Privacy policy
Pistacho, Arquitectura e Interiores, Lda.
NIF (Tax ID): 516 848 780
Registered office: Rua Vale de Sá, n.º 1, Santa Luzia, 3050-106 Mealhada
Email (general and privacy matters): help@pistachodecor.com
Telephone: +351 239 137 054 (general) · +351 239 230 010 (sales line)
· +351 924 108 660 (WhatsApp)
Last updated: 29 September 2026
1. Data controller
Pistacho, Arquitectura e Interiores, Lda., NIF 516 848 780, with registered office at Rua Vale de Sá, n.º 1, Santa Luzia, 3050-106 Mealhada, is the controller of the personal data collected through the Online Shop, under Regulation (EU) 2016/679 — GDPR and Lei n.º 58/2019, de 8 de agosto (Law No. 58/2019 of 8 August).
Data Protection Officer (DPO): N/A — Pistacho is not required to appoint a DPO under article 37 of the GDPR.
2. Personal data processed
Depending on the relationship established with the Customer, Pistacho may process the following categories of data:
- Identification and contact: name, NIF (tax identification number), billing and delivery address, telephone, email;
- Order and payment data: products purchased, amount, payment method and reference (Pistacho does not store full bank card details, which are processed directly by the payment service provider);
- Communication data: messages sent by email, contact form, WhatsApp or chat;
- Browsing data: IP address, type of device, browser, pages visited, date and time and, where the user consents, interaction with the pages (clicks, scrolling and movements on the page, recorded for session analysis) — collected through cookies and similar technologies;
- Marketing data: commercial preferences, history of opens and clicks, if subscribed to the newsletter.
3. Purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Management of the contractual relationship, order processing, invoicing and delivery | Performance of the contract (point (b)) |
| Compliance with tax, accounting and legal obligations | Legal obligation (point (c)) |
| Responding to requests for information and handling complaints | Performance of the contract / Legitimate interest (points (b) and (f)) |
| Sending newsletters and marketing communications | Consent (point (a)) |
| Non-essential cookies (analytics, session analysis, marketing) | Consent (point (a)) |
| Cookies strictly necessary for the website to function | Legitimate interest (point (f)) and art. 5(3) of the ePrivacy Directive |
| Fraud prevention and website security | Legitimate interest (point (f)) |
4. Recipients and processors
Data may be disclosed to processors engaged by Pistacho to the extent strictly necessary for the performance of the contracted services, namely:
- Shopify International Limited — the e-commerce platform that hosts the Online Shop, manages the checkout and the cookie consent banner, and stores order and customer data;
- Ifthenpay, Lda. — payment processing gateway for Multibanco and MB Way;
- Shopify Payments — payment processing gateway for international cards;
- Klarna Bank AB (publ), where the Customer opts for Klarna payment — in this case, Klarna acts as an independent controller of the data shared with it, under its own Privacy Notice (see Klarna Payment Policy);
- Klaviyo Inc. — email marketing platform, for sending newsletters and commercial communications to Customers who have consented;
- Microsoft (Microsoft Clarity) — session analysis tool, which records in aggregate form how visitors interact with the pages (clicks, scrolling, heatmaps and session recordings) in order to improve how the website works, only with the user’s consent;
- Google (Google Analytics and Google Ads) — measurement of website traffic and performance and measurement and personalisation of adverts, only with the user’s consent;
- Meta Platforms Ireland Ltd. — through the Meta Pixel, for measurement and personalisation of adverts on Meta platforms, only with the user’s consent; and through WhatsApp Business, where the Customer chooses to contact Pistacho via WhatsApp;
- Pinterest — measurement and personalisation of adverts on the Pinterest platform, only with the user’s consent;
- CentralGest — management and invoicing software, for issuing invoices and complying with accounting and tax obligations;
- Partner suppliers (namely Storm-Light, Zambelis brand, and Placeminds, Nordlux brand) and their respective carriers, where products are shipped directly by the suppliers, to the extent necessary for delivery;
- Public authorities (Autoridade Tributária, ASAE, courts), in the cases provided for by law.
All processors are subject to confidentiality and data protection obligations, set out in written contracts under article 28 of the GDPR.
5. International transfers
Whenever a processor involves the transfer of data outside the European Economic Area, Pistacho ensures that appropriate safeguards are in place under the GDPR, namely European Commission adequacy decisions or standard contractual clauses.
6. Retention periods
Data are retained for the period necessary to fulfil the purposes for which they were collected:
- Customer and order data: for the duration of the contractual relationship and, after it ends, for the statutory retention periods (namely 10 years for tax and accounting purposes);
- Marketing and newsletter data: until consent is withdrawn;
- Browsing and cookie data: in accordance with the retention periods set out in section 10;
- Communications via form or email: for the time necessary to handle the request and for up to 2 years after it is closed, unless a longer statutory retention obligation applies.
7. Data subjects’ rights
The Customer may exercise the following rights at any time and free of charge:
- Access to their personal data;
- Rectification of inaccurate data;
- Erasure (“right to be forgotten”), under the conditions laid down in the GDPR;
- Restriction of processing;
- Portability of data;
- Objection to processing, in particular for direct marketing purposes;
- Withdrawal of consent, at any time, without affecting the lawfulness of processing already carried out;
- Not to be subject to automated decisions with significant legal effects (Pistacho does not make automated decisions producing legal effects).
To exercise these rights, simply contact help@pistachodecor.com. Pistacho will reply within a maximum of 30 days.
8. Right to lodge a complaint with the supervisory authority
Without prejudice to contacting Pistacho directly, the Customer may lodge a complaint with the competent supervisory authority in Portugal, the Comissão Nacional de Proteção de Dados (CNPD) — Av. D. Carlos I, n.º 134, 1.º, 1200-651 Lisboa | www.cnpd.pt | geral@cnpd.pt.
9. Security
Pistacho adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration, including encryption in transit (HTTPS/TLS), access control, regular backups and internal training.
10. Cookie Policy
What cookies are. Cookies are small text files placed on the user’s device when they visit a website. Among other things, they make it possible to remember preferences, improve browsing and analyse use of the website.
Types of cookies used:
| Category | Purpose | Indicative duration | Legal basis |
|---|---|---|---|
| Strictly necessary | Website operation, basket, session | Session or up to 1 year | Legitimate interest (consent not required) |
| Functional / Preferences | Language, layout, user preferences | Up to 1 year | Consent |
| Analytics / Statistics | Measurement of traffic and performance and session analysis (e.g. Google Analytics, Microsoft Clarity) | Up to 2 years | Consent |
| Marketing / Advertising | Ad personalisation, remarketing (e.g. Meta Pixel, Google Ads, Pinterest) | Up to 2 years | Consent |
Microsoft Clarity. The Online Shop uses Microsoft Clarity for session analysis. Clarity is linked to the consent banner through Clarity’s consent mode (consentv2), which passes on to it the user’s choices regarding storage for analytics and advertising purposes.
Consent management. On first visiting the Online Shop, a Shopify platform consent banner is displayed, allowing the user to accept, reject or customise the use of non-essential cookies. Preferences can be reviewed at any time.
Third-party cookies. The Online Shop integrates third-party services (namely those listed in section 4) which place their own cookies. These are governed by the privacy policies of those entities.
11. Amendments
This Privacy and Cookies Policy may be updated periodically. Any changes will be published on this page, stating the date of the last revision.
