Privacy Policy

Scope to be drafted: identity and full contact details of the controller; registered office; NIF; a dedicated privacy contact address; whether a Data Protection Officer is required and, if so, their contact. Oh! My Cod, Lda. · NIF 515 482 907 · Rua dos Bacalhoeiros 14, 5.º dto, 1100-070 Lisboa privacy@ohmycodshop.com

Scope to be drafted: data you give us (name, email, delivery and billing address, phone, NIF, order contents, messages sent through the contact form, newsletter subscription, account credentials, product reviews); data collected automatically (IP address, device and browser, pages viewed, referrer, cookie identifiers); data received from third parties (payment authorisation status from the payment provider, delivery status from carriers). Must state explicitly that we never receive or store full card details.

Scope to be drafted: each purpose listed separately — processing and delivering orders, issuing invoices, customer support, digital delivery and download link management, fraud prevention, newsletter and marketing, product reviews, statutory accounting and tax obligations, audience measurement, and site security.

Scope to be drafted: a purpose-by-purpose mapping to Article 6 — performance of a contract for orders and delivery; legal obligation for invoicing, tax and food traceability; consent for the newsletter and for non-essential cookies; legitimate interests for fraud prevention and site security, with the balancing test recorded. A table is the clearest format and is what a supervisory authority expects to see.

Scope to be drafted: categories of recipients and, for transparency, the named suppliers — the e-commerce platform, the payment provider, the invoicing provider, the carriers, the email marketing provider, the analytics provider, hosting, and the accountant. Must state that we do not sell personal data and do not share it for third-party marketing. Our processors are Shopkit (shop platform), Stripe and PayPal (payments), CTT Expresso (delivery), Google Workspace (e-mail) and Mailchimp (newsletter).

Scope to be drafted: that processors act only on our instructions under Article 28 contracts; which of them process data outside the European Economic Area; the transfer mechanism relied on for each (adequacy decision or standard contractual clauses); how a copy of those safeguards can be requested. The automatic translation feature and any analytics tool are the likely transfer points and must be checked before this section is signed off.

Scope to be drafted: a retention period per data category — order and invoicing records for the statutory accounting period; account data while the account is open plus a defined dormancy period; newsletter data until consent is withdrawn; contact form messages for a stated period; cookie data per the Cookie Policy; what is deleted and what is anonymised at the end of each period.

Scope to be drafted: access, rectification, erasure, restriction, portability, objection, withdrawal of consent at any time without affecting prior processing, and the right not to be subject to solely automated decisions. Must state how to exercise them, what identity verification we require, our response deadline of one month extendable by two, and that exercising them is free unless requests are manifestly excessive.

Scope to be drafted: a short section cross-referring to the Cookie Policy, stating that non-essential cookies are set only after consent and that consent can be withdrawn at any time through the same banner. Must not duplicate the cookie table — one source of truth, kept in the Cookie Policy.

Scope to be drafted: the technical and organisational measures in place — encryption in transit, access control, the fact that payment data is handled entirely by the payment provider, staff access on a need-to-know basis; and the personal data breach notification procedure, including the 72-hour deadline to the supervisory authority and when data subjects are informed directly.

Scope to be drafted: the minimum age to buy or to create an account; the age of consent for information society services under Portuguese law; what we do if we learn that an account belongs to a child below that age.

Scope to be drafted: how to complain to us first; the right to lodge a complaint with the Comissão Nacional de Proteção de Dados, named with its address and website; how changes to this policy are communicated; the date of the last revision, displayed and updated at every change.