1. Data Controller

Brincadeiras ao Cubo, Comércio de Jogos e Brinquedos, Lda., VAT number 510204538, headquartered at Marina Plaza, Daytona Beach Building, Block 27-A, Shop 79, 8125-401 Quarteira. Registered at the CRC of Coimbra. This Policy complies with the GDPR (Regulation (EU) 2016/679) and applicable national legislation.

2. Data We Collect

2.1. Data provided by the Customer: name, address, email, phone, tax identification number and data necessary for order processing and customer support.

2.2. Device information: IP address, time zone, cookies and log files (browser, ISP, referral/exit pages, date/time stamps) for security and performance.

2.3. Order information: purchased items, billing/shipping addresses, payment methods (processed by third parties) and support history.

3. Purposes, Legal Basis and Retention Period

3.1. Contract performance (art. 6(1)(b) GDPR): processing orders, payments, shipments and customer support (including in-store pickup). Period: during the contractual relationship and for the legally prescribed limitation periods.

3.2. Compliance with legal obligations (art. 6(1)(c)): invoicing, tax obligations and responding to authorities. Period: as legally required.

3.3. Legitimate interest (art. 6(1)(f)): website security, fraud prevention, service improvement and aggregated statistics. Period: as long as necessary and proportionate.

3.4. Marketing (art. 6(1)(a)): sending communications (email/SMS) only with consent. You may withdraw at any time. Period: until consent is withdrawn.

4. Data Sharing with Third Parties

4.1. Service providers (subcontractors): acting on behalf of Brincadeiras ao Cubo, Lda., following our instructions and this Policy. Includes: Ifthenpay (payments), CTT Expresso (logistics), DPD (returns management via Pickup network), and communication/marketing platforms (email/SMS).

4.2. Analytical tools: we may use analytics solutions to understand website usage in an aggregated/anonymous manner.

4.3. Authorities: we may disclose data to comply with the law, respond to judicial/administrative orders or protect our own/third-party rights.

5. Cookies and Similar Technologies

We use necessary cookies (functionality/security) and performance/statistics cookies. Management is done via the browser. Disabling may affect functionalities (cart, checkout). Learn more at aboutcookies.org.

6. Data Transfers

If transfers outside the EEA occur, we ensure appropriate mechanisms (e.g. EU standard contractual clauses) guaranteeing a level of protection equivalent to that required by the GDPR.

7. Data Subject Rights

7.1. Access: to know the data processed and their purposes.

7.2. Rectification and erasure: to correct inaccurate data and delete it under legal terms.

7.3. Restriction and objection: to restrict or object to processing, when applicable.

7.4. Portability: to receive the provided data in a structured, machine-readable format, when applicable.

7.5. Consent: to withdraw consent at any time without affecting the lawfulness of prior processing.

7.6. Complaint: the right to complain to the National Data Protection Commission (CNPD).

How to exercise: send a request to the Data Protection Officer (geral@brincatoys.pt) or by post to the headquarters address indicated in point 1.

8. Security

We apply appropriate technical and organisational measures (firewall, encryption, access control, event logging) to protect data against loss, misuse or unauthorised access/disclosure. In case of a relevant incident, we may communicate via website and/or email/SMS.

9. Minors

The website is not intended for persons under 18 years. We do not intentionally collect data from minors. If you become aware of improper collection, please contact us.

10. Retention

Data is retained only for the period necessary for the purposes or the applicable legal period (e.g. invoicing and tax obligations). After the period, data is deleted or anonymised.

11. Updates to this Policy

We may update this Policy whenever necessary. The current version is the one published on this page, effective from the date of publication.

12. Contact

Questions about privacy or exercising rights: geral@brincatoys.pt.