Privacy policy

Last updated: 19 June 2026

1. Introduction

Ninho do Tejo respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your information when you visit or make a purchase on our website ninhodotejo.pt.

This policy complies with the General Data Protection Regulation (Regulation EU 2016/679 — GDPR) and with Law no. 58/2019 of 8 August, which ensures the implementation of the GDPR in Portugal.

2. Data controller

Company name: Ninho do Tejo, Lda. VAT no.: 519 094 484 Registered office: Rua das Perdizes 38, 2925-718 Azeitão, Portugal

Contact email for privacy matters: geral@ninhodotejo.pt

3. Personal data we collect

We collect the following personal data, whenever it is strictly necessary for the purpose in question:

Identification and contact data: full name, email address, telephone number.

Billing and delivery data: billing address, delivery address, tax identification number (NIF), when provided by the customer for invoicing.

Order data: order history, products purchased, payment methods used (we do not store credit card data — these are processed directly by our payment partners).

Browsing data: IP address, browser type, device used, pages visited, time spent. This data is collected through technical cookies essential to the operation of the website.

Interaction data for advertising purposes (only with consent): when you grant us authorisation through the cookie banner, we also collect information about the product pages viewed, items added to the cart, checkout processes started and purchases made. This data may include pseudonymised identifiers (obtained by irreversible encryption of your contact details) that allow our advertising partners, in particular Meta Platforms, to associate your activity on our website with the possible display of ads on Facebook and Instagram. The technical detail of this sharing is described in section 6.

4. Purposes of processing and legal bases

Your data is processed for the following purposes and on the basis of the following legal grounds:

Performance of the sales contract — to process orders, issue invoices, ship products and manage returns or exchanges. Legal basis: Article 6(1)(b) of the GDPR (performance of a contract).

Compliance with legal obligations — to issue and archive tax documents and respond to requests from the competent authorities. Legal basis: Article 6(1)(c) of the GDPR (legal obligation).

Communication with the customer — to answer questions, provide after-sales support and inform about the status of orders. Legal basis: Article 6(1)(b) of the GDPR (performance of a contract) or (f) (legitimate interest).

Legitimate interest in improving the service — for internal analysis of the shop's performance and fraud prevention. Legal basis: Article 6(1)(f) of the GDPR (legitimate interest).

Personalised advertising and campaign measurement — to show you relevant ads on Meta's platforms (Facebook and Instagram), assess the effectiveness of our advertising campaigns and avoid showing you content that is not of interest to you. Legal basis: Article 6(1)(a) of the GDPR (consent). This processing only takes place after your explicit consent in the cookie banner, with consent being revocable at any time as described in sections 8 and 9.

5. Data retention periods

We keep your personal data only for as long as strictly necessary for the purposes for which it was collected:

Billing and order data: 10 years, as required by Portuguese tax law (VAT Code).

Contact data and preferences: for as long as the customer keeps an active account or until deletion is requested.

Browsing data: up to 13 months, the maximum period recommended by the National Data Protection Commission for analytics cookies.

Data shared with advertising partners: the data shared with Meta Platforms for advertising purposes is kept by Meta in accordance with its own retention policies, typically up to 2 years for event data. The user may, at any time, ask Meta to delete this data through the "Off-Facebook Activity" feature (see section 6).

6. Sharing data with third parties

Your personal data may be shared with the following partners, strictly for the purpose of providing the service:

Shopify, Inc. — the e-commerce platform that hosts our shop. Shopify is certified under the European Union's Standard Contractual Clauses. Shopify's Privacy Policy.

IFTHENPAY, Lda. — MB WAY and Multibanco payment processor. Transaction data is processed directly by IFTHENPAY, without banking data being shared with us.

Batch (itsBatch) — the courier responsible for dispatching and delivering orders, which may subcontract postal operators for the final delivery. Only the data needed for delivery is shared (name, address, telephone).

Moloni — Portuguese invoicing platform. It receives the data needed to issue the invoice-receipt (name, address, NIF where applicable).

Meta Platforms Ireland Limited (operator of Facebook and Instagram in the European Union) — only with your explicit consent in the cookie banner, we use two complementary technologies provided by Meta:

  • Meta Pixel — a small piece of JavaScript code installed on our website that, through your browser, records events such as product page views, items added to the cart, checkout started and purchases made.

  • Conversions API (CAPI) — a complementary technology that allows our server (through Shopify) to communicate directly with Meta's servers, in order to ensure the integrity and accuracy of the same events, even when the Meta Pixel is blocked by your browser.

The data shared with Meta includes information about your interaction with the site (pages visited, items viewed, purchase events) and, where applicable, your email address, telephone number and address, always previously encrypted using an irreversible hash function (SHA-256). Meta uses this data to identify its users and show them ads from Ninho do Tejo, as well as to provide us with aggregated statistics on the performance of our campaigns.

You may disable this data sharing at any time, regardless of your initial consent, through two mechanisms:

  1. By withdrawing consent for marketing cookies in the cookie banner available on our site.
  2. By accessing your Facebook account and using the "Off-Facebook Activity" feature (Settings and privacy → Your Facebook information → Off-Facebook activity), where you can turn off the association between your activity on third-party sites and your Meta profile.

We never sell or transfer your personal data to third parties for commercial purposes.

7. International data transfers

Some of our partners process data on servers located outside the European Economic Area. This is the case for Shopify, Inc. (Canada and the United States) and Meta Platforms Ireland Limited (which, although based in Ireland, may transfer data to infrastructure in the United States). In these cases, we ensure that adequate safeguards are in place, in particular through the Standard Contractual Clauses approved by the European Commission and, in Meta's case, adherence to the EU-U.S. Data Privacy Framework.

8. Your rights

Under the GDPR, the data subject has the right to:

  • Access their personal data.
  • Rectify incorrect or outdated data.
  • Erase their data (right to be forgotten), where applicable.
  • Restrict the processing of their data in certain circumstances.
  • Data portability, in a structured, machine-readable format.
  • Object to processing based on legitimate interest.
  • Withdraw consent given previously, without affecting the lawfulness of prior processing.

To exercise any of these rights, simply send an email to geral@ninhodotejo.pt. We will respond within a maximum of 30 days.

If you consider that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the National Data Protection Commission (CNPD): www.cnpd.pt.

9. Cookies

Our website uses cookies to ensure the basic operation of the shop, to improve your experience and, with your consent, for personalised advertising purposes. We distinguish three categories:

Essential technical cookies — necessary for the operation of the site (maintaining the shopping cart, session authentication, language preferences). They do not require consent.

Analytics cookies — help us understand how visitors use the site, in an aggregated and anonymous way. They require consent.

Marketing and advertising cookies — include the cookies installed by the Meta Pixel and allow us to show you relevant ads on Facebook and Instagram. They require explicit consent.

You can manage your cookie preferences at any time through the consent banner available on the site. Refusing marketing cookies does not affect your ability to browse the site or make purchases — it only disables the personalisation of the advertising directed at you.

10. Security

We adopt appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or alteration. All communication between your browser and our website is encrypted using the SSL protocol.

11. Changes to this Policy

This Privacy Policy may be updated periodically. The date of the last update is shown at the top of the document. Substantial changes will be communicated by email or through a prominent notice on the site.