PRIVACY POLICY

1. PURPOSE AND SCOPE

1.1. This Privacy and Cookies Policy governs the processing of personal data carried out in connection with the website dudeco.pt, hereinafter referred to as the “SITE”, as well as the use of cookies and similar technologies and the processing of data arising from the relationship established between DUDECO and its customers, users, prospective customers and other data subjects.

1.2. The purpose of this Policy is to provide clear and transparent information about the personal data processed by DUDECO, the respective purposes and legal bases, recipients, applicable retention periods, the rights of data subjects and the conditions governing the use of cookies and similar technologies.

1.3. Personal data is processed in accordance with Regulation (EU) 2016/679 of 27 April 2016, hereinafter the “GDPR”, Portuguese Law No. 58/2019 of 8 August, and all other applicable Portuguese and European legislation concerning personal data protection, privacy and electronic communications.

2. DATA CONTROLLER

2.1. The controller responsible for the processing of personal data is:

DUDECO HOUSE - MOBILIÁRIO E DECORAÇÃO, UNIPESSOAL LDA.

Portuguese Tax ID (NIPC): 516263781

Registered office: Avenida Menino Jesus de Praga, n.º 1895, 4630-001 Marco de Canaveses, Portugal

Email: geral@dudeco.pt

Telephone: +351 910 309 520

Website: dudeco.pt

2.2. For any matter relating to the processing of personal data, the use of cookies or the exercise of the rights set out in this Policy, the data subject may contact DUDECO at geral@dudeco.pt.

3. PERSONAL DATA PROCESSED

3.1. DUDECO processes personal data that is adequate, relevant and limited to what is necessary for the purposes for which it is collected.

3.2. Depending on how the data subject interacts with DUDECO, the following data may, in particular, be processed:

a) Identification data, namely name;

b) Contact data, namely email address, telephone number and postal address;

c) Tax identification number, where required for invoicing purposes;

d) Billing and delivery data;

e) Order-related data, including products purchased, value, order status, returns, exchanges, complaints and purchase history;

f) Customer account data, where an account is created on the SITE;

g) Data relating to contact requests, customer support or complaints;

h) Data relating to requests for commercial information or relationships established with professional or business customers;

i) Data relating to subscriptions to newsletters, campaigns, availability alerts or other communications;

j) Reviews, ratings or content voluntarily submitted in relation to products or services;

k) Technical and SITE usage data, including IP address, online identifiers, device type, operating system, browser, pages visited, source of access, interactions with the SITE and similar information;

l) Data relating to interaction with advertising campaigns, advertisements, emails, newsletters or other digital communications;

m) Approximate location data that may be inferred from the IP address or other technical information, where applicable;

n) Preferences relating to cookies, marketing and communications.

3.3. DUDECO does not intend to collect special categories of personal data, including data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for the unique identification of a person, or data concerning a person’s sex life or sexual orientation.

3.4. The data subject should avoid voluntarily providing data belonging to the categories referred to in the previous paragraph, unless this is strictly necessary and there is an appropriate legal basis for the relevant processing.

4. HOW DATA IS COLLECTED

4.1. Personal data may be collected:

a) Directly from the data subject through the SITE;

b) During the creation or use of a customer account;

c) During the ordering and payment process;

d) When the data subject contacts DUDECO by email, telephone, form or other means;

e) When subscribing to newsletters, alerts or other communications;

f) When participating in campaigns or promotions;

g) When submitting reviews, ratings or other content;

h) Automatically, through cookies, pixels, tags, identifiers and similar technologies, under the conditions set out in this Policy;

i) Through platforms and service providers used by DUDECO, to the extent necessary for the functionalities used and in accordance with applicable law.

5. PURPOSES AND LEGAL BASES

5.1. DUDECO may process personal data for the purposes and on the legal bases set out in this clause.

5.2. Order management and performance of the contract

Data may be processed for:

a) Registration and processing of the order;

b) Payment management;

c) Invoicing;

d) Preparation, dispatch and delivery;

e) Communication regarding order status;

f) Management of cancellations, returns, exchanges and refunds;

g) Handling requests relating to warranties or product conformity.

The legal basis for this processing is the performance of a contract or taking pre-contractual steps at the request of the data subject.

5.3. Customer account management

Data may be processed to create, maintain and manage the customer account and make the associated functionalities available.

