Privacy
Privacy policy
This policy explains what personal data we process, why, on what legal basis, for how long and what rights you have. It applies to the relevo3d.com site and everything that follows from it: orders, quotes, customer accounts and the newsletter.
Who processes your data
The data controller is [RAZÃO SOCIAL], tax number PT314797793, with its registered office at [MORADA DA SEDE].
For any data protection matter, write to talkto@relevo3d.com or to talkto@relevo3d.com. We have not appointed a data protection officer: given the scale and nature of our processing, it is not required.
What data we process and on what legal basis
We process only what is needed to manufacture, invoice and deliver. Each purpose has its own legal basis.
| Purpose | Data | Legal basis |
|---|---|---|
| Produce, invoice and deliver the order | Name, email, phone, delivery and billing address, content of the piece (text, font, height, colour, finish) | Performance of the contract, art. 6(1)(b) GDPR |
| Respond to quote requests and submitted logos | Name, email, phone, uploaded vector file, description of the request | Pre-contractual steps at your request, art. 6(1)(b) GDPR |
| Create and maintain your account, including Google sign-in | Name, email, phone, saved addresses, order history | Performance of the contract, art. 6(1)(b) GDPR |
| Issue invoices and keep tax records | Name, billing address, tax number when provided, amount and date | Legal obligation, art. 6(1)(c) GDPR and applicable tax law |
| Process payment and prevent payment fraud | Transaction identifier, method used, country of the payment method, last four digits of the card where applicable | Performance of the contract and legitimate interest, art. 6(1)(b) and 6(1)(f) GDPR |
| Send the newsletter | Name and email | Consent, art. 6(1)(a) GDPR |
| Non-essential cookies and measurement | Device identifier, pages viewed, source of the visit | Consent, art. 6(1)(a) GDPR |
| Site security, access logs and abuse prevention | IP address, date and time, browser type, account actions | Legitimate interest, art. 6(1)(f) GDPR |
Providing this data is not mandatory, but without the contact, delivery and billing details we cannot accept or fulfil the order.
Payment data
Card details never pass through us. They are collected directly by Stripe, which acts as an independent controller as regards fraud prevention and compliance with payment scheme rules. On our side we keep only the transaction identifier, the method used and, where applicable, the last four digits, so you can recognise the purchase.
How long we keep it
| Category | Retention period |
|---|---|
| Invoices and tax records | 10 years from the end of the financial year, as a tax obligation |
| Order data and purchase history | 5 years after delivery, to cover the guarantee of conformity and any disputes |
| Customer account | For as long as the account exists. If you request deletion, we erase it within 30 days, except what tax law requires us to keep |
| Uploaded logo files | 12 months after the work is completed or the quote is declined. After that they are deleted from storage |
| Quote requests without a purchase | 12 months after the last contact |
| Newsletter | Until you unsubscribe. We keep a record of the unsubscription so as not to contact you again |
| Security and access logs | 12 months |
| Customer support messages | 3 years after the matter is closed |
Once the period ends, the data is deleted or irreversibly anonymised.
Who we share it with
We do not sell data. We share only what is necessary with providers who work on our behalf, under a processing agreement pursuant to art. 28 GDPR, and with authorities where the law requires it.
| Provider | Role | Location and safeguard |
|---|---|---|
| Stripe | Payment processing, including MB Way and Multibanco | EU and United States, under standard contractual clauses |
| Resend | Sending of transactional emails and the newsletter | United States, under standard contractual clauses |
| Supabase | Database and storage of uploaded files | EU region |
| Vercel | Site hosting and technical logs | United States, under standard contractual clauses |
| Google account sign-in, when you choose that option | United States, under standard contractual clauses | |
| Replicate | Image generation for marketing material. Does not receive personal data of customers | United States, under standard contractual clauses |
| [TRANSPORTADORA] | Order delivery: name, address, phone and contact email | EU |
Transfers outside the European Union
Some of these providers are based in the United States. In those cases the transfer relies on the standard contractual clauses approved by the European Commission, pursuant to art. 46(2)(c) GDPR, and, where the provider is certified, on the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards applied.
Your rights
- Access: Know what data we hold about you and receive a copy.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Ask us to delete your data, where it is no longer needed and the law does not require us to keep it.
- Restriction: Ask us to suspend processing while a challenge is being resolved.
- Portability: Receive, in a structured, machine-readable format, the data you gave us, and ask us to send it to another controller.
- Objection: Object to processing carried out on the basis of legitimate interest, including any marketing communication.
- Withdraw consent: At any time, without justification, for the newsletter and non-essential cookies. Withdrawal does not affect what was processed before.
To exercise any of these rights, write to talkto@relevo3d.com. We may ask for details to confirm your identity, so as not to hand data to someone who is not the data subject. We reply within 1 month of the request. If the request is complex, that period may be extended by a further 2 months, and in that case we notify you within the first month, with the reasons.
If you believe we are processing your data improperly, you may lodge a complaint with the competent supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, geral@cnpd.pt, www.cnpd.pt. If you reside in another Member State, you may complain to the competent supervisory authority of your country.
Automated decisions and profiling
We do not make solely automated decisions that produce legal effects concerning you or that significantly affect you, and we do not carry out profiling for that purpose. The price calculation in the configurator is arithmetic on the options you choose, not an assessment of you.
Minors
The service is not aimed at children under 16 and we do not knowingly collect data from children under 16. If you become aware that a minor has given us data, let us know and we will delete it.
Security
The site runs over HTTPS, passwords are stored with a cryptographic hash and never in plain text, and access to data is limited to those who need it to work. The files you upload are held in private storage, accessible only via a short-lived signed link, and are served as downloads in an isolated mode, so they cannot run code in your browser.
If there is a personal data breach that entails a risk to your rights and freedoms, we notify the CNPD within 72 hours of becoming aware of it. Where the risk is high, we also inform you directly and without undue delay, stating what happened, which data was affected and what you can do.
Cookies
The use of cookies and similar technologies is described in the cookie policy. Non-essential cookies are only installed with your consent and you can withdraw it whenever you wish.
Changes to this policy
If we change this policy, we publish the new version on this page and update the date. Where the change is material, we notify by email anyone with an active account.
Last updated: 29 July 2026
This text needs legal review before the shop opens. The markers in brackets must be filled in with the company's real details.