Política de privacidade
At NissiStore, we respect your privacy and are committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit our website, create an account, purchase products, subscribe to marketing communications or contact our customer support team.
We process personal data in accordance with applicable European Union data protection legislation, including the General Data Protection Regulation, known as the GDPR, and Portuguese Law No. 58/2019.
This Privacy Policy applies to the NissiStore online store at https://nissistore.shop.
1. Who Is Responsible for Your Personal Data?
NissiStore is an online beauty retailer operated by a sole trader registered in Portugal.
The person responsible for determining the purposes and means of the personal data processing activities carried out by NissiStore is:
Trading name: NissiStore
Legal operator: Viviane Rodrigues Barros de Almeida
Business address: Rua das Ácacias 70, 8500-811 Portimão, Portugal
Portuguese Tax Identification Number: 299637182
Privacy contact email: nissistore.store@gmail.com
Website: https://nissistore.shop
NissiStore acts as the data controller for the processing activities for which it determines the purposes and means of processing.
Certain service providers, including Shopify, may also act as independent data controllers for specific processing activities.
2. Personal Information We Collect
Depending on how you interact with our website, we collect or receive different categories of personal information.
Identity and Contact Information
This may include your full name, email address, telephone number, billing address and delivery address.
Order and Transaction Information
This may include the products you purchase, order numbers, transaction details, purchase history, shipping information, refunds, returns and customer service records.
Payment Information
When you make a purchase, payment-related information is processed through the payment methods and providers available at checkout.
These may include Shopify Payments, PayPal, Klarna, Multibanco, MB WAY and other supported payment services.
NissiStore may receive transaction references, payment confirmation, payment status and limited payment details necessary to manage purchases and refunds.
Sensitive payment credentials are handled by the relevant payment service providers according to their security procedures.
Customer Account Information
If you create or use a customer account, we may process your account details, contact information, saved addresses, order history and information necessary to provide account functionality and security.
Technical and Website Usage Information
When you browse our website, technical information may be collected through Shopify and the technologies enabled on our store.
This may include your IP address, browser type, device information, cookie identifiers, pages viewed, interactions with products, shopping basket activity and other website usage information.
Some of this information is processed through strictly necessary technologies, while other processing depends on your privacy choices and applicable consent requirements.
Customer Support Information
When you contact us, we may process your messages, order details, contact information and other information you voluntarily provide to help us respond to your enquiry.
Marketing Preferences
If you subscribe to our marketing communications, we may process your email address, subscription status, consent records and communication preferences.
We aim to collect only the information necessary for legitimate and clearly defined purposes.
3. How We Use Personal Information and Our Legal Bases
We process personal data only where an appropriate legal basis exists under applicable data protection legislation.
Processing Orders and Deliveries
We use personal information to confirm purchases, process payments, prepare orders, arrange shipping, provide delivery updates and manage returns or refunds.
Legal basis: Performance of a contract or taking steps at your request before entering into a contract.
Customer Accounts
We process account information to provide account functionality, facilitate access to order history and support account management.
Legal basis: Performance of a contract.
Accounting and Legal Compliance
We process relevant transaction and customer information to comply with applicable accounting, tax, consumer protection and other legal obligations.
Legal basis: Compliance with a legal obligation.
Customer Support
We use personal information to respond to enquiries, resolve delivery issues, investigate complaints and provide assistance with purchases.
Legal basis: Performance of a contract where the enquiry relates to an existing purchase, or legitimate interests where processing is necessary to manage other reasonable customer enquiries.
Security and Fraud Prevention
We may process transaction, account and technical information to protect our website, detect suspicious activity, prevent fraud and maintain the security of our services.
Legal basis: Our legitimate interests in protecting customers, preventing fraud and maintaining secure business operations, or compliance with legal obligations where applicable.
Marketing Communications
We use Shopify's marketing services to communicate promotional offers, product information and store updates to customers who have voluntarily subscribed.
Where consent is required, promotional communications are sent only on the basis of valid consent.
Legal basis: Consent or another applicable legal basis expressly permitted under electronic marketing legislation.
You may unsubscribe from promotional communications at any time using the unsubscribe option included in marketing emails or by contacting us.
Website Analytics
We use Google Analytics and Shopify analytics services to understand how visitors interact with our website, evaluate performance and identify opportunities to improve the shopping experience.
Where analytics involve non-essential cookies or similar technologies requiring consent, these technologies are subject to your privacy choices.
Legal basis: Consent where required for non-essential tracking, and legitimate interests for strictly necessary operational measurement where permitted by law.