The legal basis is the performance of the contract or taking steps requested by the data subject.

5.4. Invoicing and compliance with legal obligations

Data may be processed for the issue and retention of accounting and tax documents and for compliance with other legal obligations applicable to DUDECO.

The legal basis is compliance with a legal obligation.

5.5. Delivery and logistics

The data necessary for delivery may be processed and disclosed to carriers, logistics operators or other providers involved in the preparation, dispatch and delivery of products.

The legal basis is the performance of the contract.

5.6. Customer support

Data may be processed to respond to requests for information, complaints, assistance requests or other communications made by the data subject.

Depending on the specific circumstances, processing may be based on performance of the contract, taking pre-contractual steps, compliance with legal obligations or DUDECO’s legitimate interest in providing assistance and managing its relationship with customers and users.

5.7. Fraud prevention and security

DUDECO may process certain data to prevent, detect and investigate fraud, unauthorised access, misuse of the SITE, security incidents or other potentially unlawful activities.

The legal basis is DUDECO’s legitimate interest in protecting its systems, operations, customers and assets and, where applicable, compliance with legal obligations.

5.8. Direct marketing

DUDECO may process contact data to send newsletters, news, promotional campaigns, offers or other commercial communications where there is a lawful basis for doing so.

Whenever consent is legally required, such communications will only be sent after consent has been obtained.

Where the law permits communications concerning DUDECO’s own products or services that are similar to those previously purchased by the customer, processing may be carried out under the legally applicable conditions, always ensuring the possibility to object.

The data subject may, at any time and free of charge, unsubscribe or object to receiving marketing communications.

5.9. Advertising, remarketing and campaign measurement

With consent, where legally required, certain data relating to browsing and use of the SITE may be processed to:

a) Measure the effectiveness of advertising campaigns;

b) Attribute conversions;

c) Carry out remarketing;

d) Display more relevant advertising;

e) Analyse interaction with advertisements and campaigns;

f) Create or use audience segments.

5.10. Analysis and improvement of the SITE

With consent, where legally required, usage and browsing data may be used to produce statistics, analyse the performance of the SITE and improve its functionalities, content, navigation and user experience.

5.11. Product reviews and opinions

Where a user chooses to submit a review, rating or comment, the relevant data may be processed to collect, manage, verify and display that review.

The legal basis will depend on the specific functionality used and the circumstances of the processing and may correspond to performance of the requested service, consent or DUDECO’s legitimate interest in collecting and making feedback concerning the products it sells available.

5.12. Availability alerts and pre-orders

Where the user requests a back-in-stock alert, product availability alert, pre-order or similar functionality, the relevant data may be processed to manage the request and send the corresponding notification.

The legal basis is taking the steps requested by the data subject.

6. REQUIREMENT TO PROVIDE DATA

6.1. Certain personal data is necessary for entering into or performing the contract, namely data required to identify the customer and for invoicing, payment and delivery.

6.2. Failure to provide such data may prevent DUDECO from accepting or fulfilling an order or providing a requested functionality.

6.3. Fields that must be completed will, whenever possible, be identified as mandatory.

7. RECIPIENTS AND SERVICE PROVIDERS

7.1. In order to ensure the operation of the SITE, fulfil orders and carry out its business, DUDECO uses service providers that may have access to personal data to the extent necessary to provide their respective services.

7.2. Depending on the purpose and where necessary, data may be disclosed to the following categories of recipients:

a) E-commerce platforms;

b) Hosting, technology infrastructure, security and content delivery providers;

c) Payment service providers;

d) Banks and financial institutions;

e) Carriers and logistics operators;

f) Email, marketing and automation service providers;

g) Analytics and measurement service providers;

h) Digital advertising platforms;

i) Review and feedback tool providers;

j) Application and tool providers used for managing the online store, product availability, promotions, B2B functionalities or optimisation of the shopping experience;

k) Accounting, tax, legal, IT and auditing service providers;

l) Administrative, tax, law enforcement, regulatory or judicial authorities, where disclosure is required or permitted by law.

7.3. Providers and technologies used within the SITE’s technology ecosystem include, in particular, Shopify, Klaviyo, Google services, Klarna, PayPal, Judge.me, Timesact and Cloudflare.

7.4. Google technologies used or integrated into the SITE may include Google Analytics, Google Tag Manager, Google Ads, Google Conversion Linker, Google Call Conversion Tracking, Google Remarketing and associated services.

