Privacy policy

PRIVACY POLICY — BRILHAH

Last updated: 2 September 2026

BRILHAH respects the privacy of its customers and visitors and processes personal data in accordance with the General Data Protection Regulation (GDPR), applicable Portuguese law and other relevant rules on privacy and electronic communications.

This Policy explains what personal data may be processed, for what purposes, on what legal basis, with whom it may be shared, how long it may be retained and what rights data subjects have.

1. DATA CONTROLLER

Trading name:

BRILHAH

Owner / data controller:

André Luís Correia de Bettencourt Gaspar

Tax Identification Number (NIF):

247546348

Address:

Rua das Alminhas, n.º 17

3505-471 Viseu

Freguesia de Rio de Loba

Portugal

Email:

brilhahiashop@gmail.com

Telephone / WhatsApp:

+351 920 309 070

For privacy-related questions or to exercise your rights, please preferably use the email address above.

2. PERSONAL DATA WE MAY PROCESS

Depending on how you interact with BRILHAH, we may process data such as:

– name;

– email address;

– telephone number;

– billing address;

– delivery address;

– order-related information;

– products purchased;

– purchase history;

– payment status and references;

– communications with BRILHAH;

– return, refund or warranty requests;

– IP address;

– device type;

– browser;

– technical identifiers;

– usage and browsing data;

– privacy and marketing preferences;

– information collected through cookies and similar technologies where legally permitted.

Complete payment-card details are normally processed directly by the relevant payment providers and are not stored in full by BRILHAH.

3. HOW WE COLLECT DATA

We may collect data directly when a user:

– visits the store;

– creates an account;

– places an order;

– starts checkout;

– provides delivery or billing details;

– contacts customer support;

– requests a return or refund;

– subscribes to communications;

– participates in a promotion;

– uses store features;

– chooses cookie or privacy preferences.

We may also receive certain data from service providers involved in store operations, including Shopify, payment providers, carriers, suppliers, logistics partners and technology tools used by BRILHAH.

4. PURPOSES OF PROCESSING

Personal data may be processed to:

– process orders;

– confirm and manage payments;

– arrange dispatch and delivery;

– provide order status information;

– provide customer support;

– manage returns and refunds;

– handle complaints and warranties;

– prevent fraud and misuse;

– comply with tax, accounting and legal obligations;

– protect store systems and security;

– improve store operation and customer experience;

– analyse performance and conversions where legally permitted;

– personalise content where a valid legal basis exists;

– carry out marketing where an appropriate legal basis exists;

– defend BRILHAH's rights and legitimate interests.

5. LEGAL BASES

Depending on the circumstances, processing may be based on:

a) Performance of a contract

Where processing is necessary to place an order, process payment, arrange delivery, handle a return or another request connected to a purchase.

b) Compliance with a legal obligation

Where BRILHAH must retain or communicate certain data to comply with tax, accounting, consumer-protection or other legal obligations.

c) Legitimate interests

Where necessary for security, fraud prevention, protection of the business, service improvement or defence of rights, provided the rights and fundamental freedoms of the data subject do not override those interests.

d) Consent

Where processing legally depends on consent, including in certain cases involving marketing, cookies, analytics or advertising.

Where consent is the legal basis, it can be withdrawn at any time as easily as it was given, without affecting the lawfulness of processing carried out before withdrawal.

6. SHOPIFY

The BRILHAH store uses the Shopify platform to provide and manage its online store.

Shopify processes data necessary to provide its services, including information relating to accounts, devices, customers, orders, checkout, payments and use of the platform, in accordance with its own legal and contractual obligations.

Using Shopify does not remove BRILHAH's own responsibilities for processing activities for which BRILHAH is responsible.

7. SERVICE PROVIDERS AND RECIPIENTS

Data may be shared, only to the extent necessary, with parties such as:

– Shopify;

– payment providers;

– suppliers;

– fulfilment partners;

– carriers;

– logistics operators;

– email services;

– customer-support services;

– hosting and infrastructure providers;

– security and fraud-prevention services;

– analytics tools;

– marketing and advertising platforms where applicable;

– accountants, consultants or legal advisers;

– public authorities where required by law.

BRILHAH seeks to limit disclosure to the data necessary for the relevant purpose.

8. DROPSHIPPING AND FULFILMENT

Some products may be prepared and dispatched directly by suppliers or logistics partners.

To process and deliver an order, it may be necessary to provide data such as:

– name;

– delivery address;

– telephone number;

– product and variant purchased;

– quantity;

– order reference.

The use of these logistics partners does not change BRILHAH's responsibility towards the customer in relation to the sale.

