Privacy policy

Who is responsible

Roberto Vámos, Av. Eng. Adelino Amaro da Costa 728, 6B, 2750-278 Cascais, Portugal, [email protected], is responsible for your personal data (the “data controller”).

What data, and why

• When you buy a print: your name, email, phone number, shipping and billing address, and the details of your order. They are used to make and deliver your print, to contact you about your order, and to keep the accounting records the law requires. Legal basis: performance of the contract and legal obligations.
• Payment: card and payment details are entered directly on Stripe’s secure payment page. We never see or store your card number.
• When you write to us through the contact form or by email: your name, email and message, used to reply. Legal basis: our legitimate interest in answering you, or steps you ask for before a purchase.
• Newsletter: if a newsletter is launched and you subscribe, your email is used only to send it, with your consent, which you can withdraw at any time.
• Technical data: when you visit the site, our hosting provider briefly processes your IP address and basic information about your browser, to deliver the pages and protect the site against attacks. Legal basis: legitimate interest in running a secure website.

Cookies and storage

The site uses no advertising or analytics cookies and does not track you. It keeps two things in your own browser: the contents of your cart and your preferred gallery view. This stays on your device, is not sent to us, and you can clear it at any time in your browser settings.

The site’s typeface is loaded from Google Fonts, so your browser connects to Google’s servers and Google receives your IP address.

Who receives your data

• Stripe, for payments.
• Cloudflare, which hosts and protects the website.
• Resend, which delivers order notifications and contact form messages to our inbox.
• Google Workspace, our email provider.
• Shipping carriers, which receive your name, address and phone number to deliver your print.
• Our accountant and the tax authorities, where the law requires it.

Your data is never sold or shared for marketing.

Transfers outside Europe

Some of these providers are based in, or process data in, the United States. These transfers are protected by the EU–US Data Privacy Framework and/or the European Commission’s standard contractual clauses.

How long it is kept

• Order and invoicing records: 10 years, as required by Portuguese tax law.
• Messages: as long as needed to deal with your request, and no more than two years after our last exchange.
• Newsletter: until you unsubscribe.

Your rights

You can ask to see, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Just write to [email protected].

You also have the right to complain to the Portuguese data protection authority, CNPD (www.cnpd.pt), or to the authority in your own country.

Changes

If this policy changes, the new version will be published here with its date.