7.5. The existence of a particular technology integration does not mean that the relevant provider has access to all personal data processed by DUDECO.

7.6. The data actually processed depends on the functionality used, its configuration, the user’s interaction and, where applicable, the preferences and consents expressed by the user.

7.7. Whenever a provider processes personal data on behalf of DUDECO as a processor, the contractual measures required by Article 28 of the GDPR will be adopted.

7.8. Certain providers may process data as independent controllers in relation to processing operations whose purposes and means they determine independently, in which case their respective privacy policies will apply.

8. PAYMENTS

8.1. Payments made through the SITE are processed using the payment methods and payment service providers made available during checkout.

8.2. Depending on the option selected by the CUSTOMER, Shopify Payments, Shop Pay, Klarna, PayPal, Multibanco or other payment methods made available on the SITE may be used.

8.3. The data necessary to process payment may be processed directly by the relevant provider.

8.4. As a rule, DUDECO does not need to store the full bank card details used by the CUSTOMER, as these are processed by the providers responsible for payment processing in accordance with their legal obligations and privacy policies.

9. SHOPIFY

9.1. The SITE uses the Shopify platform to provide and manage the online store.

9.2. Use of this platform may involve processing data necessary for store operation, account management, carts, orders, payments, security, analytics and other functionalities associated with the service.

9.3. Depending on the operation carried out, Shopify may process data on behalf of DUDECO or within the scope of its own responsibilities.

9.4. Where applicable, the user may also consult the privacy information provided by Shopify regarding processing for which Shopify is responsible.

10. MARKETING AND KLAVIYO

10.1. DUDECO uses tools for marketing management and automation, including Klaviyo and functionalities available through the Shopify ecosystem.

10.2. These tools may be used, in particular, for:

a) Newsletter management;

b) Commercial campaigns;

c) Recipient segmentation;

d) Communication automation;

e) Preference management;

f) Analysis of opening, delivery and interaction with communications;

g) Sending communications related to the purchasing process, where legally permitted.

10.3. Whenever processing depends on consent, consent may be withdrawn at any time.

10.4. The data subject may unsubscribe via the link included in the communications themselves or by contacting geral@dudeco.pt.

10.5. Withdrawal of consent does not affect the lawfulness of processing carried out previously on the basis of validly given consent.

11. COOKIES AND SIMILAR TECHNOLOGIES

11.1. Cookies are small files or information records stored on or accessed through the device used to visit a website.

11.2. The SITE may use cookies, pixels, tags, identifiers, local storage and other similar technologies to ensure its operation, remember preferences, measure SITE usage and, with consent where legally required, carry out analytics, personalisation and advertising.

11.3. For the purposes of this Policy, references to “cookies” also include similar technologies whenever they perform equivalent functions.

12. CATEGORIES OF COOKIES

12.1. Cookies used on the SITE may be grouped into the following categories:

a) Strictly necessary cookies

These are necessary for the operation of the SITE and to provide the functionalities requested by the user.

They may be used, in particular, to ensure security, authentication, session management, shopping cart operation, checkout processing, storage of privacy preferences and other essential functions.

These cookies do not require consent when they are strictly necessary to provide the service requested by the user.

b) Functional or preference cookies

These enable additional functionalities or remember certain choices and preferences made by the user.

Where the use of these cookies is not strictly necessary, consent will be requested in accordance with applicable law.

c) Analytics or performance cookies

These make it possible to understand how users interact with the SITE, measure visits and usage, identify the most frequently viewed pages, analyse performance and improve the browsing experience.

They may include technologies associated with Google Analytics and other analytics tools used by DUDECO.

Where legally required, these cookies will only be activated after the user has given consent.

d) Advertising and marketing cookies

These make it possible to measure campaigns, attribute conversions, carry out remarketing, limit or manage the display of advertisements and, where applicable, display advertising tailored to the user’s interests or interactions.

They may include technologies related to Google Ads, Google Conversion Linker, Google Call Conversion Tracking, Google Remarketing and other marketing tools used by DUDECO.

These cookies or technologies will be used with consent where legally required.

