This Privacy Policy explains what personal data we collect through this website, for what purpose and on what legal basis we process it, how long we keep it, who we share it with and what rights data subjects have.
1. Who we are
This website is owned and operated by Luís Diogo – Equipamentos para Motos, Unipessoal Lda., trading as Atelier da Moto.
| Registered name | Luís Diogo – Equipamentos para Motos, Unipessoal Lda. |
|---|---|
| Company type | Single-member private limited company |
| Registered office | Rua Bernarda Ferreira de Lacerda, n.º 10, Charneca da Cotovia, 2970-839 Sesimbra, Portugal |
| Registry | Commercial Registry of Sesimbra, registration number 506987566 |
| VAT / company number | 506987566 |
| Share capital | €5,000.00 |
| Premises | Urb. Jardim da Amoreira, Praça da República, N6, Loja B, 2620-543 Ramada, Portugal |
| geral@atelierdamoto.com |
Email is our contact channel. We answer every message sent to it.
For any question about personal data, including the exercise of rights, the contact is geral@atelierdamoto.com.
We are not required to appoint a data protection officer, as the conditions in Article 37 of the General Data Protection Regulation are not met.
2. What we process, why and on what basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing, delivering and invoicing orders | First and last name, address, postcode, town, tax number, mobile, email, products ordered and notes | Performance of the contract, Article 6(1)(b) | 10 years, as required by tax law |
| Answering enquiries | Name, email, subject and message | Legitimate interest in replying to those who contact us, Article 6(1)(f) | 1 year after the last interaction, unless it leads to an order |
| Audience measurement and advertising | See the Cookie Policy | Consent, Article 6(1)(a) | See the Cookie Policy |
| Commercial communications | Prior express consent | Until consent is withdrawn |
On that last row we should be plain: we do not currently send commercial communications and there is no subscription mechanism on the website. The purpose is stated in case one is added, and at that point collection will always depend on prior, freely given, express consent, withdrawable at any time and at no cost.
Providing the data marked as required in the order form is necessary to enter into and perform the contract. Without it we cannot process the order or issue the invoice the law requires.
3. Who we share data with
We neither sell nor rent personal data. We use the following providers, who process data on our behalf and only on our instructions:
| Provider | Role | Where processing takes place |
|---|---|---|
| Ifthenpay | Multibanco and MB WAY payment processing | Portugal |
| Hetzner Online GmbH | Website and database hosting | Nuremberg, Germany |
| SMTP2GO | Transactional email delivery | Outside the European Economic Area, under standard contractual clauses |
| Audience measurement, only with consent | United States, under the EU-US Data Privacy Framework adequacy decision | |
| Meta | Advertising measurement and personalisation, only with consent | United States, under the EU-US Data Privacy Framework adequacy decision |
Data may also be disclosed to public authorities where there is a legal obligation, and to our certified accountant for the purpose of meeting tax obligations.
4. International transfers
The main processing, covering all order and enquiry data, takes place on servers located in Germany and therefore within the European Economic Area.
Transfers to third countries are limited to email delivery and to measurement and advertising services, and the latter only occur if you have consented to the corresponding cookie categories. In every case, transfers rest on a European Commission adequacy decision or on standard contractual clauses.
5. Security
We apply appropriate technical and organisational measures to protect data against destruction, loss, alteration or unauthorised access, in particular encryption of communications, access control and restricting access to staff who need it.
No transmission over the Internet is absolutely secure, and we do not make that promise. What we do undertake is to keep measures appropriate to the risk and to notify the supervisory authority and, where applicable, data subjects, within the legal deadlines, should a breach likely to create a risk occur.
6. Your rights
Data subjects have the following rights, exercisable by email to geral@atelierdamoto.com:
- Access, to know what data we process and obtain a copy.
- Rectification, to correct inaccurate data or complete incomplete data.
- Erasure, where the data is no longer necessary or processing is unlawful.
- Restriction of processing, in the situations the law provides.
- Portability, to receive the data in a structured, commonly used format, or have it transmitted to another controller.
- Objection to processing based on legitimate interest.
- Withdrawal of consent at any time, without affecting the lawfulness of earlier processing.
We reply within one month, extendable by two further months in particularly complex cases, in which event we inform you within the first month.
One limit is worth stating plainly: a request for erasure does not cover invoicing data, which tax law obliges us to keep for 10 years. In that case the data stops being used for any other purpose and is merely archived for the legally required period.
7. Complaint to the supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with the supervisory authority:
Comissão Nacional de Proteção de Dados
cnpd.pt
8. Automated decision-making
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning data subjects or similarly significantly affect them.
9. Minors
This website is not aimed at children under 16 and we do not knowingly collect their data. If we learn that we have collected a child's data without the necessary consent, we delete it.
10. Links to other sites
The website contains links to third-party sites, including social networks. This policy does not apply to them, and their privacy practices should be checked with the respective controllers.
11. Changes
This policy may be updated. The version in force is always the one published on this page, with the date shown at the end. Material changes are flagged visibly.