Privacy policy
Last updated: 29 August 2026
This Privacy Policy explains how Aquiroma Lda collects, uses, shares and protects personal data when you visit our website, place an order, create an account, contact us, submit a complaint or subscribe to our communications.
We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation, GDPR, and applicable Portuguese data protection and electronic communications legislation.
1. Who We Are
The controller responsible for the processing of your personal data is:
Aquiroma Lda
Travessa Fala Só 13B
1250 109 Lisbon
Portugal
Registration and legal person number, NIPC: 519099974
VAT number: PT519099974
Email: info@aquiroma.com
Phone: +351 913 610 064
Questions concerning privacy or the use of your personal data may be sent to the contact details above.
2. Personal Data We Collect
The personal data we collect depends on how you interact with Aquiroma.
Information You Provide
This may include:
Name and surname
Billing and delivery address
Email address
Phone number
Company name, VAT number and professional information where relevant
Products ordered and order history
Account information where you create a customer account
Messages, enquiries and correspondence
Return, refund and complaint information
Marketing preferences
Information provided when submitting a review
Any other information you voluntarily provide to us
Payment and Transaction Information
Payments are processed through Shopify and the payment providers available through our store.
We may receive transaction information such as payment status, payment method and information necessary to identify or manage a transaction.
Aquiroma does not normally receive or store complete payment card numbers.
Information Collected Automatically
When you use our website, certain technical information may be collected automatically, including:
IP address
Device type
Browser type
Operating system
Approximate location derived from technical information
Pages viewed
Referring pages
Interactions with the website
Date and time of access
Cookie and similar technology identifiers
Non essential cookies and tracking technologies are used only where permitted by applicable law and, where required, after consent has been provided.
Information From Third Parties
We may receive information from third parties involved in providing our services, including:
Shopify
Payment providers
Shipping and logistics companies
Fraud prevention services
Marketing and communication providers
Customer service providers
Such information may include payment status, fraud screening information, delivery status and other information necessary to complete or support a transaction.
3. Why We Process Personal Data
We process personal data only where we have a lawful basis for doing so.
Orders and Customer Service
We process personal data to:
Process orders
Take payment
Prepare invoices
Arrange delivery
Communicate about an order
Provide customer service
Handle returns and refunds
Legal basis:
Performance of a contract or steps taken at your request before entering into a contract.
Legal and Regulatory Obligations
We may process personal data where necessary to comply with obligations relating to:
Tax
Accounting
Invoicing
Customs
CITES requirements where applicable
Consumer protection
Product and transaction records
Complaints and dispute resolution
Legal basis:
Compliance with a legal obligation.
Fraud Prevention and Security
We may process information to detect fraudulent transactions, misuse, security incidents or other unlawful activity.
Legal basis:
Our legitimate interests in protecting Aquiroma, our customers and our services.
Marketing Communications
Where you have subscribed to marketing communications, we may use your contact information to send newsletters, product information, educational content and commercial communications.
Legal basis:
Your consent where consent is required.
Where permitted by applicable law, we may also contact existing customers regarding products or services similar to those previously purchased.
You may unsubscribe from marketing communications at any time using the unsubscribe option provided in the communication or by contacting us at info@aquiroma.com.
Objecting to or unsubscribing from marketing does not affect transactional communications relating to an order or customer service request.
Website Analytics and Improvement
We may use analytics to understand how visitors use our website and to improve its performance, navigation and content.
Where analytics involve non essential cookies or similar tracking technologies, processing is based on your consent where required.
Legal Claims
We may process personal data where necessary to establish, exercise or defend legal claims.
Legal basis:
Our legitimate interests in protecting our legal rights.
4. When Personal Data Is Required
Certain personal data is necessary to process an order or comply with legal obligations.
For example, we normally require your name, delivery details, contact information and information necessary to process payment.
If required information is not provided, we may be unable to process or fulfil the order.
Providing information for marketing purposes is optional.
5. Who We Share Personal Data With
We share personal data only where reasonably necessary for the purposes described in this Privacy Policy.
Recipients may include:
Shopify
Shopify provides the ecommerce platform that powers our online store.
Depending on the service being provided, Shopify may process certain personal data on our behalf or may process certain information as an independent controller under its own privacy terms.
Payment Providers
Payment providers process information necessary to authorise and manage payments.
Certain payment providers may act as independent controllers of personal data for their own regulatory, fraud prevention and payment processing obligations.
Delivery and Logistics Providers
We provide carriers and logistics providers with information necessary to deliver orders, such as your name, address, phone number and shipment details.
Professional Service Providers
We may share necessary information with:
Accountants
Auditors
Tax advisers
Legal advisers
IT providers
Security providers
Customer service providers
Marketing and email providers
Where a provider acts as a processor on our behalf, appropriate contractual and data protection arrangements are used as required by law.
Public Authorities
Personal data may be disclosed where required by law to authorities including:
Portuguese tax authorities
Customs authorities
CITES or environmental authorities
Courts
Regulators
Law enforcement authorities
Consumer protection and dispute resolution bodies
We do not sell personal data to third parties.
6. Shopify and Our Online Store
Our online store is hosted and operated using Shopify.
Shopify processes personal data necessary to provide ecommerce services to Aquiroma.
Depending on the Shopify services and features used, Shopify may act as a processor on our behalf or as an independent controller for certain processing activities.
Customers may also have privacy rights directly in relation to processing carried out independently by Shopify.
Further information about Shopify's own processing is available through Shopify's privacy information and privacy controls.
7. International Transfers
Some of the service providers used by Aquiroma or Shopify may process personal data outside the European Economic Area.