13. THIRD-PARTY TECHNOLOGIES

13.1. The SITE integrates both proprietary and third-party technologies.

13.2. Depending on the configuration and functionalities used, cookies or technologies may be associated, in particular, with:

a) Shopify, for store operation, authentication, cart, checkout, security and related functionalities;

b) Google Analytics, to analyse use of the SITE;

c) Google Tag Manager, to manage tags and technologies integrated into the SITE;

d) Google Ads and related technologies, for campaign measurement, conversions and advertising;

e) Klaviyo, for marketing-related functionalities and interaction analysis;

f) Klarna, PayPal, Shopify Payments and other payment providers, where used by the CUSTOMER;

g) Judge.me, for review-related functionalities;

h) Timesact, for functionalities relating to availability, pre-orders or alerts;

i) Cloudflare, for security, performance and infrastructure delivery;

j) Other Shopify applications used for technical or commercial functionalities of the SITE.

13.3. Certain third-party technologies may allow those third parties to receive information about the user’s interaction with the SITE.

13.4. Where such third parties independently determine the purposes and means of certain processing operations, they may act as independent controllers and their respective privacy policies will apply.

14. CONSENT AND COOKIE MANAGEMENT

14.1. On first accessing the SITE, the user will be able to manage their preferences regarding cookies that depend on consent.

14.2. The user may accept or reject cookies that are not strictly necessary and, where categories are provided, select the categories they wish to authorise.

14.3. Refusing cookies that are not strictly necessary should not prevent access to the essential functionalities of the SITE.

14.4. Consent may subsequently be changed or withdrawn through the preference management mechanism made available on the SITE.

14.5. Withdrawal of consent does not affect the lawfulness of processing previously carried out on the basis of validly given consent.

14.6. Simply continuing to browse the SITE will not, in itself, be regarded as consent to the use of cookies that legally require consent.

15. COOKIE DURATION

15.1. In terms of duration, cookies may be:

a) Session cookies, which are deleted when the user closes the browser or ends the session;

b) Persistent cookies, which remain stored for a certain period or until they are deleted by the user.

15.2. The specific duration depends on the purpose, configuration and provider responsible for the technology used.

15.3. Up-to-date information on the cookies and technologies actually used, including, where applicable, their purpose and duration, may be made available through the cookie management mechanism on the SITE.

16. BROWSER SETTINGS

16.1. In addition to the options made available directly on the SITE, the user may configure their browser to block or delete cookies.

16.2. Blocking strictly necessary cookies through browser settings may affect the operation of certain SITE functionalities.

16.3. Managing cookies through the browser is independent of the consent mechanism made available by DUDECO.

17. INTERNATIONAL DATA TRANSFERS

17.1. Some of the providers used by DUDECO belong to international groups or use infrastructure that may involve the processing of data outside the European Economic Area.

17.2. Whenever there is an international transfer of data subject to Articles 44 et seq. of the GDPR, legally permitted mechanisms must be used to ensure the protection of personal data.

17.3. Depending on the circumstances, those mechanisms may include:

a) An adequacy decision adopted by the European Commission;

b) Standard contractual clauses approved by the European Commission;

c) Other appropriate safeguards provided for in the GDPR.

17.4. Where necessary, supplementary measures may also be adopted to ensure an adequate level of protection for transferred data.

17.5. The data subject may request additional information about the safeguards applicable to international transfers of their data by contacting geral@dudeco.pt.

18. RETENTION OF PERSONAL DATA

18.1. Personal data will be retained only for the period necessary for the purposes that determined the relevant processing, without prejudice to retention periods imposed by applicable law.

18.2. In determining retention periods, the following will be considered, in particular:

a) The duration of the contractual relationship;

b) Statutory retention periods for tax and accounting documents;

c) Applicable limitation and expiry periods;

d) The need to establish, exercise or defend legal rights;

e) The duration of consent, where consent is the legal basis for processing;

f) The exercise of the rights to object or erasure, where applicable.

18.3. Data used exclusively for marketing based on consent will be processed while consent remains valid or until the data subject exercises the applicable rights, without prejudice to retaining information strictly necessary to demonstrate consent, its withdrawal or compliance with legal obligations.

18.4. When data is no longer necessary, it will be deleted or anonymised unless there is a legal basis for retaining it.

19. DATA SECURITY

19.1. DUDECO adopts technical and organisational measures appropriate to the risk in order to protect personal data against destruction, loss, alteration, unauthorised disclosure or access, whether accidental or unlawful.

