Privacy policy

Last updated: October 3, 2026

This Privacy Policy explains how Loja dos Puzzles collects, uses, shares and protects the personal data of people who visit the website lojadospuzzles.com, create an account, make a purchase or communicate with us (together, the "Services"). In this policy, "we" refers to Loja dos Puzzles and "you" refers to any person whose data we process, whether a customer, a website visitor or another individual.

We process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), with Lei n.º 58/2019 (the Portuguese law implementing the GDPR) and with Lei n.º 41/2004 (the Portuguese law on privacy in electronic communications). Please read this policy carefully.

Data controller

The controller responsible for processing your personal data is:

Loja dos Puzzles, operated by RULE'S SCAPE, LDA
NIF (Portuguese tax number) 518815617
Rua do Passal, n.º 7, São Romão de Neiva, 4935-537 Viana do Castelo, Portugal
Email: info@lojadospuzzles.com
Phone: +351 965 677 050 (call to the Portuguese national mobile network)

What personal data we collect

"Personal data" means any information relating to an identified or identifiable natural person. The data we collect depends on how you interact with us.

Data you provide to us directly

  • Contact details: name, address, phone number and email address.
  • Order details: name, billing address, shipping address, tax identification number (if you provide it for invoicing), payment confirmation, email address and phone number.
  • Account details: username, password, security questions and other information used to keep your account secure.
  • Shopping data: products you view, add to your cart, save to your account or buy, as well as related product reviews, loyalty points, referrals or gift cards.
  • Customer support data: information you choose to include in your communications with us, for example when you send a message through the contact page or by email.
  • Newsletter data: email address and communication preferences, if you subscribe to our newsletter.

Some data is necessary to enter into and perform the purchase contract (for example, your name, shipping address and email). If you do not provide it, we will not be able to process your order. Other data is optional, but without it some features of the Services may not be available.

Data collected automatically

When you use the Services, we may automatically collect certain information about your interaction with us ("Usage Data"), such as device and browser information, network connection information, your IP address, your approximate location derived from your IP address and the pages you visit. To do this we use cookies, pixels and similar technologies ("Cookies"), as described in the Cookies section below.

Data we obtain from third parties

  • Shopify, the platform that powers our online store.
  • Payment service providers, which confirm your payment and related information to us (for example, the payment method used and the billing address). Full card details are handled directly by these providers and are not stored by us.
  • Carriers, which inform us about the status of your delivery.
  • Analytics and advertising partners, when you accept their Cookies, which provide us with information about how you interact with the website, with the emails we send or with our ads.

Data we obtain from third parties is processed in accordance with this Privacy Policy.

Purposes and legal bases for processing

We only process your personal data when there is a legal basis under Article 6 GDPR:

  • Processing and delivering orders: processing payments, preparing and shipping orders, sending order notifications and handling returns, exchanges, the exercise of the right of withdrawal and warranty claims (see our Refund Policy). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Managing your customer account: creating, maintaining and managing your account, if you choose to create one, in accordance with our Terms of Service. We may also improve your shopping experience by allowing Shopify to link your account with other Shopify services you choose to use; in that case, Shopify processes your data in accordance with its own Privacy Policy. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Customer support: answering your messages, requests for information and complaints. Legal basis: performance of a contract or steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to you and maintaining our business relationship (Art. 6(1)(f) GDPR).
  • Compliance with legal obligations: issuing invoices, meeting tax and accounting obligations and responding to complaints and requests from authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
  • Direct marketing: sending our newsletter and promotional communications by email or text message. Legal basis: your consent (Art. 6(1)(a) GDPR and Lei n.º 41/2004). If you are already a customer, we may email you information about products similar to those you have bought, based on our legitimate interest (Art. 6(1)(f) GDPR), as permitted by Lei n.º 41/2004. You can opt out of these communications at any time using the unsubscribe link included in every message or by contacting us.
  • Analytics and personalized advertising: understanding how the website is used and showing you more relevant ads on our website and on other websites, through non-essential Cookies. Legal basis: your consent (Art. 6(1)(a) GDPR), given through the cookie banner.
  • Security and fraud prevention: detecting, investigating and preventing fraudulent, illegal or malicious activity and keeping the website secure. Legal basis: our legitimate interest in protecting the store, our customers and our rights (Art. 6(1)(f) GDPR).
  • Improving the Services: improving how the website works, our catalog and the service we provide. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
  • Product reviews: publishing the reviews you choose to submit. Legal basis: your consent (Art. 6(1)(a) GDPR).
  • Defending our rights: establishing, exercising or defending legal claims in judicial, arbitration or administrative proceedings. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

If you create an account, you are responsible for keeping your login credentials secure and for not sharing them with anyone. If you suspect that your account has been compromised, please contact us immediately.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. We do not process special categories of personal data (for example, health data) and we do not use your data to infer characteristics about you.

Cookies

We use cookies and similar technologies to run the store, remember your actions and preferences (for example, the contents of your cart), analyze how the website is used and, with your consent, show you personalized advertising.

Cookies that are strictly necessary for the website to work are used without consent, as permitted by Lei n.º 41/2004. Analytics and advertising cookies are only used if you accept them in the cookie banner, and you can change or withdraw your consent at any time in the website's cookie preferences.

For information about the cookies Shopify uses to run our store, see https://www.shopify.com/legal/cookies.

You can also set your browser to remove or reject cookies. Please note that removing or blocking cookies may affect your experience and cause some features, such as the shopping cart, to stop working properly.