Where personal data is transferred outside the European Economic Area, appropriate safeguards are used as required by Chapter V of the GDPR.
These safeguards may include:
An adequacy decision adopted by the European Commission
Standard Contractual Clauses approved by the European Commission
Other transfer mechanisms permitted by applicable data protection law
Additional technical or organisational safeguards where appropriate
You may contact us for further information about safeguards applicable to international transfers involving your personal data.
8. How Long We Keep Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with legal obligations.
Orders, Invoices and Accounting Records
Records required for Portuguese tax, accounting and commercial purposes are generally retained for the legally required period, which is currently 10 years for relevant accounting and supporting records.
Customer Accounts
Customer account information is normally retained while the account remains active and for a reasonable period afterwards, subject to applicable legal obligations.
Customer Service and Correspondence
Correspondence is retained for as long as reasonably necessary to resolve the relevant matter and for any subsequent legal or administrative period that may apply.
Returns, Complaints and Legal Claims
Information relating to returns, complaints, disputes or claims may be retained for the period necessary to resolve the matter and for the applicable limitation period.
Marketing Information
Marketing information is retained until you withdraw consent, unsubscribe or object to receiving marketing communications.
We may retain limited information afterwards to ensure that your preference not to receive marketing communications is respected.
Cookies and Analytics
Cookie and analytics information is retained according to the duration applicable to the particular cookie or technology.
Where personal data is no longer required, it is deleted, anonymised or otherwise securely disposed of where appropriate.
9. Your Data Protection Rights
Subject to the conditions and limitations established by the GDPR, you may have the right to:
Access your personal data
Obtain correction of inaccurate or incomplete personal data
Request erasure of personal data
Request restriction of processing
Object to processing based on legitimate interests
Object at any time to processing for direct marketing
Receive certain personal data in a structured, commonly used and machine readable format
Request transmission of eligible data to another controller where technically feasible
Withdraw consent at any time where processing is based on consent
Lodge a complaint with a competent data protection authority
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise your rights, contact:
We may request information reasonably necessary to confirm your identity before responding to a request.
We normally respond within one month of receiving a valid request.
Where permitted by the GDPR, this period may be extended by up to two additional months because of the complexity or number of requests. If an extension is required, we will inform you.
10. Right to Object to Marketing
You have the right to object at any time to the use of your personal data for direct marketing.
You can do this by:
Using the unsubscribe link included in a marketing email
Changing available communication preferences
Contacting info@aquiroma.com
Once you unsubscribe, we will stop sending the relevant marketing communications, subject to the time reasonably required to process your request.
11. Complaints to a Data Protection Authority
If you believe that Aquiroma has processed your personal data in breach of applicable data protection law, you may lodge a complaint with:
Comissão Nacional de Proteção de Dados
CNPD
Portugal
Official website: www.cnpd.pt
Where applicable, you may also contact the competent supervisory authority in the European Union country where you normally live, work or where the alleged infringement occurred.
We encourage you to contact us first where possible so that we have an opportunity to address your concern.
12. Automated Decision Making
Aquiroma does not itself make decisions that produce legal effects or similarly significant effects on customers based solely on automated processing.
Payment providers, Shopify or fraud prevention services may use automated systems to assess transactions or detect suspected fraud.
Where such processing is carried out independently by another provider, that provider's own privacy terms and applicable data protection obligations apply.
If an order or payment is affected by automated fraud screening, you may contact us for assistance regarding the order.
13. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
Essential Cookies
Certain cookies are necessary for functions such as:
Shopping cart operation
Checkout
Security
Authentication
Remembering essential selections
These cookies may be used without consent where they are strictly necessary to provide a service requested by the user.
Non Essential Cookies
Analytics, advertising, marketing and other non essential cookies or tracking technologies are used only where permitted by applicable law and, where required, after you have provided consent.
You may accept, reject or manage non essential cookies through the cookie preferences available on the website.
You may change or withdraw your consent at any time.
Refusing non essential cookies does not prevent you from making a purchase, although certain optional website features may operate differently.
Further information about the cookies used on the website is available through our cookie settings or Cookie Policy where provided.
14. Shopify Privacy Controls
Certain Shopify services may involve additional data processing by Shopify.
Where applicable, customers may be able to exercise certain preferences or privacy rights directly through Shopify's privacy controls in addition to contacting Aquiroma.
Requests relating specifically to an Aquiroma order or customer relationship should normally be sent to:
15. Children
Our online store is intended for adults and is not directed at children.
We do not knowingly seek to collect personal data from children through our online store.
If we become aware that personal data has been provided by a child in circumstances where its processing is not lawful, we will take appropriate steps to delete or otherwise address that information.
16. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Measures may include, where appropriate:
Encrypted network connections
Access controls
Secure service providers
Account security controls
Technical monitoring and security measures
No internet based system can guarantee absolute security, but we take reasonable measures appropriate to the nature and risks of the personal data processed.
Where a personal data breach occurs, we will take the actions required by applicable data protection law, including notification to the competent supervisory authority or affected individuals where legally required.
17. Changes to This Privacy Policy
We may update this Privacy Policy where necessary because of changes to our processing activities, service providers, website functionality or applicable law.
The current version will be made available on our website together with the date of the latest update.
Where a change materially affects the way we process personal data, additional notice may be provided where appropriate.
18. Contact
For questions about this Privacy Policy or the processing of your personal data, contact:
Aquiroma Lda
Travessa Fala Só 13B
1250 109 Lisbon
Portugal
NIPC: 519099974
VAT number: PT519099974
Email: info@aquiroma.com
Phone: +351 913 610 064