Your data
Privacy policy
This policy explains what personal data we collect when you visit dearlume.shop or buy from us, why, and what rights you have under the GDPR and Portuguese Law 58/2019.
1. Controller
CONFECÇÕES VIRGINIA CASTRO, LDA (brand: Dearlume), Sítio Cadilhe, 4495-111 Amorim, Póvoa de Varzim, Portugal. Contact for all privacy matters: support@dearlume.shop.
2. What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email, phone (optional), billing and delivery address, order contents | Process and deliver your order, send order emails, handle returns and guarantee claims | Contract (art. 6(1)(b) GDPR) | 10 years for invoices and accounting records (legal obligation); otherwise up to 3 years after delivery for guarantee claims |
| Payment data (handled by the payment provider) | Take payment and prevent fraud | Contract; legitimate interest in fraud prevention | As required by the provider and accounting law; we never receive full card numbers |
| Account data (if you create an account) | Let you sign in and see your orders | Contract | Until you delete the account |
| Messages you send us (contact form, email) | Answer your request | Legitimate interest / pre-contractual steps | Up to 2 years after the matter is closed |
| Technical data (IP address, browser, pages requested) in server logs | Keep the site secure and working | Legitimate interest (art. 6(1)(f)) | Up to 30 days |
| Functional cookies (cart, language, currency, cookie choice) | Make the shop work | Necessary for the service you request | See the Cookie policy |
We do not send newsletters or advertising, we do not use analytics or advertising trackers, and we do not sell personal data. No decisions are made about you by automated means.
3. Who receives your data
- Our website hosting provider, which stores the site and its database.
- The payment provider you choose at checkout (for example Stripe or PayPal, when offered), which processes the payment as an independent controller for its own legal obligations.
- The carrier that delivers your parcel (name, address, phone or email for delivery notices).
- Our email provider, and our accountant and the tax authorities where the law requires.
4. Transfers outside the EEA
Some providers (for example payment providers) may process data outside the European Economic Area, including in the United States. Such transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or on the European Commission’s standard contractual clauses. For deliveries outside the EEA, we necessarily share delivery details with carriers in the destination country.
5. Your rights
You may ask for access to your data, rectification, erasure, restriction, data portability, and object to processing based on legitimate interest. Where processing relies on consent, you may withdraw it at any time. Write to support@dearlume.shop; we reply within one month.
You also have the right to complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt, or to the authority in your own EU country.
6. Security
The site uses HTTPS encryption. Access to order data is limited to the people who need it to fulfil your order.
7. Children
Our shop is meant for adults. We do not knowingly collect data from children under 16.
8. Changes
We will update this page if the way we handle data changes. The date of the last update is shown below.
Last updated: 12 October 2026