may be collected such as:

  • IP address;
  • Device type;
  • Operating system;
  • Browser type and version;
  • Language and region;
  • Pages visited;
  • Date, time and duration of the visit;
  • Interactions with products, basket and checkout;
  • Cookie and similar technology identifiers;
  • Data needed for security and fraud prevention.

3. Data sources

We may collect personal data:

  • Directly from you;
  • Automatically while you use the website;
  • Through Shopify and the apps installed in the shop;
  • Through payment providers;
  • Through Packlink PRO and carriers;
  • Through the invoicing system;
  • Through technical support, hosting, security or communications providers;
  • Through social platforms when you voluntarily interact with our pages or content.

4. Purposes and legal bases

We process personal data only where there is an appropriate legal basis.

Performance of a contract and pre-contractual steps

We use the data needed to:

  • Display and process orders;
  • Confirm payments;
  • Prepare, dispatch and deliver products;
  • Create and manage customer accounts;
  • Communicate about orders;
  • Process cancellations, returns and refunds;
  • Provide customer support;
  • Respond to enquiries made before purchase.

Without the data essential for purchase, payment and delivery, it may not be possible to complete or fulfil the order.

Compliance with legal obligations

We may process and retain data to:

  • Issue and report invoices;
  • Comply with tax, accounting and commercial obligations;
  • Keep legally required records;
  • Respond to competent authorities;
  • Handle complaints;
  • Comply with obligations relating to warranties, conformity and consumer rights;
  • Exercise or defend rights in administrative or judicial proceedings.

Consent

We rely on consent to:

  • Send promotional emails;
  • Install analytics, non-essential functional or advertising cookies;
  • Carry out other operations for which the law requires prior authorisation.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out previously.

Legitimate interests

We may process data where necessary for legitimate interests, including:

  • Protecting the shop, customers and systems;
  • Preventing fraud and misuse;
  • Detecting and resolving technical problems;
  • Ensuring transaction security;
  • Managing and improving the operation of the shop;
  • Protecting or exercising legal rights.

Before relying on this basis, we assess whether our interests are compatible with the data subject's rights and freedoms.

5. Marketing

We will only send promotional emails where you have given consent or another valid legal basis exists.

Consent to marketing:

  • Is optional;
  • Is not a condition of making a purchase;
  • May be withdrawn at any time;
  • May be withdrawn using the unsubscribe link included in messages or by contacting geral@oportoamigurumi.pt.

Data subjects may object at any time to the processing of their personal data for direct marketing purposes.

Even after you unsubscribe from promotional communications, we may continue sending messages necessary for orders, payments, deliveries, security, accounts or legal obligations.

We do not sell personal data to third parties.

6. Data sharing

We share only the necessary data with providers involved in running the shop and meeting our obligations.

These providers may include:

Shopify

The shop is hosted and technically supported by Shopify, which processes data relating to browsing, accounts, baskets, checkout and orders.

You can read Shopify's Consumer Privacy Policy at:

https://www.shopify.com/legal/privacy/app-users

Payment providers

We share the necessary data with Shopify Payments, Ifthenpay and other providers displayed at checkout to:

  • Authorise and confirm payments;
  • Prevent fraud;
  • Process refunds;
  • Comply with legal and security obligations.

Packlink PRO and carriers

We share the data needed to prepare, dispatch, deliver and track orders, including name, address, telephone number, email and necessary shipment information such as parcel weight and dimensions.

The specific carrier depends on the service selected or booked for the order and may include CTT, DPD, UPS or other carriers available through Packlink PRO.

Invoicing and accounting

The data needed to issue, report and retain invoices may be processed by Moloni, the accountant and other providers necessary to comply with tax and accounting obligations.

Technical providers

We may use providers of:

  • Hosting and storage;
  • Email;
  • Security;
  • Technical support;
  • Domain management;
  • Analysis of shop performance;
  • Customer service.

These providers receive only the data needed for their respective roles and are subject to applicable data protection obligations.

Authorities and defence of rights

We may disclose data to public authorities, courts or other entities when:

  • Required by law;
  • There is a legally valid request;
  • It is necessary to prevent or investigate fraud;
  • It is necessary to exercise, establish or defend rights.

7. Relationship with Shopify and enhanced services

The online shop is hosted by Shopify, which processes personal data relating to browsing, customer accounts, baskets, checkout, payments and orders to provide, protect and improve its e-commerce platform.

We use enhanced features provided by Shopify through Shopify Network Intelligence. To provide these services, Shopify may process data arising from your interactions with Oporto Amigurumi, Shopify and other merchants using the platform.

This data may be used to improve services, personalisation, security, fraud prevention and shop performance and, where valid consent exists, advertising and marketing.

Data entered or collected through the shop may be shared with Shopify and its service providers and processed in countries other than your country of residence, subject to the legally required mechanisms and safeguards.

Shopify may act as an independent data controller for certain operations and features. No other merchant has direct access to Oporto Amigurumi customers' personal data through Shopify Network Intelligence.

You can read Shopify's Consumer Privacy Policy at:

https://www.shopify.com/legal/privacy/app-users

To learn about Shopify's processing and exercise applicable rights directly with that company, you can use Shopify's Privacy Portal:

https://privacy.shopify.com/

8. International transfers

Some of our providers, including Shopify and associated technology providers, may process data outside the European Economic Area.

Where data is transferred to countries without a European Commission adequacy decision, legally recognised mechanisms such as standard contractual clauses or other appropriate safeguards will be used.

You can contact us to request further information about the applicable safeguards.

9. Data retention

Data is retained only for the period necessary for the purposes for which it was collected, taking into account:

  • The duration of the customer relationship;
  • Account maintenance;
  • Order fulfilment and follow-up;
  • Return and warranty periods;
  • Applicable limitation periods;
  • Tax, accounting and commercial obligations;
  • The need to resolve disputes or defend rights.

