Privacy policy

1. Data controller

Tropical Orchids Portugal, Lda., company number 515350028, registered office at Av. 23 de Julho de 1833, Lt. 19, 2865-759 Fernão Ferro, Portugal. For any question about your data, write to info@tropicalorchidsportugal.com.

2. What data we collect

• Identity and contact details: name, email, phone, billing and delivery address, tax number (if you provide it for the invoice).
• Orders: products bought, amounts, chosen payment method, payment and delivery status. Card details are handled directly by the payment providers; we do not receive or store them.
• Customer account: login details (your password is stored encrypted), order history, wishlist and rewards club points.
• Communications: messages you send us by email, form, phone or WhatsApp.
• Reviews: the name you choose and the content of the review.
• Browsing: IP address, device and browser type, pages visited and data collected through cookies, according to your choices (see the Cookie policy).

3. Why we use your data and on what legal basis

• Processing and delivering orders, managing your account, the rewards club, returns and guarantees – performance of a contract (Art. 6(1)(b) GDPR).
• Issuing invoices and meeting tax and accounting obligations – legal obligation (Art. 6(1)(c)).
• Answering requests and providing customer support – pre-contractual steps, performance of a contract or our legitimate interest in replying (Art. 6(1)(b) and (f)).
• Sending the newsletter and marketing communications – consent (Art. 6(1)(a)), which you can withdraw at any time using the link in every email. We may send customers information about products similar to those they bought, with the option to opt out in every message, under Article 13-A of Portuguese Law 41/2004.
• Requesting and publishing product reviews – legitimate interest in gathering customer feedback; you can opt out at any time.
• Statistics and personalised advertising through cookies – consent (Art. 6(1)(a)).
• Website security, fraud prevention and defending legal claims – legitimate interest (Art. 6(1)(f)) and legal obligation.

4. Who we share your data with

We only share data with companies that provide services we need to run the shop, under contracts that require them to protect the data and use it only on our instructions, or where the law requires it:

• Website hosting: Hostinger.
• Payments: Stripe, PayPal and easypay.
• Delivery: MRW (name, address, phone and email for delivery).
• Invoicing: Moloni.
• Email marketing: Mailchimp (Intuit), only if you subscribe to the newsletter.
• Statistics and advertising: Google (Analytics, Ads and Merchant Center), Microsoft (Clarity) and Meta (Facebook and Instagram), only with your consent.
• Messaging: WhatsApp (Meta), if you choose to contact us that way.
• Accountants, legal advisers and public authorities (such as the Portuguese Tax Authority), where necessary or required by law.

We do not sell your personal data.

5. Transfers outside the European Economic Area

Some providers (such as Google, Meta, Stripe, PayPal and Mailchimp) may process data in the United States or other countries outside the EEA. In these cases, transfers rely on a European Commission adequacy decision (such as the EU-US Data Privacy Framework, for certified companies) or on standard contractual clauses approved by the Commission, with additional safeguards where needed.

6. How long we keep your data

• Orders and invoices: 10 years, as required by tax law.
• Customer account: while the account is active. You can ask us to delete it at any time, except for data the law requires us to keep.
• Newsletter: until you withdraw your consent.
• Support requests and complaints: up to 3 years after our reply, or for as long as any dispute lasts.
• Cookies: for the period stated in the Cookie policy.

7. Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interest and to direct marketing. Where processing is based on consent, you can withdraw it at any time, without affecting what was done before.

To exercise your rights, write to info@tropicalorchidsportugal.com. We reply within one month. We may ask for additional information to confirm your identity.

You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or with the supervisory authority of the EU country where you live.

8. Security

We use encrypted connections (HTTPS), restricted access to data, encrypted passwords and regular backups. Payments are processed in environments certified by the payment providers themselves.

9. Minors

The shop is intended for people aged 18 or over. We do not knowingly collect data from minors. If you become aware that a minor has given us data, please contact us so we can delete it.

10. Changes

We may update this policy to reflect changes in the law or in our services. The date of the latest update is shown at the top of this page.