Advertising and Personalisation
We use Google Ads, Meta advertising services and TikTok advertising technologies to measure advertising performance and, where permitted, provide more relevant promotional content.
These services may process information about your interactions with our website, including advertising identifiers and browsing activity, subject to applicable consent requirements.
Legal basis: Consent where required for advertising cookies, tracking technologies and related personalisation activities.
You can manage your preferences through the privacy controls provided on our website.
4. Shopify and Shopify Network Intelligence
Our online store is hosted by Shopify, which provides the technology necessary to operate our website, process orders, manage accounts and support the shopping experience.
Shopify collects and processes personal information when customers visit or make purchases through our store.
NissiStore has enabled Shopify Network Intelligence, a feature that allows Shopify to use customer information together with information from interactions involving Shopify and other merchants to provide enhanced services.
Depending on the services enabled, these activities may support website improvements, personalised shopping experiences, advertising relevance, advertising measurement and business insights.
Information relating to your interactions with NissiStore may be shared with Shopify and relevant service providers for these purposes.
Shopify may process certain information as an independent data controller, according to its applicable privacy terms.
Where consent is required for non-essential tracking or personalised advertising, your choices made through our website's privacy controls are respected by Shopify's properly integrated consent mechanisms.
For information about Shopify's own data processing activities, please consult:
Shopify Consumer Privacy Policy
https://www.shopify.com/legal/privacy/consumers
You may also access Shopify's privacy portal to learn more about its processing activities and exercise applicable privacy rights, including options relating to consent and personalised advertising:
Shopify Privacy Portal
5. Cookies and Tracking Technologies
Our website uses cookies and similar technologies to provide essential functions and, where permitted, support analytics and advertising.
These technologies may include the following categories.
Strictly Necessary Cookies
These support essential functions such as website security, checkout, shopping basket management, account access and remembering privacy preferences.
Strictly necessary technologies may be used without consent where permitted by law.
Analytics Cookies
These help us understand website traffic, visitor interactions and store performance.
Advertising and Marketing Cookies
These may be used to measure advertising campaigns, understand interactions with advertisements and provide personalised marketing content.
Preference Technologies
These may help remember user preferences, including language or website settings.
NissiStore uses Shopify's customer privacy tools and an automatically configured cookie consent banner.
Visitors can accept or reject optional cookies and manage their choices through the privacy controls available on the website.
Where consent is legally required, non-essential analytics and advertising technologies are not intended to operate before valid consent has been obtained.
You may withdraw or change your consent through the available cookie preference controls.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Certain essential website functions may continue to operate independently of optional cookie choices.
6. Sharing Personal Information with Third Parties
To operate our online store and fulfil customer orders, we share relevant personal information with selected service providers where necessary and legally permitted.
These providers may include:
-
Shopify, for website hosting, checkout, customer accounts, order management, analytics and other e-commerce functions.
-
Payment providers, including Shopify Payments, PayPal, Klarna and providers supporting Multibanco and MB WAY.
-
European suppliers and fulfilment partners, for processing, preparing and dispatching orders.
-
Shipping carriers and logistics providers, for delivering parcels and providing shipment information.
-
Google, for analytics, advertising and related measurement services.
-
Meta, for advertising services associated with Facebook and Instagram.
-
TikTok, for advertising and campaign measurement services.
-
Technical and security providers, where necessary for the operation and protection of our services.
-
Public authorities and professional advisers, where disclosure is required or permitted by law.
For order fulfilment, the information shared with suppliers and logistics partners may include your name, delivery address, telephone number and relevant order details.
We seek to limit the personal information shared to what is necessary for each specific purpose.
Where a provider processes personal information on our behalf, appropriate data protection arrangements are required under applicable law.
Some providers act as independent controllers for their own processing activities and provide separate privacy notices explaining those activities.
7. International Data Transfers
Although NissiStore sells to customers within the European Union and works with European fulfilment partners, some technology, advertising and payment providers operate internationally.
As a result, personal information may be processed or accessed outside the European Economic Area.
Where international transfers occur, they must be supported by appropriate safeguards under applicable data protection legislation.
These may include European Commission adequacy decisions, approved Standard Contractual Clauses or other legally recognised transfer mechanisms.
Additional safeguards may be necessary depending on the destination country, the relevant provider and the nature of the information transferred.
You may contact us for further information about the safeguards relevant to the processing of your personal information.
8. How Long We Retain Personal Information
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected or to comply with applicable legal obligations.
The appropriate retention period depends on the category of information and the purpose of processing.