Invoicing documents and related data will be retained for the period required by tax and accounting law.

Data used for marketing is retained until consent is withdrawn or it is no longer needed, without prejudice to keeping a minimal record to respect requests not to receive further communications.

Cookie consent is retained and renewed in accordance with the periods set by the platform and applicable law.

10. Security

We adopt appropriate technical and organisational measures to protect data against:

  • Unauthorised access;
  • Loss;
  • Destruction;
  • Alteration;
  • Improper disclosure;
  • Fraudulent use.

Despite these measures, no electronic system or Internet transmission can be considered completely secure.

You should keep your account access details secure and contact us if you suspect unauthorised use.

11. Data subjects' rights

Under data protection law, data subjects may, where applicable:

  • Request access to their personal data;
  • Request correction of inaccurate or incomplete data;
  • Request erasure of data;
  • Request restriction of processing;
  • Object to processing based on legitimate interests;
  • Object at any time to processing of their data for direct marketing purposes;
  • Receive data in a structured, commonly used, machine-readable format;
  • Request transmission of data to another controller, where applicable;
  • Withdraw consent at any time;
  • Lodge a complaint with the supervisory authority.

These rights are not absolute. Certain data may need to be retained to comply with legal obligations, perform contracts, prevent fraud, or exercise and defend rights.

To exercise your rights, send a request to geral@oportoamigurumi.pt.

We may request additional information strictly necessary to confirm the requester's identity.

We will respond without undue delay and, as a rule, within one month, except where the law allows an extension.

12. Data protection complaints

Data subjects may lodge a complaint with:

Comissão Nacional de Proteção de Dados — CNPD (Portuguese Data Protection Authority)
Website: https://www.cnpd.pt/

We recommend contacting us first at geral@oportoamigurumi.pt so that we can try to clarify or resolve the situation.

Prior contact with Oporto Amigurumi is not mandatory and does not restrict the right to lodge a complaint with the supervisory authority.

13. Minors' data

The shop is not intended for purchases by minors without authorisation from their legal representative.

We do not knowingly collect children's personal data for marketing purposes.

If a legal representative believes that a minor's data has been provided without appropriate authorisation, they may contact us to request a review and, where applicable, deletion.

14. Automated decisions

Oporto Amigurumi does not make exclusively automated decisions that produce legal effects or significantly affect you.

Payment or security providers may use automated systems to detect fraud, assess transactions or protect their services, in accordance with their policies and legal obligations.

15. External links and services

The website may contain links or content from external platforms, including social media, video services, payments, order tracking or other services.

When you use these services, data may be processed by their operators in accordance with their own privacy policies.

Including a link does not mean that we control the third party's privacy practices.

Cookies

16. What cookies are

Cookies are small files stored on your device when you visit a website.

Among other functions, they can:

  • Maintain your basket;
  • Save preferences;
  • Keep you logged in;
  • Protect checkout;
  • Remember privacy choices;
  • Measure shop usage;
  • Display relevant content or advertising.

Similar technologies, such as pixels, local storage, identifiers and electronic tags, may also be used.

17. Cookie categories

Strictly necessary cookies

These are essential for the operation, security and use of the shop, including:

  • Browsing;
  • Basket;
  • Checkout;
  • Payments;
  • Login;
  • Traffic distribution;
  • Fraud prevention;
  • Recording privacy preferences.

These cookies cannot be disabled through the consent panel because the website may not work correctly without them.

Functional cookies

These provide additional features or remember choices such as language, region or other preferences.

Where they are not strictly necessary, they will only be used with consent.

Analytics cookies

These help us understand how visitors use the shop, which pages are most visited and whether errors occur.

Non-essential analytics cookies will only be activated after you give consent.

Advertising and marketing cookies

These may be used to measure campaigns, limit repeated ads or show advertising based on interests and interactions.

These cookies will only be used with consent, when tools that use them are installed.

18. First-party and third-party cookies

We may use:

  • First-party cookies set by the shop or Shopify;
  • Third-party cookies set by providers whose features are integrated into the website.

Third parties may include Shopify, payment providers, analytics tools, video platforms, social networks or marketing services, depending on which integrations are active.

The list and duration of cookies may change when Shopify, an app or another integration is updated. Information available in the preferences panel and the respective providers' policies is the most up-to-date reference.

You can find additional information about cookies used by Shopify at:

https://www.shopify.com/legal/cookies

19. Consent and cookie management

On your first visit, a banner will allow you to:

  • Accept non-essential cookies;
  • Reject non-essential cookies;
  • Configure the permitted categories.

Rejecting non-essential cookies does not prevent you from making a purchase, although some optional features may be limited.

You can change or withdraw consent later using the “Cookie preferences” link on the website.

Withdrawing consent does not affect the lawfulness of processing carried out previously.

You can also delete or block cookies through your browser settings. However, blocking strictly necessary cookies may prevent your basket, account or checkout from working correctly.

20. Policy changes

We may update this Privacy and Cookie Policy to reflect:

  • Changes in the law;
  • New features;
  • Changes of providers;
  • Installation or removal of apps;
  • Changes in data processing practices.

The updated version will be published on the website with the date of the latest update.

Where changes are significant or legally required, an additional notice will be provided or fresh consent requested.

21. Contact

For questions about privacy, cookies or exercising your rights:

Oporto Amigurumi
Data controller: Luís Márcio Pinheiro Moita
Email: geral@oportoamigurumi.pt
Telephone: +351 960 413 221 — Calls to the Portuguese national mobile network. For calls from abroad, your operator's international rate applies.