Privacy Policy

1. Data controller

The data controller for any personal data processed through eyestyle.pt is Eyestyle, S.L., with registered office at Calle López de Neira 3, 3ª planta, oficina 301, 36202 Vigo, Pontevedra, España, tax identification number (NIF) B94084878. Eyestyle has not designated a data protection officer; the controller is the point of contact for all data subject requests.

You can reach us at [email protected] for any question or request related to the processing of your personal data.

2. Categories of personal data we process

• Account data: name, email address, phone number, and an encrypted password
• Order and billing data: delivery address, billing address, order history, VAT number (when provided for invoicing) and payment reference
• Payment data: processed directly by Stripe as an independent controller — Eyestyle never stores full card numbers or CVV codes
• Customer service data: messages you send us, attachments, and the history of the support conversation
• Technical and security data: IP address, browser user agent, and session identifiers strictly necessary to keep the website and cart working securely
• Cookie preferences: the choice you make in our cookie banner is stored in a first-party cookie so we do not ask again on every visit

3. We do not process special category (health) data at this time

The current Eyestyle catalogue only includes non-prescription products (sunglasses, ocular care products, solutions, accessories). We do not ask for prescription data, medical history or any other data falling under Article 9 of the GDPR. If prescription products are added in the future, this policy will be updated before that processing begins, and explicit consent will be sought.

4. Purposes of processing and legal basis

• Processing and delivering your orders — legal basis: performance of a contract (GDPR Art. 6(1)(b))
• Managing your customer account — legal basis: performance of a contract (Art. 6(1)(b))
• Invoicing and complying with tax, accounting and consumer protection rules — legal basis: legal obligation (Art. 6(1)(c); Código do IVA, SAF-T, Decreto-Lei 84/2021)
• Responding to customer service enquiries — legal basis: legitimate interest in answering your questions and resolving complaints (Art. 6(1)(f))
• Preventing fraud and securing the website — legal basis: legitimate interest (Art. 6(1)(f))
• Sending transactional messages (order confirmations, shipping updates, password resets) — legal basis: performance of a contract (Art. 6(1)(b))
• Sending optional marketing communications — legal basis: your explicit consent (Art. 6(1)(a)), which you can withdraw at any time without affecting previous processing

5. Retention periods

We keep your personal data only for as long as necessary for the purposes described above, and within the periods required by applicable law:

• Account data: while the account is active, plus a short grace period after deletion to handle chargebacks or complaints
• Order, invoicing and tax records: 10 years from the end of the fiscal year, as required by the Portuguese Código do IVA and Código Comercial
• Customer service correspondence: up to 3 years after the last interaction, unless a dispute is still pending
• Technical and security logs: up to 6 months, unless a longer period is required to investigate an incident
• Marketing consent records: until you withdraw consent, plus proof of the withdrawal

6. Recipients and data processors

We only share your personal data with third parties that provide services on our behalf, under written agreements that comply with Article 28 of the GDPR. We do not sell personal data and we do not share it for third-party marketing purposes.

• Stripe Payments Europe, Ltd. (Ireland) — payment processing. Stripe acts as an independent controller for fraud prevention and regulatory compliance.
• Cloudflare, Inc. (United States / Ireland) — CDN, DDoS protection and secure tunnelling. Processing covered by Standard Contractual Clauses and the EU-US Data Privacy Framework.
• PostHog (EU region) — product analytics and error reporting, and separately session recording, which records the pages, clicks and navigation of a visit so we can see what went wrong. These are two distinct consent categories: you may accept one and refuse the other, and withdraw either at any time. Recording is used only to find and fix errors. Data is stored in the European Union. Form inputs are masked in the browser before anything is sent, as are your name, address and email where a page displays them; passwords and payment details are never collected.
• Resend (United States / EU) — transactional email delivery, subject to Standard Contractual Clauses.
• Google Ireland Limited (Ireland) — only if you choose to sign in with your Google account: Google shares your name and email address with us so we can create or open your account. Google processes that data as an independent controller under its own privacy policy.
• Our fulfilment partners and carriers — for shipping to the delivery address you provide at checkout.
• Competent authorities — when required to comply with a legal obligation, a court order or an investigation.

7. International transfers

Some of our processors are located outside the European Economic Area. When this happens, we rely on the adequacy decisions adopted by the European Commission, on Standard Contractual Clauses approved by Decision (EU) 2021/914, or on the EU-US Data Privacy Framework. You can request a copy of the safeguards in place by writing to us.

8. Your rights

Under Articles 15 to 22 of the GDPR, you have the following rights with respect to your personal data:

• Right of access — confirmation of whether we process data about you, and a copy of it
• Right to rectification — correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — deletion of your data when the legal basis no longer applies
• Right to restriction of processing — in specific situations foreseen by the GDPR
• Right to data portability — a structured, machine-readable copy of data you provided to us
• Right to object — to processing based on legitimate interest
• Right to withdraw consent — at any time, without affecting processing already carried out
• Right to lodge a complaint — with a data protection supervisory authority

9. How to exercise your rights and complain

To exercise any of these rights, send an email to [email protected] describing the right you wish to exercise. We will respond within one month, as required by Article 12(3) of the GDPR, and may ask you for additional information to verify your identity.

If you believe that we have not handled your personal data in accordance with the law, you have the right to file a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD) — https://www.cnpd.pt ([email protected]). Spanish residents can contact Agencia Española de Protección de Datos (AEPD) — https://www.aepd.es.

10. Security of processing

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (HTTPS/TLS), encryption of passwords at rest, least-privilege access controls, audit logging, and regular backups. No system is entirely risk-free; we encourage you to use a strong, unique password and to notify us immediately if you suspect unauthorised access to your account.

11. Cookies and similar technologies

eyestyle.pt uses strictly necessary cookies (session, cart, consent preference, bot mitigation), which do not require consent. Only with your consent, and as two separate categories, we use PostHog for usage analytics and for session recording (see section 6). We also use Plausible, hosted in the European Union, for aggregate and anonymous visit statistics without cookies. We do not use advertising cookies. A detailed inventory and the option to withdraw consent at any time are available on our Cookie Policy page.

12. Minors

Eyestyle does not knowingly process personal data of minors under 13. Accounts and orders intended for minors should be placed by a parent or legal guardian, who remains the data subject towards Eyestyle.

13. Changes to this policy

We may update this policy to reflect changes in the service, the law or our processors. When changes are material, we will notify registered customers by email or through a notice on the website. The current version and its effective date are always available at this URL. Last updated: 2026-09-28.