1. Who is responsible for your data

This Privacy Policy applies when you visit tracesofmetm.com, create an account, place or attempt to place an order, visit or contact us, subscribe to communications, or otherwise interact with Traces of Me.

The data controller is Traços de Mim Decorações Lda, trading as Traces of Me, with registered office at Largo de S. João, nº 3, 1º, 7580-624 Comporta, Portugal, VAT number PT 504036386 (“Traces of Me”, “we”, “us” or “our”).

Privacy requests may be sent to customer.service@tracesofmetm.com.

2. Personal data we collect

• Contact and identification data: name, email address, telephone number, billing and delivery addresses, country and customer account details.
• Order and transaction data: products viewed or purchased, order history, returns, exchanges, discounts, invoices, delivery details and payment status. Payment details are handled by authorised payment providers; we do not normally receive complete card numbers.
• Communications and support data: emails, forms, telephone or WhatsApp communications, preferences, feedback and information supplied when requesting assistance.
• Marketing data: subscription status, consent records, campaign interactions and communication preferences.
• Device and usage data: IP address, browser, device identifiers, approximate location, time zone, pages viewed, searches, clicks, referrer information and cookie or pixel identifiers.
• Fraud and security data: signals needed to authenticate users, secure the Site, detect suspicious activity and protect transactions.

3. How and why we use personal data

Some information is required to enter into or perform a purchase contract. If you do not provide the information requested at checkout, we may be unable to accept, process or deliver the order.

4. Where data comes from

We collect data directly from you, automatically through the Site and connected technologies, and from service providers or partners involved in payments, delivery, marketing, security and analytics. We may also receive information from social or advertising platforms when you interact with our campaigns, subject to your settings and applicable law.

5. Shopify and our online store

Our store is hosted by Shopify. Shopify processes personal data when you visit or purchase from our store to provide the commerce platform, checkout, security, analytics and related services. Read the Shopify Consumer Privacy Policy for information about Shopify's processing and privacy controls.

Where Shopify Network Intelligence or other Enhanced Services are enabled, and subject to applicable consent and opt-out choices, Shopify may use information about interactions with our store, other merchants and Shopify to improve services, personalise experiences, understand advertising performance and provide more relevant advertising. Information may be shared with Shopify and relevant service partners in other countries for those purposes. Available cookie and data-sharing choices will be shown through our privacy controls where required.

6. Marketing and mobile messaging

When you subscribe, we may send news, collections, invitations, offers, cart reminders and other marketing by email, SMS or WhatsApp. Marketing consent is not a condition of purchase and can be withdrawn at any time:

• Email: use the unsubscribe link included in each marketing email.
• SMS: reply STOP or use the available unsubscribe method.
• WhatsApp: reply STOP or UNSUBSCRIBE, or use WhatsApp's controls.
• Alternatively, contact us by email.

Opting out of marketing does not prevent necessary transactional or service communications about an order, return, account or security issue.

7. Cookies and similar technologies

We and our partners, including Shopify, use cookies, pixels, tags and similar technologies to operate the Site, remember preferences, measure performance, prevent fraud, personalise experiences and, where permitted, provide advertising. Non-essential technologies are used according to the consent choices presented in our cookie banner.

You can review or change your choices through Cookie preferences in the Site footer or the privacy controls shown on the Site. Browser controls may also block or delete cookies, although some store functions might then be unavailable.

8. Who receives personal data

We disclose only the data reasonably necessary for the relevant service or legal purpose. Recipients may include:

• Shopify, for e-commerce hosting, checkout, security, analytics and related services;
• Klaviyo and communications providers, for CRM, email, SMS and WhatsApp;
• payment providers such as Stripe, PayPal and Ifthenpay;
• Shiptimize and carriers such as DHL, Nacex and CTT for delivery and returns;
• technology, hosting, security, professional, accounting and customer-support providers;
• analytics, advertising and social platforms such as Google and Meta, subject to consent and privacy settings where required;
• courts, regulators, tax authorities, law enforcement or other parties where disclosure is required by law or necessary to protect legal rights.

These organisations may act as our processors, independent controllers or joint controllers depending on the service and applicable law. Their own privacy notices may also apply. We may disclose data in connection with a genuine corporate reorganisation or sale, subject to appropriate safeguards.

9. International transfers

Some recipients may process data outside Portugal or the European Economic Area. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses or another legally recognised safeguard. You may contact us for information about the applicable safeguards.

10. How long we keep data

We retain data only for as long as needed for the stated purpose, including:

• orders, invoices and accounting records for the periods required by tax, accounting and consumer law;
• account data while the account remains active and for a reasonable period afterwards;
• support, return and claim records for as long as needed to resolve the matter and establish or defend legal claims;
• marketing data until consent is withdrawn, you opt out or the record becomes inactive under our retention rules;
• cookie and technical data according to the duration shown in the cookie preference tool or the relevant provider's settings.

After the relevant period, data is deleted or anonymised unless continued retention is required or permitted by law.

11. Security

We use appropriate technical and organisational measures designed to protect personal data, including access controls, secure service providers, staff confidentiality practices and security monitoring. No internet transmission or storage system can be guaranteed to be completely secure, so please protect your account and contact us if you suspect unauthorised activity.

12. Your privacy rights

Subject to applicable law, you may request access, rectification, erasure, restriction, portability or objection to processing. You may withdraw consent at any time without affecting earlier lawful processing and may object at any time to direct marketing.

Send your request to customer.service@tracesofmetm.com. We may request proportionate information to verify your identity and protect your data. We aim to respond within the period required by applicable law.

You also have the right to lodge a complaint with your local supervisory authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).

13. Automated processing and fraud prevention

Our platform and payment or security providers may automatically assess transaction and device signals to detect fraud or security risks. Where a decision based solely on automated processing produces legal or similarly significant effects, you may request human intervention, express your point of view and contest the decision where applicable law provides those rights.

14. Children

Our Site is intended for adults and is not directed to children. We do not knowingly collect personal data from children for marketing. If you believe that a child has provided personal data without the required authorisation, please contact us.

15. Changes to this Policy

We may update this Policy to reflect changes to our practices, services or legal obligations. The date at the top identifies the latest version. Where appropriate, we will provide additional notice of material changes.