Privacy policy


Tokens & Tales ("we", "us") is the controller of the personal data collected through this website and processes such data in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese law.

1. Personal Data We Collect

Orders and Customer Accounts

Data: Name, email address, billing and shipping address, phone number, tax identification number (NIF), and order details.

Purpose: Processing orders, delivering products, providing customer support, issuing invoices, and complying with legal obligations.

Legal basis: Performance of a contract and compliance with legal obligations.

Contact Requests

Data: Name, email address, and any information you choose to provide.

Purpose: Responding to enquiries and providing customer support.

Legal basis: Consent or our legitimate interest in responding to your request.

Marketing

Data: Email address and information about your interactions with our store where applicable.

Purpose: Sending newsletters and promotional communications.

Legal basis: Consent. You may withdraw your consent at any time.

2. Data Sharing

We share personal data only where necessary to operate our business, including with:

  • Shopify (our ecommerce platform);
  • payment providers;
  • shipping and logistics providers;
  • email and marketing service providers (where you have consented);
  • professional advisers and public authorities where required by law.

Some providers may process data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, including the European Commission's Standard Contractual Clauses where required.

3. Data Retention

We retain personal data only for as long as necessary, including:

  • accounting and tax records: 10 years;
  • customer account information: until the account is deleted;
  • marketing data: until consent is withdrawn or no longer required.

4. Your Rights

You have the right to:

  • access your personal data;
  • rectify inaccurate data;
  • request erasure;
  • restrict or object to processing where applicable;
  • request data portability;
  • withdraw consent at any time where processing is based on consent;
  • lodge a complaint with the Portuguese Data Protection Authority (CNPD).

To exercise your rights, contact us at suporte@tokensandtales.com.

5. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure.

6. Contact

If you have any questions about this Privacy Policy or our processing of your personal data, please contact us at: suporte@tokensandtales.com.