Privacy Policy

1. Who is responsible

STRATEGY AND METHOD, LDA, tax number 518096998, Travessa José Ferreira Marques 13, 4620-912 Lousada, Portugal. Contact for privacy questions: hugo.sanches@icarusintelligence.com.

2. What data we collect

• Order data: name, email, phone, delivery and billing address, tax number (NIF) if you give one, and the items bought.
• Payment data: payment is made on Stripe's page. We do not receive or store your card number; we only receive confirmation of the payment and the method used.
• Withdrawal requests: name, email, order number, items you name, the date and time of the request and a hashed version of the IP address, to prevent abuse.
• Technical data: our hosting records IP addresses and request data for a short period, for security and operation.
• Cart: a random identifier stored in a cookie and the items reserved.

We do not collect dates of birth or any data that is not needed to sell and deliver.

3. What we use it for and on what basis

• Processing and delivering your order, handling returns and withdrawals and answering requests: performance of a contract (Art. 6(1)(b) GDPR).
• Issuing invoices and meeting tax and accounting obligations: legal obligation (point c).
• Preventing fraud and abuse and keeping the Shop secure: legitimate interest (point f).

We do not use the data for advertising and we do not make decisions about you based solely on automated processing.

4. Who we share data with

We share only what is necessary with providers who work for us or need the data to perform their service:

• Stripe (payments).
• Resend (sending emails about your order and withdrawal).
• Supabase (database, hosted in the European Union) and Vercel (website hosting).
• CTT and DHL (delivery: the recipient's name, address, phone and email).
• Our accountant and a certified invoicing service, to issue and keep invoices.
• Authorities, where the law requires it.

Some of these providers may process data outside the European Economic Area. In those cases the transfer relies on mechanisms recognised by the GDPR, such as standard contractual clauses or adequacy decisions.

5. How long we keep data

• Orders and invoices: for the period required by tax and commercial law (generally 10 years).
• Withdrawal requests: the same period as the orders they relate to.
• Abandoned carts: deleted periodically.
• Technical hosting logs: for a short period set by the provider.

6. Your rights

You can ask for access to, correction, erasure, restriction and portability of your data, and object to processing based on legitimate interest, by writing to hugo.sanches@icarusintelligence.com. We reply within one month. Erasure does not apply to data we are legally required to keep (for example invoices).

You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD) at https://www.cnpd.pt.

7. Security

The site uses an encrypted connection (HTTPS), access to the Shop's management requires two-factor authentication, and the database restricts access through security rules. No system is completely immune; if a data breach affects you, we will tell you as the law requires.

8. Changes

We may update this policy. The date of the last update is at the top of the page.