Introduction

Thank you for visiting To&Li Pure Nature. We care deeply about your privacy and want you to feel confident that your personal information is in safe hands.

This Privacy Policy explains what personal data we collect when you visit our website ( www.tolipurenature.com ) or place an order with us, how we use it, who we may share it with, and what rights you have over it.

To&Li Pure Nature is operated by Katharina Schröter, a sole trader (Empresária em Nome Individual) registered in Portugal, and we are committed to handling your data responsibly and in accordance with applicable law.

If you have any questions about this policy, you are always welcome to contact us — details are in Section 10.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

Katharina Schröter — To&Li Pure NatureRua Dr. Teófilo Martins de Oliveira 8 2665-286 Malveira, Portugal NIF: 308588045 Email:  tolipurenature@gmail.com 

Website:  www.tolipurenature.com 

As the data controller, we determine the purposes and means of processing your personal data.

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following types of personal data:

When you place an order:

• Full name

• Delivery address (mainland Portugal only)

• Email address

• Phone number

• Order details and purchase history

• Payment information (processed securely by our payment provider — we do not store full card details)

When you create an account:

• Name and email address

• Password (stored in encrypted form)

• Account preferences

When you contact us:

• Name and email address

• The content of your message

When you visit our website:

• IP address

• Browser type and device information

• Pages visited, time spent, and how you arrived at our site

• Cookie identifiers (see Section 8 for full details)

We do not knowingly collect personal data from children under the age of 16. If you believe we have inadvertently done so, please contact us so we can delete it.

3. How and Why We Use Your Personal Data

We only use your personal data for specific, clear purposes and always on a lawful legal basis under the General Data Protection Regulation (GDPR / RGPD). The table below sets out each processing activity, the reason we carry it out, the legal basis we rely on, and how long we keep the data.

Processing Purposes, Legal Bases, and Retention Periods

Purpose: Processing and fulfilling your orderWe use your name, delivery address, email, phone number, and order details to confirm, process, pack, and deliver your order, and to handle any returns or issues. Legal basis: Article 6(1)(b) GDPR — performance of a contract to which you are a party. Retention: We keep order records for 10 years from the date of the transaction to comply with Portuguese accounting and tax law (Código do IVA and Decreto-Lei n.º 158/2009).

Purpose: Managing your customer accountIf you create an account on our website, we use your data to maintain your account, allow you to log in, view your order history, and manage your preferences. Legal basis: Article 6(1)(b) GDPR — performance of a contract (the account agreement). Retention: For as long as your account remains active. If you close your account, we delete your account data within 30 days, except where we are required to retain it by law.

Purpose: Sending order confirmations and shipping updatesWe send you transactional emails to confirm receipt of your order, notify you when it has been dispatched, and provide tracking information where available. Legal basis: Article 6(1)(b) GDPR — performance of a contract. Retention: These communications are retained for 10 years as part of the order record.

Purpose: Responding to your enquiries and providing customer supportWhen you contact us by email or phone with a question, complaint, or request, we use your contact details and the content of your message to respond to you. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in providing good customer service and resolving any issues promptly. This interest does not override your rights. Retention: We keep correspondence for 2 years from the date of the last contact.

Purpose: Compliance with tax and accounting obligationsPortuguese law requires us to retain invoices, receipts, and financial records for a minimum of 10 years. This includes records linked to your orders. Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation (Código do IVA, Decreto-Lei n.º 158/2009, and related Portuguese tax legislation). Retention: 10 years from the end of the relevant tax year.

Purpose: Website analytics and improvementWe use anonymised or pseudonymised data collected through cookies and analytics tools to understand how visitors use our website, which pages are most popular, and where we can improve the shopping experience. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in improving our website and services. This processing only takes place if you have accepted analytics cookies via our cookie consent banner. Retention: Aggregated analytics data is retained for up to 26 months. Individual session data is typically retained for a shorter period in line with the analytics provider's standard settings.

Purpose: Marketing communicationsWith your consent, we may send you newsletters, product updates, special offers, or information about new arrivals by email. Legal basis: Article 6(1)(a) GDPR — your freely given, specific, and informed consent. You can withdraw your consent at any time by clicking "unsubscribe" in any marketing email or by contacting us directly. Withdrawing consent does not affect any processing carried out before you withdrew it. Retention: Until you withdraw your consent or ask us to stop, or if your email has not engaged with our communications for 3 years.