19.2. Measures adopted may include access control mechanisms, secure communications, protection of technology infrastructure and other measures appropriate to the nature of the data and the risks associated with processing.

19.3. Despite the measures adopted, no IT system or transmission of data over the Internet can guarantee absolute security.

19.4. DUDECO will manage any personal data breaches in accordance with the obligations set out in the GDPR.

20. RIGHTS OF DATA SUBJECTS

20.1. Under the terms and conditions provided for in applicable law, the data subject may exercise:

a) The right of access to their personal data;

b) The right to rectify inaccurate or incomplete data;

c) The right to erasure of data;

d) The right to restriction of processing;

e) The right to object to processing;

f) The right to data portability;

g) The right to withdraw consent at any time where processing is based on consent;

h) The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, in the cases provided for by applicable law.

20.2. The rights referred to above are not absolute and are subject to the conditions, limitations and exceptions set out in the GDPR and other applicable legislation.

20.3. To exercise any of these rights, the data subject may contact DUDECO at geral@dudeco.pt, identifying the right they wish to exercise.

20.4. Where there are reasonable doubts concerning the identity of the person submitting the request, DUDECO may request additional information strictly necessary to confirm that person’s identity.

20.5. Requests will be handled within the time limits and under the conditions laid down by applicable law.

21. RIGHT TO OBJECT TO DIRECT MARKETING

21.1. Where personal data is processed for direct marketing purposes, the data subject has the right to object, at any time and free of charge, to the processing of their data for that purpose.

21.2. Once that right has been exercised, personal data will no longer be processed for direct marketing purposes.

21.3. The data subject may exercise this right using the unsubscribe option included in the communications themselves or by contacting geral@dudeco.pt.

22. AUTOMATED DECISION-MAKING AND PROFILING

22.1. Some of the tools used by DUDECO may allow audience segmentation, content personalisation, recommendations or profiling of interests for commercial, analytical or advertising purposes.

22.2. Where such processing depends on consent, it will only be carried out after consent has been obtained.

22.3. In the normal use of the SITE, DUDECO does not make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them, without prejudice to situations permitted by law.

22.4. If processing of this nature is implemented, the data subject will be provided with the information and safeguards required by law.

23. CHILDREN’S DATA

23.1. The SITE and the products marketed by DUDECO are not specifically directed at children.

23.2. DUDECO does not intend to knowingly collect personal data from minors through the SITE outside situations permitted by law.

23.3. If DUDECO becomes aware that data relating to a minor has been collected without an appropriate legal basis, it will take the necessary measures regarding that data in accordance with applicable law.

24. THIRD-PARTY WEBSITES, SOCIAL NETWORKS AND SERVICES

24.1. The SITE may contain links to websites, platforms, social networks or services belonging to third parties.

24.2. DUDECO does not control the privacy practices of those entities where they act independently as controllers.

24.3. Users should consult the relevant privacy policies before providing personal data directly to those third parties.

25. COMPLAINT TO THE SUPERVISORY AUTHORITY

25.1. Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with the competent supervisory authority if they consider that the processing of their personal data infringes applicable law.

25.2. In Portugal, the supervisory authority is:

COMISSÃO NACIONAL DE PROTEÇÃO DE DADOS – CNPD

Avenida D. Carlos I, n.º 134, 1.º

1200-651 Lisboa

Website: cnpd.pt

25.3. Without prejudice to the right referred to above, the data subject may first contact DUDECO at geral@dudeco.pt in order to seek clarification or resolution of any matter relating to the processing of their personal data.

26. CHANGES TO THE PRIVACY AND COOKIES POLICY

26.1. DUDECO may amend this Policy whenever necessary to reflect legal, regulatory, technological or organisational changes or changes to its processing practices.

26.2. The updated version will be published on the SITE together with the relevant update date.

26.3. Where the nature of the changes so requires, additional information measures will be adopted or new consent will be requested where legally necessary.

27. CONTACT DETAILS

27.1. For any matter relating to this Policy, the processing of personal data, cookies or the exercise of data subject rights, the following contact details may be used:

DUDECO HOUSE - MOBILIÁRIO E DECORAÇÃO, UNIPESSOAL LDA.

Avenida Menino Jesus de Praga, n.º 1895

4630-001 Marco de Canaveses, Portugal

Email: geral@dudeco.pt

Telephone: +351 910 309 520

Website: dudeco.pt

Last updated: 6 September 2026.