Courtesy translation. In case of any discrepancy, the Portuguese version prevails.
Privacy and Cookie Policy
Last updated: 03/09/2026
This policy explains how processes personal data in the digital menu, online orders, customer account, loyalty card and related communications. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR), Law no. 58/2019 and Portuguese law applicable to electronic commerce and communications.
1. Data controller
The controller is the establishment identified on this site: .
The controller's contact details are in the site footer, or can be configured in the back office.
2. What data we process
- Browsing and security data: IP address, date and time of access, pages viewed, browser type, technical session identifiers and records needed for security.
- Account data: name, phone, email, password stored as a hash, address and preferences linked to the account.
- Order data: products chosen, quantities, order notes, contact details, collection or delivery time, order status and the history needed to provide the service.
- Loyalty card and points data: card number or code, points balance, points movements and the history needed for the loyalty programme.
- Feedback data: rating, comment and associated identification when you submit product feedback.
3. Purposes and legal bases
- Managing orders, cart, account and customer support: performance of a contract or pre-contractual steps.
- Points programme and loyalty card: performance of the service requested by the customer and, where applicable, consent or a duly balanced legitimate interest.
- Tax, accounting and legal compliance: compliance with legal obligations.
- Security, abuse prevention and technical maintenance: legitimate interest and the legal obligation to ensure security.
- Direct marketing or promotional communications: only where valid consent exists or another applicable legal basis.
4. Cookies and local storage
We use cookies and local storage necessary for the site to work. These keep your session, cart, cookie preferences and security. Without them, some features such as logging in, ordering or the cart may not work.
| Type | Purpose | Legal basis |
|---|---|---|
| Session cookie | Keeps login, cart and session security. | Necessary for the service / legitimate interest. |
| Cookie preference | Records whether you accepted optional cookies or kept only the necessary ones. | Legal obligation / legitimate interest. |
| Back office and POS local storage | Stores technical preferences in authenticated administrative areas. | Necessary for the tool to work. |
At present the public shop does not enable third-party advertising or analytics cookies unnecessarily. If they are enabled in future, they must depend on prior consent that is freely given, specific, informed and unambiguous.
5. Sharing of data
Data may be processed by service providers needed to run the site, hosting, technical support, communications, invoicing, POS or order printing. Those providers must process the data only on instructions and with appropriate security measures. We do not sell personal data.
6. Retention periods
- Account data: while the account is active or for as long as needed to meet legal obligations.
- Orders and related documents: for the legal period applicable to tax and accounting obligations and the defence of rights.
- Technical and security logs: for the period needed for security and technical diagnosis, limited to what is necessary.
- Consents and preferences: for as long as needed to demonstrate the choice made, or until it is changed or withdrawn.
7. Your rights
Under the GDPR you may exercise the rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent where applicable. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
You may also lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt.
8. Security
We apply appropriate technical and organisational measures, including protected sessions, access control, passwords stored as hashes, secure communications where available, and security logs. No system is entirely free of risk, but we work to reduce those risks and to act when incidents occur.
9. Minors
The service is not intended for the deliberate collection of minors' data without the involvement of their legal representatives. If you detect registration or improper use by a minor, please contact us so it can be reviewed and removed where applicable.
10. Changes to this policy
This policy may be updated to reflect legal, technical or functional changes. The applicable version is the one published on this page.