Purpose: Fraud prevention and website securityWe monitor activity on our website and systems to detect and prevent fraudulent orders, unauthorised access, and other security threats. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in protecting our business and our customers from fraud and security risks. This interest does not override your rights. Retention: Security logs are retained for up to 12 months.

4. Who We Share Your Data With

We do not sell your personal data to anyone, and we will never share it for purposes you would not reasonably expect.

We may share your data with the following categories of third parties, strictly as necessary to run our business:

Delivery and logistics providersWe share your name, delivery address, and phone number with courier and postal services in order to deliver your order. These providers act as data processors on our behalf.

Payment service providersYour payment is processed securely by our payment provider. We do not store full card numbers. The payment provider handles your payment data in accordance with PCI-DSS standards and their own privacy policy.

Website and e-commerce platform (Wix)Our website is built and hosted on the Wix platform. Wix processes certain technical and transactional data as part of hosting our online shop. Wix acts as a data processor under a Data Processing Agreement.

Email service providersWe use email service providers to send order confirmations, shipping updates, and (with your consent) marketing communications.

Analytics providersIf you have consented to analytics cookies, anonymised usage data may be shared with analytics service providers to help us understand how our website is used.

Professional advisorsWe may share data with our accountant, legal advisors, or tax authorities where required to comply with legal obligations.

Law enforcement or regulatory authoritiesWe will disclose personal data to authorities if required to do so by law, court order, or to protect the rights, property, or safety of To&Li Pure Nature, our customers, or the public.

All third parties we work with are required to keep your data secure and to use it only for the purposes we specify. Where required by law, we have Data Processing Agreements in place with them.

5. International Data Transfers

We are a Portuguese business and we primarily process your data within the European Economic Area (EEA), where the same GDPR protections apply.

Some of the third-party service providers we use (such as Wix and analytics providers) may process data outside the EEA, including in countries such as the United States. When this occurs, we ensure that appropriate safeguards are in place to protect your data, such as the European Commission's Standard Contractual Clauses (SCCs), as permitted under Article 46 GDPR. These safeguards ensure that your data receives a level of protection equivalent to that within the EEA.

You can request details of the specific safeguards we rely on by contacting us using the details in Section 10.

6. How We Keep Your Data Safe

We take the security of your personal data seriously. We have put in place appropriate technical and organisational measures to protect your data against accidental loss, unauthorised access, alteration, or disclosure. These include:

• Use of HTTPS encryption across our website

• Secure access controls and password protection for our systems

• Working only with reputable third-party providers who maintain appropriate security standards

• Limiting access to personal data to those who genuinely need it to do their jobs

Although we take every reasonable precaution, no method of transmission over the internet is completely secure. If you have reason to believe your data has been compromised, please contact us immediately.

7. How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purposes set out in Section 3, or as required by law. In general:

• Order and transactional records: 10 years (required by Portuguese tax law)

• Customer account data: for the duration of the account, then deleted within 30 days of closure

• Customer service correspondence: 2 years

• Marketing communications data: until you unsubscribe or for 3 years of inactivity

• Security and fraud prevention logs: up to 12 months

• Analytics data: up to 26 months

When your data is no longer needed, we delete or anonymise it securely.

8. Cookies

Our website uses cookies and similar tracking technologies. Cookies are small files placed on your device when you visit a website. They help the website work correctly, remember your preferences, and (if you consent) allow us to understand how visitors use the site.

Our Cookie Consent Banner

When you first visit  www.tolipurenature.com , you will see a cookie consent banner. You can choose to accept or reject non-essential cookies. Only strictly necessary cookies will be placed without your consent. You can change your cookie preferences at any time by accessing the cookie settings on our website.

Types of cookies we use:

Strictly necessary cookiesThese cookies are essential for the website to function. They enable basic features such as page navigation, adding items to your basket, and completing a purchase. These cookies are placed regardless of your cookie choice and do not require your consent.

Analytics cookies (optional — only with your consent)These cookies allow us to understand how visitors interact with our website, which pages are visited most frequently, and how visitors arrive at our site. This helps us improve our website and your shopping experience. We only place these cookies if you have given your consent via the cookie banner.

