Shopping Cart
Last updated: 9 October 2026.
1. Who is responsible
The controller of your personal data is the seller, trading as Cacauwe. For anything in this policy, write to [email protected].
2. What we collect, and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Name, email, delivery and billing address, phone | To take your order, ship it and answer you about it | Contract, Art. 6(1)(b) |
| Orders and invoices | To keep the accounts that tax law requires | Legal obligation, Art. 6(1)(c) |
| Messages you send us | To reply to you | Legitimate interest, Art. 6(1)(f) |
| IP address, browser data and the cookies in our Cookie Policy | To keep your cart and session working and to block abuse | Contract and legitimate interest |
We never sell your data or profile you for advertising.
3. Payment data
Checkout offers bank transfer only. You pay from your own bank, and what reaches us is the transfer with the details your bank sends with it, such as the account holder's name. We never see card data.
4. Who else receives your data
- The makers and packers who prepare and send your order, and the carrier that delivers it: your name, delivery address, phone and what the parcel contains, for delivery and the customs declaration.
- Customs and tax authorities, and our accountant, where the law requires it.
- Hetzner Online GmbH, Germany, which hosts this site and its database.
- Cloudflare, Inc., United States, which runs the network and email routing for our domain.
- Google: mail sent to [email protected] is delivered to a Google mailbox, and our pages load fonts from Google Fonts, which sends your IP address to Google.
5. Transfers outside the EU
The data needed to deliver your order goes to the makers who send it, in the country where they are. For Indonesia and Australia, the transfer is necessary to perform the contract you ask us to perform (Article 49(1)(b) GDPR); the European Commission has not adopted an adequacy decision for either country. For Canada, the legal basis is the European Commission's adequacy decision for Canada, which covers commercial organisations. Cloudflare and Google may also process data in the United States.
6. How long we keep it
- Account data: while your account exists, or until you ask us to delete it.
- Orders and invoices: 10 years, as Portuguese accounting law requires.
- Messages: 2 years.
7. Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable file. If you have an account, you can download your data and ask for deletion from your account page; anyone can ask by writing to [email protected]. We answer within 30 days, free of charge.
You can complain to the Portuguese data protection authority, CNPD (www.cnpd.pt), or to the authority in your own country.
8. Cookies
The cookies this site sets are listed in our Cookie Policy.