Privacy policy

Data Protection Policy

1) Data controller

The controller of your personal data in this online store is Generation Bloom, Lda, Portuguese tax number (NIPC) 517411296, registered office at Av. Conselheiro Albuquerque, n.º 8, 1.º Esq., 6000-161 Castelo Branco, Portugal. For any question about your data, write to apoiocliente@prostaphytol.pt.

2) What data we process and why

  • Orders: name, address, email, phone number, products purchased and payment details, to process, deliver and invoice your order and provide customer support. Legal basis: performance of the contract and compliance with legal obligations (e.g. tax).
  • Contacting us: the data you send us by email, phone or form, to answer your request. Legal basis: legitimate interest and, where applicable, performance of the contract.
  • Customer account: registration details, if you choose to create an account. Legal basis: performance of the contract.
  • Newsletter and marketing communications: your email address, only with your consent, which you can withdraw at any time using the link in each message.
  • Browsing the site: technical data (IP address, browser, pages visited), to keep the site working and secure. Legal basis: legitimate interest.
  • Analytics and advertising cookies: only with your consent, given in the cookie banner, to measure visits and show relevant advertising (e.g. Meta and Google).

3) Who we share data with

We share only the data strictly necessary with: Shopify, which hosts the store; payment service providers; the carriers that deliver orders; customer service providers acting on our behalf; and, with your consent, advertising platforms. These providers process data on our instructions or as independent controllers under their own policies. We do not sell your data.

4) Transfers outside the European Economic Area

Some providers (e.g. Shopify, Meta or Google) may process data outside the EEA. In such cases, transfers are made with the safeguards provided for in the GDPR, such as adequacy decisions or the European Commission's standard contractual clauses.

5) How long we keep data

Order and invoicing data are kept for the period required by Portuguese tax law (10 years). Other data are kept only for as long as needed for the purpose for which they were collected or until you withdraw your consent.

6) Your rights

You can at any time request access to, rectification, erasure or portability of your data, object to or request restriction of processing, and withdraw any consent you have given, without affecting the lawfulness of prior processing. To do so, write to apoiocliente@prostaphytol.pt.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or with the supervisory authority in your country of residence.

7) Cookies

We use cookies that are essential for the store to work (e.g. the shopping cart). Analytics and advertising cookies are used only if you consent in the cookie banner, and you can change your choice at any time.

8) Security

The site uses encrypted connections (HTTPS) and we apply appropriate technical and organisational measures to protect your data.

9) Changes

We may update this policy. The current version is always available on this page.

Last updated: October 2026.