Orders, Invoices and Accounting Records
Transaction information and legally required accounting records are retained for the periods established by applicable Portuguese accounting and tax legislation.
Customer Accounts
Account information is retained for as long as necessary to provide account services, subject to applicable legal obligations and valid deletion requests.
Customer Support Communications
Customer service information is retained for the period reasonably necessary to manage enquiries, resolve complaints and protect applicable legal rights.
Marketing Information
Marketing subscription information is retained while the relevant legal basis remains valid and for any further period necessary to document compliance with applicable legal obligations.
You may unsubscribe or withdraw marketing consent at any time.
Analytics and Technical Information
The retention of technical identifiers, analytics information and cookies depends on the relevant service, its configuration and applicable legal requirements.
Where information is no longer necessary, it will be deleted, anonymised or otherwise handled in accordance with applicable data protection law.
A valid request for deletion does not necessarily require the removal of records that must be retained to comply with legal obligations.
9. Personal Data Security
We take appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, accidental loss, misuse or unlawful disclosure.
Our website operates through Shopify, which provides security infrastructure and technical protections for online commerce.
We also rely on the security measures of relevant payment and technology providers for the services they operate.
Access to personal information should be limited to legitimate operational needs.
No online service can guarantee absolute security. Where a personal data breach occurs, we will assess the incident and comply with applicable notification and response obligations.
10. Your Rights Under European Data Protection Law
Under the GDPR, you may have the following rights, subject to applicable legal conditions.
Right of Access
You may request confirmation of whether your personal information is being processed and obtain access to eligible information.
Right to Rectification
You may request correction of inaccurate personal information or completion of incomplete information.
Right to Erasure
You may request deletion of personal information where the legal conditions for erasure are met.
Right to Restriction
You may request that certain processing activities be restricted in circumstances provided by law.
Right to Data Portability
You may request eligible personal information in a structured, commonly used and machine-readable format.
Right to Object
You may object to certain processing activities based on legitimate interests. You may object to the processing of your personal information for direct marketing at any time.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time.
Rights Relating to Automated Decision-Making
You may exercise the protections provided by applicable law in relation to decisions based solely on automated processing that produce legal or similarly significant effects.
To exercise your rights, please contact:
We may request reasonable verification of your identity where necessary to protect your information.
We will respond without undue delay and generally within one month of receiving your request.
Where permitted by law, this period may be extended for complex requests, and you will be informed of the extension and its reasons.
Requests are generally handled free of charge, except in circumstances where the law permits otherwise.
You may also exercise rights directly with Shopify in relation to processing activities for which Shopify is responsible:
11. Automated Processing and Profiling
Some of the services supporting our website, payments, security and advertising may use automated systems.
These may include fraud detection, transaction risk assessment, advertising measurement and the creation of advertising audiences.
The use of automated technologies does not automatically mean that a decision with legal or similarly significant effects is made solely through automated processing.
Where automated decision-making falls within the specific protections established by the GDPR, the relevant information and rights will apply.
12. Children's Privacy
Our online store is intended for individuals legally permitted to make purchases or those acting with appropriate legal authorisation.
We do not intentionally seek to collect personal information from children in circumstances prohibited by applicable law.
If you believe that personal information relating to a child has been collected unlawfully, please contact us so that the situation can be investigated and appropriate action taken.
13. Your Right to Lodge a Complaint
If you believe that your personal information has been processed in violation of applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.
In Portugal, the national data protection supervisory authority is:
Comissão Nacional de Proteção de Dados — CNPD
Website: https://www.cnpd.pt
You may also contact the competent supervisory authority in another European Union Member State where you habitually reside, work or where the alleged infringement occurred, in accordance with the GDPR.
You may contact NissiStore directly to raise privacy concerns, but you are not required to do so before submitting a complaint to a competent supervisory authority.
14. Updates to This Privacy Policy
We may update this Privacy Policy to reflect changes in applicable law, technology, service providers or our personal data processing practices.
The current version will be made available on our website.
Where legally required, we will provide additional notice or request consent before implementing relevant changes.
Changes to this Privacy Policy do not remove rights already established under applicable data protection legislation.
15. Contact Information
If you have questions about this Privacy Policy, your personal information or your rights under applicable data protection legislation, please contact:
NissiStore
Legal operator: Viviane Rodrigues Barros de Almeida
Business address: Rua das Ácacias 70, 8500-811 Portimão, Portugal
Tax Identification Number: 299637182
Email: nissistore.store@gmail.com
Website: https://nissistore.shop
You may also use the contact options provided on our Contact Information page.
NissiStore — Beauty, Made for You