1. Introduction

To&Li Pure Nature, operated by Katharina Schröter (sole trader), is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, and what rights you have in relation to it.
This policy applies to all personal data collected through www.tolipurenature.com and through any direct communications with To&Li Pure Nature.

By using this website, you acknowledge that you have read and understood this Privacy Policy.

2. Who is Responsible for Your Data
The data controller responsible for your personal data is:
Katharina Schröter Trading as TO&LI Pure Nature Website: www.tolipurenature.com Phone: +351 933 032 836 Email: tolipurenature@gmail.com
As data controller, Katharina Schröter is responsible for determining the purposes and means of processing your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Portuguese law.

3. What Personal Data We Collect
Depending on how you interact with our website, we may collect the following categories of personal data:
a) Account and registration data

• Full name
• Email address
• Password (stored in encrypted form)

b) Order and transaction data
• Delivery address
• Billing information
• Order history and purchase details
• Payment method type (we do not store full card or bank account details)

c) Communication data
• Messages, enquiries, or complaints sent to us by email or phone • Any information you voluntarily provide when contacting us

d) Technical and usage data
• IP address
• Browser type and version
• Pages visited and time spent on the website • Referring website
• Device type

This technical data is collected automatically when you visit our website and may be processed through cookies and similar technologies (see Section 8).

4. How We Use Your Personal Data (See Table 1 below)

5. How Long We Keep Your Data
We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

• Order and transaction data: retained for a minimum of 10 years to comply with Portuguese tax and accounting obligations

• Account data: retained for as long as your account is active, plus a reasonable period after account closure

• Communication data: retained for up to 3 years from the date of last contact

• Technical and usage data: retained for up to 12 months
  When data is no longer needed, it is securely deleted or anonymised

​

6. Who We Share Your Data With
We do not sell, rent, or trade your personal data to third parties.
We may share your data with trusted third-party service providers who assist in operating our website and fulfilling orders, including:

• Payment processors — to securely process your payments (e.g. Multibanco, card payment providers). These providers process payment data under their own privacy policies and security standards.

• Shipping carriers — your name and delivery address are shared with the carrier responsible for delivering your order.

• Website and hosting providers — technical service providers who support the operation of our website.

• Accounting and tax services — where required to fulfil legal and fiscal obligations.
  All third parties with whom we share data are required to handle it in accordance with applicable data protection law and are only authorised to use it for the specific purpose for which it was shared.
  We may also disclose your personal data if required to do so by law, court order, or competent regulatory authority.

​

7. International Data Transfers

Legal Basis

a a a

s ( s

Your personal data is primarily processed and stored within the European Economic Area (EEA). If any data is transferred outside the EEA, we will ensure that appropriate safeguards are in place in accordance with GDPR requirements, such as Standard Contractual Clauses approved by the European Commission.

8. Cookies
Our website uses cookies and similar tracking technologies to improve your browsing experience and analyse website usage.
What are cookies? Cookies are small text files stored on your device when you visit a website. They help the website remember your preferences and understand how you use it.
Types of cookies we use:

• Strictly necessary cookies — essential for the website to function correctly (e.g. keeping items in your shopping cart, maintaining your session). These cannot be disabled.

• Analytical/performance cookies — help us understand how visitors interact with our website so we can improve it (e.g. Google Analytics or similar tools). These are only used with your consent.

• Functional cookies — remember your preferences to improve your experience (e.g. language settings).

• Marketing cookies — used to show you relevant content or advertising, only where you have given consent.

  Managing cookies: You can manage or disable cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the website. You may also withdraw your consent to non-essential cookies at any time by adjusting your preferences through our cookie banner.

  For more information about cookies and how to manage them, visit www.allaboutcookies.org.

​

9. Your Rights Under GDPR

• As a data subject, you have the following rights regarding your personal data:

• Right of access — you have the right to request a copy of the personal data we hold about you.

• Right to rectification — you have the right to request that inaccurate or incomplete data be corrected.

• Right to erasure — you have the right to request deletion of your personal data, subject to certain legal exceptions (e.g. data we are required to retain for tax purposes).

• Right to restriction of processing — you have the right to request that we limit the way we use your data in certain circumstances.

• Right to data portability — you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller where technically feasible.

• Right to object — you have the right to object to processing based on legitimate interests or for direct marketing purposes.

• Right to withdraw consent — where processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

• Right not to be subject to automated decision-making — you have the right not to be subject to decisions made solely by automated means that produce significant effects on you.

  To exercise any of these rights, please contact us at: • Phone: +351 933 032 836
  • Email: tolipurenature@gmail.com

  We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

  10. Security
  We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. These include encrypted data transmission (SSL/HTTPS), secure password storage, and restricted access to personal data.
  However, no method of transmission over the internet is completely secure. While we do our best to protect your data, we cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals, in accordance with GDPR obligations.

11. Links to Third-Party Websites
Our website may contain links to third-party websites. This Privacy Policy applies only to www.tolipurenature.com. We are not responsible for the privacy practices of third-party websites and encourage you to review their privacy policies before providing any personal data.

12. Children's Privacy
Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be published on this page with a revised date. We encourage you to review this policy periodically. Where changes are significant, we will notify you directly where possible.

14. Complaints
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Portuguese data protection authority:
Comissão Nacional de Proteção de Dados (CNPD) Website: www.cnpd.pt Phone: +351 213 928 400
You also have the right to seek a remedy through the courts.
We would, however, appreciate the opportunity to address your concerns directly before you contact the CNPD. Please reach out to us first at tolipurenature@gmail.com or +351 933 032 836.