Recipients and processors

We only share your personal data to the extent necessary for the purposes described above, with the following categories of recipients:

  • Shopify (Shopify International Limited, Ireland, and other Shopify group companies), which provides the e-commerce platform, website hosting and checkout.
  • Payment service providers, such as the companies that process MB WAY, Multibanco and Payshop payments.
  • Carriers, such as CTT, to deliver orders and handle returns.
  • Technology service providers that support us, for example with sending emails and the newsletter, managing product reviews, customer support, cloud storage and data analytics.
  • Analytics and advertising partners, only when you have given your consent through the cookie banner. These partners process data in accordance with their own privacy policies.
  • Our certified accountant and advisors, to meet legal, tax and accounting obligations.
  • Public authorities, courts and dispute resolution bodies, when required by law or to defend our rights.
  • Other third parties, at your request or with your consent, for example when you use social media widgets or login integrations.
  • A potential buyer or successor, in the context of a transaction such as a merger or the sale of the business, as permitted by law.

Providers that process data on our behalf act as processors under contracts that comply with Article 28 GDPR and may only process the data in accordance with our instructions. Some recipients, such as payment service providers and carriers, may also process data as independent controllers, in accordance with their own privacy policies.

International transfers

Some of our service providers, such as Shopify, may process your personal data outside the European Economic Area (EEA), for example in Canada or the United States. In such cases, we ensure that the transfer is covered by appropriate safeguards under Chapter V GDPR, namely:

  • an adequacy decision of the European Commission (such as the one covering Canada or companies certified under the EU-U.S. Data Privacy Framework); or
  • Standard Contractual Clauses approved by the European Commission, together with supplementary measures where necessary.

You can request more information about these safeguards, or a copy of them, using the contact details in this policy.

Data retention

We keep your data only for as long as necessary for the purposes for which it was collected:

  • Orders and invoicing: 10 years, to meet the tax and accounting obligations laid down by Portuguese law.
  • Warranty and complaints: for the 3-year legal guarantee period from delivery and, after that, until the end of the legal limitation periods applicable to any disputes.
  • Customer account: while the account is active or until you ask us to delete it.
  • Newsletter and marketing: until you withdraw your consent or unsubscribe.
  • Customer support requests: for as long as necessary to handle the request and any resulting complaints.
  • Product reviews: while they are published or until you ask us to remove them.
  • Cookies: for the period shown in the cookie preferences, which varies from cookie to cookie.

At the end of these periods, the data is deleted or anonymized.

Security

We apply appropriate technical and organizational measures to protect your personal data against loss, unauthorized access, alteration or disclosure, including encrypted connections (HTTPS) and restricted access to data.

However, no security measure is perfect or impenetrable, and data transmission over the internet is never completely secure. We recommend that you do not use insecure channels to send us sensitive or confidential information.

User-generated content

The Services may allow you to post product reviews and other content. If you choose to post content in a public area of the Services, that content, including the name you provide, becomes public and accessible to anyone.

We do not control how third parties use information you choose to make public and we are not responsible for the privacy or security of that information. You can ask us to remove your reviews at any time by contacting us.

Third-party websites and links

Our website may contain links to third-party websites or platforms, including social networks. We do not control these websites and are not responsible for their privacy and security practices, so we recommend that you read their privacy policies and terms.

Information you share on third-party social media platforms may be seen by other users of those platforms. Including a link does not imply that we endorse the content of those platforms or their owners or operators.

Children's data

Although we sell puzzles and games for children, the Services are intended for adults and we do not knowingly collect personal data from children. If you are the parent or legal guardian of a child who has provided us with personal data, please contact us to request its deletion.

Your rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access: to know whether we process your data, obtain a copy of it and receive information about how we process it.
  • Right to rectification: to have inaccurate or incomplete data corrected.
  • Right to erasure: to have your data deleted when it is no longer needed or when the processing has no legal basis, unless the law requires us to keep it.
  • Right to restriction of processing: to ask us to restrict the processing of your data in certain circumstances, for example while we verify its accuracy.
  • Right to data portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, and to ask us to transmit it to another controller, where the processing is based on consent or a contract and is carried out by automated means.
  • Right to object: to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, and to object, without giving any reason, to processing for direct marketing purposes.
  • Right to withdraw consent: where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise any of these rights, send an email to info@lojadospuzzles.com or write to us at the address given in the Data controller section. Exercising your rights is free of charge.

We will respond within one month of receiving your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will let you know. We may ask you for additional information to confirm your identity before responding.

Communication preferences: you can stop receiving promotional emails at any time using the unsubscribe link included in every email. We will continue to send you necessary non-promotional messages, such as those about your account or your orders.

Complaints

If you have a complaint about how we handle your personal data, please contact us first so that we can try to resolve the issue.

You also have the right to lodge a complaint with a supervisory authority. In Portugal, the competent authority is the CNPD, Comissão Nacional de Proteção de Dados (the Portuguese data protection authority) (www.cnpd.pt). If you live or work in another Member State of the European Union, you can also complain to the data protection authority of that country. A list of these authorities is available on the European Data Protection Board website.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our practices or for operational, legal or regulatory reasons. The revised version will be posted on this page with an updated "Last updated" date. If the changes are significant, we will inform you by appropriate means where required by law.

Contact

If you have any questions about this Privacy Policy or about how we process your personal data, or if you wish to exercise your rights, contact us by email at info@lojadospuzzles.com, by phone at +351 965 677 050 (call to the Portuguese national mobile network) or through our contact page. You can also write to us at RULE'S SCAPE, LDA, Rua do Passal, n.º 7, São Romão de Neiva, 4935-537 Viana do Castelo, Portugal.