Privacy policy

1. INTRODUCTION

This Privacy Policy (the “Policy”) provides an overview of how Turtle Petals, Lda (GIOCUP® brand) (“Turtle Petals”, “we”, “our”), in its capacity as data controller, collects, uses and shares your personal data in connection with the website www.giocup.pt (the “Website”) and the sale of our products (the “Products”). This Policy also explains how you can exercise your rights under Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR”) and other applicable national legislation. For the purposes of this Policy, “GIOCUP®” refers to the brand and the Website; Turtle Petals, Lda is the legally responsible entity. This Policy complements our Terms and Conditions and our Cookie Policy.

2. DATA CONTROLLER

Turtle Petals, Lda, legal person no. 516 034 790, with registered office at Zona Industrial da Jardoeira, Rua 1, Lt 316, N3, 2440-001 Batalha, is the entity responsible for determining the purposes and means of the processing of personal data carried out in connection with the Website and the Services:
・ Contact for data protection and the exercise of rights (GDPR): support@giocup.pt
・ General contacts: WhatsApp +351 925 853 551 | giocup@giocup.pt

3. PERSONAL DATA

3.1. For the purposes of the GDPR, personal data means any information, of any nature and regardless of the medium on which it is held (including sound and image), relating to an identified or identifiable natural person (the “data subject”). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to identifiers such as a name, an identification number, location data, electronic identifiers (for example, IP address, cookies or other online identifiers) or factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

3.2. In the context of the Website and the GIOCUP® Products, no special categories of data within the meaning of Article 9 of the GDPR are collected (for example, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, biometric data, or data concerning health, sex life or sexual orientation). If, in specific and exceptional circumstances, it becomes necessary to process special categories of data, this will only take place on an appropriate legal basis (including, where required, explicit consent) and subject to the adoption of enhanced technical and organisational measures. In such a case, the data subject will be informed in advance in a clear and transparent manner.

4. COLLECTION OF PERSONAL DATA

Your data is collected directly when you use the Website to purchase Products (checkout), when you contact us for support, when you fill in forms (for example, the declaration of withdrawal) and when you subscribe to the newsletter (if applicable). We only process data that is strictly necessary and provided voluntarily, as well as data generated by the use of the website www.giocup.pt, for the purposes identified below.
Whatever the method of collection, at most the following data may be collected and processed:
・ First name and surname
・ Email address
・ Age/date of birth
・ Telephone number
・ Billing and delivery address (postcode, city, country)
・ Order and transaction data (Product, price, taxes, shipping costs and status);
・ Payment information processed by the PSP, payment service provider (EU PAGO)
・ Cookies and usage data (online identifiers, IP address, technical logs, device/browser type, source of the visit, date/time, preferences in the CMP).

5. PURPOSES

The personal data described in the previous section is processed by Turtle Petals for specified, explicit and legitimate purposes, namely:
・ Management of the contractual relationship and of the account (where applicable)
◦ Creation and administration of profiles, authentication, support and transactional communications.
・ Sale of Products (e-commerce)
◦ Processing of the checkout and the order, confirmation and settlement of payments with the PSP (EU PAGO), shipping and tracking with carriers, issuing of invoices/receipts and proof of performance.
・ After-sales (returns and guarantee)
◦ Management of the exercise of the right of withdrawal and of exchanges where applicable, the legal guarantee of conformity, and the handling of complaints.
・ Compliance with legal obligations
◦ Tax/accounting and record-retention obligations; responding to administrative and judicial authorities; consumer information obligations.
・ Security and prevention of abuse/fraud
◦ Monitoring of access to and the integrity of the Website; protection against fraud; documentary verification of the integrity of the hygiene seal for the purposes of the rules on the right of withdrawal.
・ Improvement and optimisation
◦ Aggregated/de-identified analysis of usage (with analytics cookies only subject to consent) to improve features and UX.
・ Marketing and communication (optional)
◦ Sending of newsletters and promotional campaigns, in accordance with the data subject’s preferences and their consent, where required.
Where possible, we use techniques of minimisation, pseudonymisation and, where appropriate, anonymisation, to reduce the impact on your privacy.
・ Evidence and compliance
◦ Retention, for a period appropriate for evidential purposes, of evidence relating to the exercise of rights (for example, records of marketing opt-ins/opt-outs and of cookie consents) and, where strictly necessary, of minimal documentary evidence linked to withdrawal requests and to the verification of the integrity of the hygiene seal (for example, photographic records of the packaging), exclusively for the purpose of demonstrating legal and contractual compliance.

