BigBrainlda

1. Data Controller
The data controller responsible for the personal data collected through this shop is: Catarina A. M. Salas
Contact: bigbrain.geral@gmail.com

2. Data Collected
When placing an order or contacting the shop, the following personal data may be collected:
a. Full name
b. Email address
c. Billing and shipping address
d. Payment details (securely processed by Etsy or integrated payment providers)
e. Messages exchanged through Etsy

3. Purposes of Processing
Personal data is used exclusively for the following purposes:
a. To process and deliver orders;
b. To issue invoices and comply with legal obligations;
c. To communicate with customers regarding orders, inquiries, or support;
d. To comply with tax and accounting obligations;
e. To prevent fraud or misuse of the shop.

4. Legal Basis
The processing of personal data is based on:
a. The performance of a contract of sale (Art. 6.º, n.º 1, al. b) do GDPR);
b. Compliance with legal obligations (Art. 6.º, n.º 1, al. c) do GDPR);
c. Customer consent, where applicable (e.g., newsletter subscription).

5. Data Sharing
Personal data will not be sold or transferred to third parties.
However, data may be shared with:
a. Etsy (sales platform, which has its own Privacy Policy);
b. Payment providers (PayPal, Stripe, or other Etsy-integrated processors);
c. Logistics and shipping services, for order delivery purposes;
d. Tax authorities, where legally required.

6. Data Storage and Retention Period
a. Data is stored in accordance with Etsy’s policies and applicable legislation.
b. Data will only be kept for as long as necessary for the purposes for which it was collected (usually 5 to 10 years for tax and accounting purposes).

7. Data Subject Rights
In accordance with the GDPR, customers have the right to:
a. Access their personal data;
b. Request correction of inaccurate or incomplete data;
c. Request erasure of their data (where legally possible);
d. Request restriction of or object to processing;
e. Request data portability, where applicable.
To exercise these rights, customers may contact: bigbrain.geral@gmail.com

8. Security
Appropriate technical and organizational measures are implemented to protect personal data against loss, misuse, unauthorized access, alteration, or disclosure.

9. Supervisory Authority
Customers also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) in Portugal, or with the competent supervisory authority in their country of residence.