Privacy policy

Privacy Policy

Last updated: 26 September 2026.

This policy explains what personal data we collect when you visit stonedcompany.pt, make a purchase or get in touch with us, what we use it for, who we share it with and what rights you have over it.

1. Who is responsible for your data

The data controller is Stoned Company Lda., NIPC 518190544, with its registered office at Arruamento Impasse da Quinta de Sant'Ana, n.º 2, 9200-075 Machico, Madeira. For any question about your data, write to us at geral@stonedcompany.pt.

2. What data we collect

  • Contact and order data: name, billing and delivery address, email, telephone, tax number (NIF, if you request it on the invoice), products purchased and payment confirmation.
  • Account data, if you create an account: email, name and order history.
  • Messages you send us through the contact form or by email.
  • Browsing data: IP address, device and browser type, pages visited and interaction with our emails, collected through cookies and similar technologies.

We do not receive or store your card details. Payment is handled directly by Viva.com.

3. What we use your data for and on what legal basis

  • Processing and delivering orders, including payments, shipping, in-store pickup, returns and guarantees. Legal basis: performance of the purchase contract.
  • Complying with legal obligations, such as invoicing and accounting. Legal basis: legal obligation.
  • Replying to your messages and providing customer support. Legal basis: our legitimate interest in replying to you and, where the message concerns an order, performance of the contract.
  • Sending the newsletter and promotions by email. Legal basis: your consent, which you give when subscribing and may withdraw at any time. If you leave a purchase unfinished at checkout, we may send you a reminder email, based on our legitimate interest; every email includes a link to stop receiving them.
  • Security and fraud prevention on the website and in payments. Legal basis: our legitimate interest in protecting the shop and its customers.
  • Statistics and website improvement. Legal basis: your consent, where non-essential cookies are concerned.

4. Cookies

We use essential cookies for the website to work (basket, checkout, session) and, if you accept them, statistics and marketing cookies. You can choose in the cookie notice that appears when you enter the website and change your choice in your browser settings. Blocking essential cookies may stop the basket and checkout from working. More information about the platform's cookies is available at shopify.com/legal/cookies.

5. Who we share your data with

We do not sell your data. We share only what is necessary with those who provide services to us:

  • Shopify, the online shop platform, which also sends our emails;
  • Viva.com, which processes payments;
  • CTT, which delivers orders;
  • our invoicing software and accountant, to meet our tax obligations;
  • public authorities, where required by law.

Some of these providers, such as Shopify, may process data outside the European Economic Area. In such cases, the transfer is protected by an adequacy decision of the European Commission or by the standard contractual clauses approved by the Commission.

6. How long we keep your data

  • Invoices and tax data: 10 years, as required by law.
  • Order data: for the duration of the guarantee (3 years) and the period for any claims.
  • Customer account: for as long as you keep it active. You can ask us to delete it.
  • Newsletter: until you unsubscribe.
  • Support messages: up to 2 years after the last email exchange.

7. Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

  • access the data we hold about you;
  • correct inaccurate or incomplete data;
  • ask us to erase your data, except data we are required by law to keep;
  • restrict or object to certain processing, including marketing;
  • receive your data in a commonly used format (portability);
  • withdraw your consent at any time, without affecting the processing carried out before then.

To exercise any of these rights, write to us at geral@stonedcompany.pt. We reply within one month. We may ask you for information to confirm your identity.

If you believe your data is not being handled properly, you may lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD) at cnpd.pt.

8. Minors

The shop is intended for persons aged 18 and over. We do not knowingly collect data from minors. If you become aware that a minor has given us personal data, let us know and we will delete it.

9. Security

The website uses an encrypted connection (HTTPS) and access to data is limited to those who need it for their work. No system is completely secure; if you create an account, choose a strong password and do not share it.

10. Changes to this policy

We may update this policy to reflect changes in the law or in the way we work. The current version is always available on this page, with the date of the last update.

11. Contact

Stoned Company Lda. · geral@stonedcompany.pt · Arruamento Impasse da Quinta de Sant'Ana, n.º 2, 9200-075 Machico