6. LEGAL BASES FOR PROCESSING

We process your personal data on the following legal bases provided for in the GDPR:
・ Performance of a contract (Art. 6(1)(b))
◦ Processing of orders, payments, shipments and related support.
・ Compliance with a legal obligation (Art. 6(1)(c))
◦ Tax/accounting obligations; responding to authorities/regulators; statutory retention periods.
・ Legitimate interest (Art. 6(1)(f))
◦ Security and integrity of the Website; fraud prevention; improvement of service and UX; management of evidence (e.g. verification of seals); and retention of evidence strictly necessary to demonstrate compliance (for example, consent logs for audit purposes and proof of compliance).
Note: Where applicable, you may object on grounds relating to your particular situation.
・ Consent (Art. 6(1)(a))
◦ Marketing communications (newsletter) and non-essential cookies (analytics/marketing).
Note: You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. For compliance purposes, GIOCUP® retains evidence of consent and of its withdrawal for an appropriate period.

7. SHARING OF DATA WITH THIRD PARTIES

7.1. We may share data with third parties that are strictly necessary for the provision of the Services, namely:
・ Payment service provider (PSP): EU PAGO (payment processing)
・ Logistics operators/carriers: for example, CTT, DHL, GLS, among others
・ Technology infrastructure/e-commerce platform and hosting: for example, Shopify, among others
・ Email marketing/CRM platform (where applicable)
・ Analytics/ads (only with consent, in accordance with the Cookie Policy and the options in the CMP)

7.2. Data may be shared with judicial, tax or regulatory authorities where required by law.

7.3. Relationships with processors are governed by contract, pursuant to Article 28 of the GDPR, ensuring:
・ Documented instructions and action in accordance with them;
・ Confidentiality and appropriate technical and organisational measures;
・ Security, minimisation and limited retention of data.

8. TRANSFER OF DATA TO THIRD COUNTRIES

8.1. We process and store data preferably within the European Economic Area (EEA). However, in connection with the operation of the Website and the sale of Products to countries outside the EEA (for example, the United States of America) and the use of certain technical platforms (for example, e-commerce, analytics or marketing solutions), data may be transferred to third countries.

8.2. Whenever a transfer is necessary (for example, a technical provider with servers outside the EEA), we ensure that such transfer will be based on an adequacy decision of the European Commission or, in the absence thereof, subject to the appropriate safeguards provided for by law, in particular the conclusion of Standard Contractual Clauses and, where necessary, supplementary measures, so as to ensure a level of protection essentially equivalent to that guaranteed within the European Union.

8.3. Where transfers result from technical integrations (for example, e-commerce platforms, analytics, advertising pixels, email marketing/CRM), the current list of providers and purposes is available in the CMP panel. You may request additional information on international transfers and the applicable safeguards via the email address support@giocup.pt.

9. PROCESSING AND SECURITY PRINCIPLES

Turtle Petals, as data controller, ensures that:
・ Processing is carried out only for specified purposes or for purposes compatible with the original purposes.
・ Only the minimum data necessary and sufficient for each purpose is collected and retained.
・ It does not transmit data for commercial or advertising purposes without an appropriate legal basis (for example, consent).
・ It implements security measures proportionate to the risk, including access control, activity logs, encryption in transit where applicable, backups, retention policies and incident response, with notification to the CNPD and to data subjects where required by law.
・ It maintains databases with access strictly limited to the employees and processors who need them for their intended purposes, who are bound by confidentiality obligations.

