Skip to content
Malmequer

Privacy Policy

Data collected

We only collect the data strictly necessary to process orders and communicate with you: name, email address, shipping address, and payment information.

How we use your data

Your data is used exclusively to process orders, send delivery status updates, and, if you've given explicit consent, send marketing communications.

We only send emails that aren't about one of your orders with your consent: the newsletter, if you subscribe (you can unsubscribe at any time through the link at the bottom of every email), and a single reminder if you don't complete a purchase, only if you tick that option at checkout. The reminder is sent once, when the payment expires, and we won't contact you about that order again.

Sub-processors and data sharing

We do not sell your personal data. We only share the minimum necessary with the following service providers, each GDPR-compliant:

  • Stripe — payment processing (credit/debit card, MB Way, Multibanco, Apple Pay, Google Pay, Samsung Pay, Amazon Pay, and Link). Payment data is handled directly by Stripe and never stored on our servers.
  • Neon / Vercel — database and application hosting, on servers located in the European Union.
  • Resend — transactional email delivery (order confirmation, account access link) and, with your consent, the newsletter and the unfinished-purchase reminder.
  • Cloudinary — product image hosting and optimization.
  • Google Analytics — traffic and behaviour analysis on the site, only active with your consent.
  • Meta Pixel — advertising campaign measurement on Facebook/Instagram, only active with your consent.
  • Google (sign-in) — if you choose to sign in with your Google account, Google processes the authentication data. Distinct from Google Analytics, which is only used with consent.
  • Upstash — request rate-limiting to prevent abuse; temporarily processes your IP address.
  • Sentry — technical error monitoring, to detect and fix site issues.
  • Moloni — invoice issuance, where applicable, to comply with tax obligations.

International data transfers

Neon and Vercel host the application and database on servers in the European Union. Other providers listed above — Stripe, Resend, Google, Meta, and Sentry — are US-based companies and may process data outside the European Economic Area, under GDPR-recognised transfer mechanisms (such as the EU-US Data Privacy Framework or standard contractual clauses).

Cookies

This site uses cookies and local storage strictly necessary for authentication, shopping cart functionality, your wishlist, and your recently-viewed products history — all stored only on your device. With your explicit consent (cookie banner), we also use Google Analytics and Meta Pixel to understand how the site is used and measure the effectiveness of advertising campaigns. You can accept or reject these cookies at any time — including after your first visit, via the "Cookie Preferences" link in the footer; rejecting does not affect your ability to use the site.

Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to access, correct, export, or request the deletion of your personal data. To exercise any of these rights, contact us at geral@malmequer.pt.

Data retention

Order data is retained for the minimum period required by Portuguese tax law (10 years). Account data is deleted upon request, unless a legal obligation to retain it applies.

Contact

Malmequer · Tax ID (NIF) 250903326 · geral@malmequer.pt