Privacy Policy

1. Who we are

This Privacy Policy explains how Bruno Gaiteiro, a sole trader (empresário em nome individual) operating under the trade name ShopWhizzy ("ShopWhizzy", "we", "us"), collects and uses personal data when you visit shopwhizzy.com, contact us, or buy our products and services.

Data controller: Bruno Gaiteiro (ShopWhizzy), Rua Gil Vicente, 4505-130 Santa Maria da Feira, Portugal. VAT number: PT212230913. Email: info@shopwhizzy.com.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Portuguese law that implements it (Law 58/2019).

2. What data we collect

• Data you give us: your name, company, email address, phone number, billing address and VAT number, your account login, and what you write to us in forms, emails or support requests.
• Order and invoicing data: the products and services you buy, invoices and payment status. Card and wallet payments are handled by Stripe and PayPal; we never see or store your full card details.
• Project data: when you hire us, information you share so we can do the work, such as access to your servers or store administration.
• Technical data: your IP address, browser and device in our server logs, used for security and to keep the site working.
• Usage data: which pages are visited and how the site is used, as described in section 9 and in our cookie policy.

3. Why we use your data and on what legal basis

• To answer your requests and provide our services (quotes, orders, hosting, development, support, your customer account): performance of a contract or steps before a contract.
• To issue invoices and keep accounting records: compliance with our legal obligations.
• To keep the site and our servers secure, prevent fraud and spam (including Google reCAPTCHA on forms), and to measure visits with our own cookieless analytics: our legitimate interests.
• To send you news and offers about our services: your consent, or our legitimate interest when you are already a customer. You can unsubscribe at any time.
• Analytics and marketing cookies, session recordings and heatmaps: your consent, given in the cookie notice.

4. Data we process for our clients

When we host, develop or manage an online store for a client, we may have access to the personal data of that client's own customers. In that case the client is the data controller and we act only as a processor, following the client's instructions and the agreement we have with them. Questions about that data should be sent to the store concerned.

5. Who we share data with

We do not sell your personal data. We only share it with the providers we need to run our business, and only as much as they need:

• Hosting: Hetzner Online GmbH, whose data centres in Germany host our website, our own analytics and our customers' servers.
• Payments: Stripe, PayPal and Blockonomics (for Bitcoin payments), and our bank for bank transfers.
• Website tools: Google (Tag Manager, Analytics and reCAPTCHA), for statistics, security and site improvement.
• Email and communication providers that deliver our messages.
• Our accountant and the tax authorities, where required by law, and courts or other authorities when we are legally obliged to do so.

6. Transfers outside the European Union

Some of these providers (for example Google, Stripe and PayPal) may process data outside the European Economic Area, mainly in the United States. In those cases the transfer is protected by the EU-US Data Privacy Framework or by the Standard Contractual Clauses approved by the European Commission.

7. How long we keep your data

• Customer account and contract data: for as long as you are a customer, and afterwards for as long as needed to deal with possible claims.
• Invoices and accounting records: 10 years, as required by Portuguese tax law.
• Messages and quote requests that do not lead to a contract: up to 2 years.
• Newsletter subscriptions: until you unsubscribe.
• Server logs: for a short period, normally no more than a few weeks.
• Session recordings: 30 days, after which they are deleted automatically.

8. Security

We manage our own servers and protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), regular security updates, firewalls, key-based access to servers, restricted access to data for the people who need it, and regular backups. If a personal data breach occurs that is likely to put your rights at risk, we will notify the Portuguese data protection authority (CNPD) and, where required, the people affected, as the law requires.

9. Cookies and analytics

We measure visits with Umami, a cookieless analytics tool that we host ourselves. Other cookies, analytics tools, session recordings and heatmaps are only used with your consent. You can find the full details, and how to change your choice, in our privacy and cookie policy.

10. Your rights

You have the right to access your personal data and get a copy of it, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time, without affecting the processing carried out before. We do not make decisions about you based solely on automated processing.

To exercise any of these rights, email us at info@shopwhizzy.com. It is free of charge and we will reply within one month. If we have reasonable doubts about who is making the request, we may ask you to confirm your identity. You can also update most of your details in My Account.

If you think we have not handled your data correctly, you can lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt) or with the data protection authority of the country where you live.

11. Children

Our services are aimed at businesses and professionals. We do not knowingly collect personal data from anyone under 16.

12. Changes to this policy

We may update this Privacy Policy. The current version is always published on this page, with the date of the last update at the top.