Privacy

This policy explains how Bird of Paradise uses personal data on birdofparadise.pt. It follows Regulation (EU) 2016/679 (GDPR), Portuguese Law 58/2019 and, for cookies and electronic communications, Law 41/2004. Last updated: 2 October 2026.

Who decides about your data

The controller is Anna Zgurskaya, a sole trader, NIF 312535090. Bird of Paradise is the trade name of the shop at birdofparadise.pt. The establishment is at 614 Rua do Rei Ordonho I, 4990-298 Ponte de Lima, Portugal.

We have not appointed a data protection officer. The law does not require one for this activity. Privacy requests: admin@birdofparadise.pt. Orders: loja@birdofparadise.pt. WhatsApp: +351 925 215 092.

What we use

To buy, we ask for your name, email, phone number and delivery address. An account is optional: you can check out as a guest. If you create an account, we store an irreversible version of the password. We cannot read the password itself.

The order includes the products, the amount, the shipping method and the payment method. For MB WAY we use the mobile number. For Multibanco we store the entity and the reference. For card and PayPal we do not store the full card number or the PayPal account credentials. The payment provider holds those.

If you write a review, we keep the name you choose, the rating and the text, linked to your account. The newsletter asks only for an email address. Messages you send us, by email or WhatsApp, are kept while we reply and while a legal duty requires it.

The server logs technical data: IP address, date, time and browser type. The cart, wishlist and a promotion code stay in your browser until you clear them. We do not ask for health, religion or other special-category data. If you write that in a message, we use it only to reply.

Why we use it, and the legal basis

Contract (GDPR Article 6(1)(b)). We use contact details, the address and the order to take payment, pack, ship and follow up, including emails about payment and dispatch. Without your name, email, phone and address we cannot perform the order. An account serves the same purpose, and it is not required.

Legal obligation (GDPR Article 6(1)(c)). We issue invoices and keep tax records. We answer courts, the Portuguese Tax Authority and other authorities when the law requires it.

Consent (GDPR Article 6(1)(a) and Law 41/2004). The newsletter is sent only if you subscribe. You may withdraw consent at any time, by the unsubscribe link or by email. Processing already carried out stays lawful. Publishing a review rests on your submitting it. You may ask us to take it down.

Legitimate interests (GDPR Article 6(1)(f)). We protect the shop against abuse, keep technical logs and, after a purchase, may ask for a review of that order. The interest is security and service quality. You may object. We do not build profiles for third-party advertising, and we do not sell lists.

How long we keep it

Invoices and supporting tax records: 10 years, the period in Article 52 of the Portuguese VAT Code. Account and order data that are not tax records: for as long as the account exists and, after that, only what the law requires us to keep. Newsletter: until you unsubscribe. Reviews: until you ask us to remove them, or until we take them down.

Technical logs and unpaid orders with no tax document: 12 months at most, unless we are investigating abuse. Where we need data to defend a legal claim, we keep it for the applicable limitation period and then delete or anonymize it.

Who receives it

Providers working on our instructions:

• Ifthenpay (Portugal), for MB WAY, Multibanco and card payments.
• PayPal (Europe), in Luxembourg, when you choose PayPal.
• CTT — Correios de Portugal and Shiptimize, for labels and delivery. A pickup point, if you choose one, may be CTT or Payshop.
• The service that delivers our emails.
• The host of the shop and of the order database.

These providers receive only what they need for the task. We do not sell or rent personal data. If you contact us on WhatsApp, or open Facebook, Instagram or LinkedIn from the footer, that platform then handles the conversation or the visit under its own rules. We do not place advertising pixels from those services on the shop.

When anti-abuse verification is switched on, Google reCAPTCHA receives the IP address and device data at checkout (Ifthenpay and PayPal), on the newsletter, on account registration, and, after failed attempts, on customer and Gestão login. We keep only the result of that check on the order, when there is one. We do not use it for advertising. While it is off, Google is not called.

Transfers outside Europe

Ifthenpay, CTT and Shiptimize operate in Portugal. We prefer providers in the European Economic Area. PayPal may process data outside that area. Google, if reCAPTCHA is on, may process data in the United States. WhatsApp and the social networks may do the same if you use them. Outside the EEA we rely on an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified, or on standard contractual clauses, plus extra measures where they are needed.

Cookies and your device

We store only what is strictly necessary for the cart, the account session and a note that you have seen the notice. There are no advertising or analytics cookies on first load. Durations and how to refuse them are in the cookie policy. Law 41/2004 requires prior consent for anything that is not strictly necessary. If we later enable analytics, the notice will ask for that consent before they are switched on.

Children

The shop is aimed at adults. In Portugal, a child's consent for information-society services is valid only from the age of 13 (Article 16 of Law 58/2019). We do not seek children's data. If we learn that we hold it without a legal basis, we delete it.

Your rights

You may ask for access, rectification, erasure, restriction and portability of data you gave us under the contract or consent. You may object to processing based on legitimate interests and, in any case, to direct marketing. You may withdraw consent. You may ask a person to review an order blocked only by automated means.

We reply within one month. That period can be extended by two further months when a request is complex. We may ask for information to confirm you are the person concerned. The request is free, unless it is manifestly unfounded or excessive.

You may complain to the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal, cnpd.pt, or to the authority in the country where you live or work. You may also go to court.

Automated decisions

We do not run credit scoring or take legal decisions by algorithm alone. Anti-abuse verification, when it is on, may block a payment, a subscription or a login that looks automated. You can write to us and a person will look at the request.

Security

We apply technical and organizational measures suited to the risk: restricted access, an irreversible password, protected connections and providers bound to confidentiality. No system is free of risk. If a breach is likely to risk your rights, we tell you and, when the law requires it, we tell the CNPD.

Changes

We publish the new version on this page, with the date. If a change needs new consent, we ask before using the data for the new purpose.

Contact

Privacy questions: admin@birdofparadise.pt.