Privacy Policy

Privacy Policy

Last updated: September 2026

1. Identification of the Data Controller

NIXOFY — Sole Proprietorship
Ana Catarina de Freitas Diogo
Tax ID: PT217375251
Av. do Atlântico, Edifício Panoramic, n.º 16, 14.º Piso, Escritório 8
Parque das Nações, 1990-019 Lisbon, Portugal
Email: suporte@nixofy.com
Website: www.nixofy.com

2. Scope and Application

This Privacy Policy applies to the processing of personal data carried out by NIXOFY within the scope of its e-commerce activity, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Portuguese legislation.

3. Personal Data Collected

Identification and contact data:

  • Full name
  • Email address
  • Mobile number (optional) — used exclusively for sending delivery status notifications for your order. Not used for marketing.
  • Delivery and billing address

Transaction data:

  • Order history
  • Payment method (reference only, never full card details)
  • Delivery preferences

Navigation and usage data:

  • IP address
  • Browser and device type
  • Pages visited and time spent
  • Recording of website interaction (mouse movements, clicks, and page scrolling), through the Microsoft Clarity analytics tool, subject to consent — see point 5
  • Cookies (see Cookie Policy)

Product reviews:

  • Name (or first name and initial), rating, review text, and, when submitted, photographs. Published reviews are publicly visible in the store.

4. Purposes and Legal Bases for Processing

  • Order and payment processing — Contract performance (Art. 6(1)(b) GDPR)
  • Issuance of invoices and tax compliance — Legal obligation (Art. 6(1)(c) GDPR)
  • Sending order confirmations and updates by email — Contract performance
  • Sending delivery status notifications by SMS — Contract performance (Art. 6(1)(b) GDPR). These notifications are only sent if you provided a mobile number with your order and relate exclusively to delivery. You can stop receiving them at any time by replying STOP to any message, without affecting your order.
  • Invitation to review purchased products — Legitimate interest (Art. 6(1)(f) GDPR). The invitation is sent by email to the address used for the purchase and can be declined at any time.
  • Customer support and complaint resolution — Legitimate interest (Art. 6(1)(f) GDPR)
  • Sending newsletters and marketing communications — Consent (Art. 6(1)(a) GDPR)
  • Statistical analysis, session recording, and website improvement — Consent, collected via the cookie banner (Art. 6(1)(a) GDPR)
  • Personalised advertising and campaign measurement on third-party platforms — Consent, collected via the cookie banner (Art. 6(1)(a) GDPR)
  • Fraud prevention — Legitimate interest

5. Data Sharing with Third Parties

Your data may be shared with the following entities, always limited to what is necessary for the stated purpose:

Platform and fulfillment:

  • Shopify Inc. — e-commerce platform hosting the store
  • Syncee and its partner suppliers — order processing and shipping
  • Carriers (CTT, DPD, GLS, DHL, and others) — order delivery

Payments and billing:

  • Shopify Payments (Stripe) — card processing
  • Easypay — MB WAY and Multibanco
  • PayPal — payments via PayPal account
  • InvoiceXpress — certified invoicing by the Tax Authority

Customer communication:

  • AfterShip Limited — order tracking and sending delivery notifications by email and SMS. Receives your name, email, mobile number (when provided), delivery address, and order details, exclusively for this purpose.
  • Judge.me — collection and publication of product reviews. Receives your name, email, and order number to send you the review invitation and to associate the review with a verified purchase.
  • E-goi — sending marketing communications by email, when consent has been given.
  • Willdesk — customer support and store chat.

Analytics and advertising (only with your consent):

  • Microsoft Corporation (Microsoft Clarity) — usage statistics, heatmaps, and recording of page interaction, to detect navigation issues and improve the store.
  • Google LLC (Google Analytics and Google Ads) — usage statistics and advertising campaign measurement.
  • Meta Platforms Ireland Limited (Facebook and Instagram) — advertising campaign measurement and presentation of relevant ads. For this purpose, data about your interaction with the store and, in encrypted form (with a hashing function applied), your email, when available, may be transmitted to Meta.

Public authorities:

  • Tax and Customs Authority (AT) — tax obligations

We do not sell your personal data. Apart from the analysis and advertising purposes described above, which depend on your consent and which you can withdraw at any time, we do not transfer your data to third parties for their own commercial purposes.

6. International Data Transfers

Some of our service providers are located outside the European Economic Area, or process data on behalf of entities based in third countries. This is the case, namely, with AfterShip Limited (Hong Kong), which ensures order tracking and the sending of delivery notifications, including SMS messages from infrastructure located in the United States of America, and also Shopify, Judge.me, Microsoft, Google, and Meta, whose infrastructures include servers in the United States of America.

In these cases, we ensure that transfers are made based on appropriate legal mechanisms — adequacy decision by the European Commission, where applicable, or Standard Contractual Clauses approved by the European Commission, accompanied by applicable supplementary measures.

7. Data Retention

  • Order and invoice data: 10 years (Portuguese legal tax obligation)
  • Customer account data: While the account is active + 2 years
  • Navigation data and cookies: Maximum 13 months
  • Session recordings (Microsoft Clarity): According to the tool's retention period, not exceeding 13 months
  • Published product reviews: While the product is available in the store or until removal is requested
  • Marketing communications: Until consent is revoked
  • SMS delivery notifications: Until delivery is completed or until cancellation is requested (STOP)
  • Complaints: 3 years

8. Data Subject Rights

Under the GDPR, you have the following rights:

  • Right to access — to know what data we hold about you
  • Right to rectification — to correct inaccurate or incomplete data
  • Right to erasure ("right to be forgotten")
  • Right to restriction of processing
  • Right to data portability
  • Right to object
  • Right to withdraw consent, at any time and without affecting the lawfulness of processing carried out before withdrawal. You can change your cookie and advertising choices through the store's consent banner.

To exercise any right: suporte@nixofy.com

You can also lodge a complaint with the National Data Protection Commission (CNPD): www.cnpd.pt

9. Data Security

We adopt appropriate technical and organisational measures to protect your personal data, including encrypted transmission (HTTPS/TLS), restricted access by authorised personnel, and PCI DSS certified payment providers.

10. Minors

Our services are not intended for individuals under 16 years of age. We do not knowingly collect data from minors.

11. Changes

We may update this policy periodically. The date of the last update is indicated at the top of this document.

12. Contact

For any questions regarding privacy or the exercise of rights:

Email: suporte@nixofy.com

NIXOFY — Tax ID PT217375251 | suporte@nixofy.com | www.nixofy.com