Privacy Policy

Last updated: September 22, 2026

1. Who is responsible for your data

The entity responsible for processing the personal data collected through the website www.finebeauty.pt is APRUMADO NENÚFAR, LDA. (fïne), with its headquarters at Edifício Diogo Cão, Doca de Alcântara Norte, 1350-352 Lisbon, Portugal, NIPC 519 112 091.

If you have any questions about privacy or wish to exercise your rights, please contact us at info@finebeauty.pt. fïne has not appointed a data protection officer, as it is not legally required to do so.

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Law No. 58/2019, dated August 8.

2. What Data We Collect

• Identification and contact information: name, email, phone number, shipping address, and billing address.
• Tax information: taxpayer ID number, if you request an invoice with a taxpayer ID.
• Orders: purchased products, amounts, order history, returns, and communications regarding each order.
• Payment: payment method and status. Full card details are processed directly by the payment providers; fïne does not have access to them.
• Customer account: login information and preferences.
• Communications: messages exchanged with customer support via email or social media, and complaints.
• Reviews and content: product reviews, photos you share with us, and social media posts that you authorize us to use.
• Marketing: newsletter subscriptions and interaction with our emails (e.g., opens and clicks).
• Browsing: IP address, device and browser type, pages visited, and interactions on the website, collected through cookies and similar technologies.

We do not request health information. If you report an adverse reaction to a product, we will use the information you provide solely to respond to your inquiry and to comply with our legal obligations regarding cosmetovigilance.

3. What we use the data for, on what legal basis, and for how long

Purpose	Legal Basis	Retention period
Process orders, payments, deliveries, returns, and warranties	Performance of the contract (Article 6(1)(b) of the GDPR)	Until the end of the warranty period (3 years after delivery)
Invoicing and Compliance with Tax and Accounting Obligations	Legal obligation (Article 6(1)(c) of the GDPR)	10 years, in accordance with tax law
Manage the customer account	Performance of the Contract	To the point of requesting that the account be deleted
Customer Support and Complaint Management	Contract performance, legal obligation, and legitimate interest	3 years after the case was closed
Send newsletters and marketing communications to subscribers	Consent (Article 6(1)(a) of the GDPR)	Until consent is withdrawn
Send customers emails about products similar to the ones they purchased	Legitimate interest, pursuant to Article 13-A, paragraph 3, of Law No. 41/2004—may be invoked in each email	Until you opt out or 2 years after your last purchase
Post reviews and use customer-generated content	Consent	As long as the content remains published or until you withdraw your consent
Website statistics and personalized advertising (non-essential cookies)	Consent	View Cookie Policy
Website Security and Fraud Prevention	Legitimate interest	1 year
Reporting and Monitoring of Adverse Reactions (Cosmetovigilance)	Legal obligation (Regulation (EC) No. 1223/2009) and Article 9(2)(i) of the GDPR	10 years after the last batch of the product was released to the market
Defense of rights in judicial or extrajudicial proceedings	Legitimate interest	Until the end of the applicable statute of limitations

Once the retention period has expired, the data is deleted or anonymized.

4. Who We Share Data With

We do not sell your data. We share it only with entities that provide us with services necessary for the operation of the store, which act in accordance with our instructions and are required to protect the data (subcontractors), or when required by law:

• Online store platform: Shopify.
• Payments: ifthenpay, which processes payments via Multibanco and MB WAY on the web checkout.
• Logistics: Esfera Sossegada, Lda. (Smartlo), which stores, prepares, and ships orders and manages returns.
• Shipping Carriers: Depending on the destination, CTT, Nacex, UPS, FedEx, Spring, or Torrestir.
• Billing: Moloni, a certified billing software.
• Email marketing: Klaviyo.
• Website translation: Weglot.
• Statistics and advertising (only with consent): Google (Google Analytics), Meta (Instagram and Facebook), and TikTok.
• Accounting: our certified public accountant.
• Authorities: Tax Authority, courts, ASAE, INFARMED, or other public entities, when required by law.

5. Transfers Outside the European Economic Area

Some of our service providers are based in or process data outside the European Economic Area (for example, in the United States). In such cases, we only transfer data when appropriate safeguards are in place, specifically an adequacy decision by the European Commission (such as the EU-U.S. Data Privacy Framework, for certified companies) or standard contractual clauses approved by the European Commission. You can request more information at info@finebeauty.pt.

6. Your Rights

Under the GDPR, you have the right to:

• access your data and obtain a copy;
• correct incorrect or incomplete data;
• request the erasure of your data, unless we are legally required to retain it;
• request the restriction of processing;
• receive the data you have provided to us in a structured format and transmit it to another entity (data portability);
• to object to processing based on legitimate interests and, at any time, to processing for marketing purposes;
• withdraw consent at any time, without affecting the lawfulness of the processing carried out up to that date;
• not to be subject to decisions made solely on the basis of automated processing (aïne does not make decisions of this kind).

To exercise these rights, please contact info@finebeauty.pt. There is no charge for exercising these rights. We will respond within one month, which may be extended by an additional two months for complex requests; we will notify you if this occurs. We may ask for additional information to verify your identity.

To stop receiving marketing emails, simply click “unsubscribe” at the bottom of any email.

You also have the right to file a complaint with the National Data Protection Commission (CNPD) at www.cnpd.pt, or with the supervisory authority in the country where you reside.

7. Safety

We implement appropriate technical and organizational measures to protect data against loss, unauthorized access, or disclosure, including encrypted connections (HTTPS) throughout the website and restricting access to data to those who need it.

8. Minors

This website is not intended for children under 13, and we do not intentionally collect their data for purposes that require consent. Purchases by individuals under 18 must be made with the authorization of a parent or guardian.

9. Social Media

When you interact with fïne on Instagram, TikTok, or other social media platforms, those platforms’ privacy policies also apply. In the statistics for our pages on these platforms, fïne and the platform may be jointly responsible for data processing.

10. Changes

We may update this policy. The current version is always available on our website, along with the date of the last update. If the changes are significant, we will notify registered customers by email.