This Privacy Policy explains what personal data Valled, Lda. processes when you visit this site or buy in the online store, for what purpose, on what legal basis, with whom it is shared, how long it is kept and what rights you have. It is written in accordance with the General Data Protection Regulation (GDPR / RGPD) and Portuguese Law No. 58/2019.

 

1. Who is the controller

The controller is Valled, Lda., company and VAT number 514 022 670, with registered office at Zona Industrial Mós, Lote 6/7, 5300-692 Bragança, Portugal. For any question about this policy or about your data, write to geral@valled.pt or call +351 273 979 117 (call to a Portuguese landline).

 

2. What data we process

• Account data: name, email address, hashed password, telephone and, for companies, business name and tax number;
• Order data: items, delivery and billing addresses, amounts, shipping, history and order status;
• Payment data: Valled does not store your card number. It receives only the payment confirmation, the last digits and the outcome of the operation;
• Communication data: messages you send us, quotation requests, complaints and the history of those exchanges;
• Browsing data: IP address, device type and pages visited, collected through cookies and equivalent technologies, and only to the extent that you allow it.

 

3. Why we use it, and on what basis

• Selling, delivering and supporting: processing the order, charging, shipping and answering the customer. Basis: performance of the contract (Article 6(1)(b) GDPR);
• Invoicing and tax and accounting obligations: issuing and keeping invoices. Basis: compliance with a legal obligation (point (c));
• Security and fraud prevention: technical logs, abuse limitation, protection of the store. Basis: legitimate interest (point (f));
• Marketing and newsletter: sending news and campaigns. Basis: consent (point (a)), which you may withdraw at any time without affecting the lawfulness of prior processing;
• Audience measurement: usage statistics for the site. Basis: consent, collected in the cookie banner before any collection takes place.

 

4. Who we share it with

Valled does not sell or rent personal data. It shares data only with those who need it to provide the service, as processors and under a written contract binding them to this policy:

• Stripe: processing of card and local payment methods; it receives card details directly from your browser;
• Resend: sending the store’s transactional emails (order confirmation, dispatch, password recovery);
• InvoiceXpress: issuing and archiving invoices;
• carriers: name, address and telephone, only what is needed to deliver;
• hosting provider: the infrastructure the store runs on.

Data is processed within the European Economic Area. Where any of these providers processes data outside the EEA, it does so under the standard contractual clauses approved by the European Commission or under an adequacy decision. Beyond those cases, data is disclosed to third parties only where the law requires it or a competent authority so orders.

 

5. How long we keep it

• Customer account: while the account is active and for three years after the last contact, after which it is deleted or anonymised;
• Orders and invoices: 10 years, as required by tax and accounting law;
• Complaints and guarantees: for the guarantee period plus the applicable limitation periods;
• Marketing consent: until you withdraw it; the record of consent is kept for as long as it is needed to demonstrate it;
• Technical and security logs: 12 months.

 

6. Your rights

As a data subject you may exercise the following rights at any time:

• Access: to know what data of yours we process and obtain a copy;
• Rectification: to correct inaccurate data or complete incomplete data;
• Erasure: to ask for deletion, where there is no legal obligation to keep the data;
• Restriction of processing: to suspend processing while a challenge is being verified;
• Portability: to receive the data you provided, in a structured, commonly used format, or to have it transmitted to another controller;
• Objection: to object to processing based on legitimate interest and, with no need to give reasons, to direct marketing;
• Withdrawal of consent: at any time, without affecting the lawfulness of what was done before.

To exercise any of these rights write to geral@valled.pt. Valled replies within one month, extendable by two further months in complex cases, and may ask for proof of identity before acting.

 

7. Complaining to the supervisory authority

If you consider that the processing of your data breaches the law, you may lodge a complaint with CNPD (the Portuguese Data Protection Authority), at www.cnpd.pt. We would be grateful if you contacted us first: it is usually quicker to resolve.

 

8. Cookies

This site uses cookies strictly necessary for it to work (session, cart and security) which require no consent. Any others, including audience measurement, are only set after you accept them in the consent banner. You may review or withdraw that choice at any time through the cookie preferences link in the footer.

 

9. Security

The connection to the site is encrypted. Passwords are stored using dedicated derivation algorithms, never in plain text. Access to customer data is restricted to those who need it for their work and is logged. In the event of a personal data breach likely to result in a high risk, Valled notifies the CNPD and the data subjects concerned within the legal deadlines.

 

10. Minors

The store is not aimed at people under 16 and does not knowingly collect data from minors. If you become aware that a minor has provided us with data, contact us: we will delete it.

 

11. Changes to this policy

This policy may be updated. The version in force is always the one published on this page, with the date of the last update at the end. Material changes are communicated by email to account holders.

Last updated: August 2026.