Marketing and preferences cookies (optional — only with your consent)These cookies may be used to remember your preferences and, where relevant, to show you content or offers that are more relevant to your interests.

You can withdraw your consent to non-essential cookies at any time. Doing so will not affect the functioning of the essential parts of our website. For more information about managing cookies in your browser, visit  www.aboutcookies.org or the help section of your browser.

9. Your Rights Under GDPR

As a person whose data we process, you have the following rights under GDPR (Regulation (EU) 2016/679) and the Lei n.º 58/2019 (the Portuguese data protection law implementing GDPR):

Right of accessYou have the right to ask us for a copy of the personal data we hold about you.

Right to rectificationIf any of the personal data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it.

Right to erasure ("right to be forgotten")In certain circumstances, you have the right to ask us to delete your personal data. This right applies where, for example, the data is no longer necessary for the purpose it was collected, or you withdraw your consent and there is no other legal basis for processing. This right is not absolute — it does not apply where we are required to keep data by law (for example, tax and accounting records).

Right to restriction of processingIn certain circumstances, you have the right to ask us to restrict the processing of your data — for example, while we verify the accuracy of data you have disputed.

Right to data portabilityWhere processing is based on your consent or on a contract, and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transferred to another controller where technically feasible.

Right to objectWhere we process your data based on legitimate interests (Article 6(1)(f)), you have the right to object to that processing. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. You also have an absolute right to object to direct marketing at any time.

Right to withdraw consentWhere we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal.

Right not to be subject to automated decision-makingWe do not make any decisions about you based solely on automated processing that produce legal or similarly significant effects.

How to exercise your rightsTo exercise any of these rights, please contact us using the details in Section 10. We will respond to your request within one month. In complex cases, we may extend this by a further two months, but we will let you know within the first month if this is the case. We will not charge a fee for reasonable requests.

We may need to verify your identity before we can respond to certain requests.

10. Contact Us

If you have any questions about this Privacy Policy, want to exercise your rights, or have a complaint about how we handle your data, please contact us:

Katharina Schröter — To&Li Pure NatureRua Dr. Teófilo Martins de Oliveira 8 2665-286 Malveira, Portugal Email:  tolipurenature@gmail.com 

We will do our best to resolve any concern you have.

11. Right to Lodge a Complaint with the CNPD

If you are not satisfied with how we have handled your personal data or responded to a request you made under Section 9, you have the right to lodge a complaint with the Portuguese data protection supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)Rua de São Bento, 148 - 3.º 1200-821 Lisboa, Portugal Phone: +351 213 928 400 Email:  geral@cnpd.pt Website:  www.cnpd.pt 

You may also lodge a complaint with the supervisory authority in the EU member state where you habitually reside or work, or where the alleged infringement took place, in accordance with Article 77 GDPR.

12. Consumer Rights (DL 24/2014)

As an online retailer selling to consumers in Portugal, we comply with Decreto-Lei n.º 24/2014 of 14 February 2014, which implements the EU Consumer Rights Directive in Portugal.

Right of withdrawal (direito de arrependimento)If you are a consumer purchasing from our online shop, you have the right to withdraw from the contract within 14 calendar days of receiving your order, without giving any reason, in accordance with Article 10 of DL 24/2014.

To exercise your right of withdrawal, please notify us clearly before the 14-day period expires, by email at  tolipurenature@gmail.com  or by post to the address in Section 1.

Please note that the right of withdrawal may not apply to certain products, in particular perishable goods, products that deteriorate rapidly, or sealed goods that are unsealed after delivery and are not suitable for return due to health or hygiene reasons (Article 17 of DL 24/2014). As our products are natural dog treats and chews, please check the product description or contact us if you are unsure whether the right of withdrawal applies to a specific item.

We will reimburse you within 14 days of receiving your withdrawal notice, using the same payment method you used for the original purchase, unless you have expressly agreed to a different method.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law or how we process data. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

If changes are material, we will notify you by email (if we hold your email address) or by placing a prominent notice on our website.

This Privacy Policy was last updated in July 2026. It applies to all personal data processed by To&Li Pure Nature through the website  www.tolipurenature.com  and related business activities.