9. INTERNATIONAL DATA TRANSFERS

Some service providers, suppliers or partners may process data outside the European Economic Area.

Where an international transfer of personal data is subject to the GDPR, legally appropriate safeguards will be used, which may include:

– an adequacy decision by the European Commission;

– Standard Contractual Clauses;

– other safeguards recognised by applicable law.

Data subjects may request further information about applicable safeguards at:

brilhahiashop@gmail.com

10. COOKIES AND SIMILAR TECHNOLOGIES

The store uses cookies and similar technologies that are necessary for its operation, including to:

– maintain sessions;

– manage the shopping basket;

– process checkout;

– maintain security settings;

– save necessary preferences.

Analytics, advertising, personalisation or measurement cookies and technologies that legally require consent should not be activated before a valid user choice has been made.

Users can manage their choices through the privacy or consent tools made available in the store.

Refusing non-essential cookies should not prevent the use of essential store functions.

11. MARKETING AND COMMERCIAL COMMUNICATIONS

BRILHAH may send promotional communications only where an appropriate legal basis exists.

Where consent is used, the user may withdraw consent or unsubscribe at any time.

Opting out of marketing does not prevent necessary communications relating to:

– orders;

– payments;

– delivery;

– security;

– returns;

– warranties;

– legal obligations.

12. DATA RETENTION

Personal data are retained only for as long as necessary for the purposes for which they are processed and for periods required by applicable law.

When determining retention periods, factors may include:

– duration of the commercial relationship;

– tax and accounting obligations;

– warranty periods;

– fraud prevention and investigation;

– exercise or defence of legal rights;

– existence of disputes;

– specific legal obligations.

When data are no longer required, they will be deleted, anonymised or otherwise handled as required by applicable law.

13. SECURITY

BRILHAH seeks to use technical and organisational measures appropriate to the risk to protect personal data against:

– unauthorised access;

– loss;

– misuse;

– alteration;

– disclosure;

– destruction.

No electronic system can guarantee absolute security.

14. DATA SUBJECT RIGHTS

Under applicable law and where the relevant conditions are met, data subjects may exercise rights including:

– right of access;

– right to rectification;

– right to erasure;

– right to restriction of processing;

– right to object;

– right to data portability;

– right to withdraw consent;

– right to information about processing;

– right to lodge a complaint with a supervisory authority.

Requests may be sent to:

brilhahiashop@gmail.com

BRILHAH will respond within the time limits established by the GDPR, normally within one month, subject to legally permitted extensions in justified circumstances.

15. RIGHT TO ERASURE

Data subjects may request erasure of their personal data where the legal requirements are met.

This right is not absolute.

BRILHAH may retain certain data where necessary, for example to:

– comply with tax or accounting obligations;

– comply with legal obligations;

– exercise or defend legal rights;

– prevent or investigate fraud.

16. RIGHT TO OBJECT

Where processing is based on legitimate interests, the data subject may object to the processing as provided by the GDPR.

Where data are processed for direct marketing, the data subject has the right to object to such processing.

17. AUTOMATED DECISION-MAKING

Unless expressly stated otherwise, BRILHAH does not intend to make decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.

Some payment, fraud-prevention or security providers may use automated mechanisms in accordance with their own policies.

18. CHILDREN'S DATA

BRILHAH may sell products intended for children, but the store is intended for purchases made by persons with legal capacity to enter into contracts.

BRILHAH does not seek to intentionally collect personal data from children so that they may independently make purchases through the store.

If we become aware that a child's data has been processed inappropriately, appropriate steps will be taken.

19. EXTERNAL LINKS

The store may contain links to third-party websites or services.

Those third parties have their own privacy practices and policies.

BRILHAH does not control independent processing carried out by those third parties.

20. SUPERVISORY AUTHORITY

In Portugal, the data-protection supervisory authority is:

Comissão Nacional de Proteção de Dados — CNPD

Av. D. Carlos I, 134, 1.º

1200-651 Lisboa

Portugal

Website:

www.cnpd.pt

Data subjects may lodge a complaint with the CNPD if they consider that the processing of their personal data breaches applicable law.

21. CHANGES TO THIS POLICY

This Policy may be updated to reflect:

– legal changes;

– technological changes;

– new service providers;

– new markets;

– changes to features;

– changes to BRILHAH's practices.

The latest version will be available in the store with the date of the last update.

22. CONTACT

BRILHAH

Data controller:

André Luís Correia de Bettencourt Gaspar

Tax Identification Number (NIF):

247546348

Address:

Rua das Alminhas, n.º 17

3505-471 Viseu

Freguesia de Rio de Loba

Portugal

Email:

brilhahiashop@gmail.com

Telephone / WhatsApp:

+351 920 309 070