Privacy policy
How we process your personal data under the GDPR.
Last updated: 31 October 2026
This is a translation for convenience. In case of any discrepancy, the Portuguese version prevails.
1. Controller
Carapau100Cardume. Data protection contact: kalisurfcasting@gmail.com.
2. What data, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Orders | Name, email, phone, address, VAT no. (optional), items, amounts | Performance of contract (Art. 6(1)(b) GDPR) | 10 years (tax and accounting obligations) |
| Payments | Payment data (processed by Stripe; we only receive the result and last digits) | Contract; legal obligation | 10 years |
| Customer account | Name, email, hashed password, addresses | Contract / your request | Until you delete it; 2 years of inactivity |
| Contact and withdrawal | Name, email, message, order number | Pre-contractual steps; legal obligation | 3 years |
| Newsletter | Email, language, consent date | Consent (Art. 6(1)(a)) | Until you withdraw consent |
| Analytics and marketing (cookies) | Online identifiers, pages visited | Consent | See Cookie policy |
| Security | IP address (rate limiting, fraud prevention) | Legitimate interest (Art. 6(1)(f)) | In memory, minutes |
3. Processors and recipients
| Entity | Service |
|---|---|
| Stripe Payments Europe, Ltd. (Irlanda) | Pagamentos / Payments |
| Vercel Inc. (EUA, cláusulas contratuais-tipo / SCCs + DPF) | Alojamento do site / Hosting |
| Neon Inc. ou Supabase (região UE) | Base de dados / Database |
| Resend (EUA, SCCs) | Envio de emails / Email delivery |
| CTT – Correios de Portugal, S.A. | Entregas / Deliveries |
| Google Ireland Ltd. (Google Analytics) — só com consentimento | Estatísticas / Analytics |
| Meta Platforms Ireland Ltd. (Meta Pixel) — só com consentimento | Marketing |
| Software de faturação certificado (Moloni / InvoiceXpress) | Faturação / Invoicing |
Transfers outside the EEA rely on adequacy decisions (e.g. EU-US Data Privacy Framework) or Standard Contractual Clauses.
4. Your rights
You may request access, rectification, erasure, restriction, portability, object to processing and withdraw consent at any time by writing to kalisurfcasting@gmail.com. You may also complain to the CNPD – Comissão Nacional de Proteção de Dados.
5. Security
HTTPS, hashed passwords, protected admin access and certified providers. We never store card data.
6. Cookies
See the Cookie policy.