10. RETENTION PERIODS FOR PERSONAL DATA

10.1. We only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, in accordance with the principles of data minimisation and storage limitation set out in the GDPR.

10.2. Following the termination of the contractual relationship, or when the data is no longer necessary for the purposes for which it was collected, it ceases to be processed for commercial purposes and is securely deleted or anonymised, except where its retention is required to comply with legal obligations, for the exercise or defence of rights in administrative or judicial proceedings, or for audit and compliance purposes.

10.3. Retention periods vary according to the category of data, the purpose of the processing and the applicable legal requirements. As a rule, data associated with orders and invoicing is retained until the end of the applicable statutory tax retention period (generally 10 years); support/guarantee data is kept for the period necessary to resolve the case and for a limited additional period for evidential purposes; consent-based marketing data is processed until opt-out, with evidence of consent/withdrawal being retained for a period appropriate for evidential purposes; cookie data is retained in accordance with the Cookie Policy and the choices made in the CMP.

10.4. Whenever we use processors, we ensure by contract that they apply consistent retention criteria and that they delete or return the data once the contracted purposes have ended. With regard to the minimal documentary evidence associated with the verification of hygiene seals or the exercise of the right of withdrawal, records are strictly limited, retained only for as long as necessary to demonstrate compliance and securely deleted once the justifiable period has elapsed.

11. RIGHTS OF DATA SUBJECTS

Under the applicable legislation, you have the following rights:
A) Information: the right to be informed of the purposes of the processing, the recipients, the retention periods, your rights and the conditions for exercising them, as well as of any data whose provision is mandatory.

B) Access: the right to obtain confirmation of the processing and to access your data, as well as the available information on its source.

C) Rectification: the right to request the correction of inaccurate data or the completion of incomplete data.

D) Erasure: the right to request the deletion of data when it is no longer necessary for the purposes in question, when you withdraw your consent (if applicable) or when you object to the processing, in accordance with the law, without prejudice to mandatory retention periods.

E) Objection: the right to object, at any time, to processing for direct marketing purposes and to processing based on legitimate interest, on grounds relating to your particular situation.

F) Portability: the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller, where the processing is based on consent or on the performance of a contract and is carried out by automated means.

G) Restriction of Processing: the right to request restriction of processing where: (a) you contest the accuracy of the data; (b) the processing is unlawful and you oppose erasure; (c) the data is no longer needed but is required for the establishment, exercise or defence of a right; (d) you have objected and are awaiting verification of which interests prevail.

H) Automated decisions and profiling: the right not to be subject to decisions based solely on automated processing which produce legal effects or similarly significant effects, and to request human intervention, express your point of view and contest the decision, where applicable.

I) Complaint: the right to lodge a complaint with the CNPD (www.cnpd.pt), without prejudice to any other administrative or judicial remedy.
To exercise your rights, please contact: support@giocup.pt (we may request proof of identity for your security).

12. COOKIES AND SIMILAR TECHNOLOGIES

The Website uses cookies and similar technologies to ensure essential functionalities and, where consent has been given, for analytics purposes and, where applicable, marketing purposes. Strictly necessary cookies are used on the basis of our legitimate interest; cookies that are not strictly necessary (for example, analytics and marketing cookies) are only used with your consent, which is collected and managed through our consent management platform (CMP), with the options “Accept”, “Reject” and “Configure” and a permanent “Manage Cookies” link in the footer. For detailed information on the categories, purposes, providers and durations of cookies, please see our Cookie Policy.

13. CHANGES TO THE PRIVACY POLICY

Turtle Petals reserves the right to update this Privacy Policy to reflect legal, technical or functional changes, as well as to incorporate best practices. The updated version will always be available on the Website www.giocup.pt. In the event of materially relevant changes, Turtle Petals will ensure that users are appropriately informed (for example, via the Website or by email), where required.