Trapito de La Boquita

Privacy policy

Last updated: 30 September 2026

This explains what personal data we collect when you create an account and place orders at Trapito de La Boquita, what we use it for and what rights you have, under the General Data Protection Regulation (GDPR) and Portuguese law.

The controller of your personal data is Trapito de La Boquita, identified below. For any question about your data, use the contact email given.

Name or company
Trapito de La Boquita
VAT number (NIF)
...
Address
...
Contact email
...

When you create an account: name, mobile number, email, password (stored encrypted), preferred language and the date you accepted the terms.

When you place an order: delivery address, postcode, town or city, contact mobile number, any notes you write, the items ordered, the amount and the status of the order and of the payment.

We do not collect card or bank account details: payment is made by MB WAY, outside our website.

To process and deliver your orders, confirm payments and contact you about the order: performance of a contract (Art. 6(1)(b) GDPR).

To manage your account and send account confirmation, password recovery and order status emails: performance of a contract.

To meet tax and accounting obligations: legal obligation (point (c)).

To keep the service secure and prevent fraud: legitimate interest (point (f)).

We do not use your data for advertising or for automated decision-making.

We use service providers that process data on our behalf, only for the purposes above: Supabase (database and authentication), Vercel (website hosting) and Resend (sending emails).

We do not sell your data or pass it to third parties for marketing. We may disclose it to authorities where the law requires.

Some providers may process data outside the European Economic Area. When they do, we require appropriate safeguards, such as the standard contractual clauses approved by the European Commission.

Account data is kept while the account exists. You can delete it at any time on the “My orders” page.

Order data is kept for the period the law requires for accounting and tax records. When you delete your account, orders are anonymised: we remove the address, phone number and notes and the link to you.

Unpaid orders are cancelled when you delete the account.

You have the right of access, rectification, erasure, restriction of processing, portability and objection. You can delete your account on the “My orders” page. To exercise the other rights, contact us at the email given above.

You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD, www.cnpd.pt) or with the supervisory authority of your country of residence in the European Union.

We only use what is essential for the site to work: session cookies that keep you signed in after you log in, a preference stored in your browser (day or night theme) and the contents of your cart. We do not use advertising, analytics or tracking cookies, so we do not ask for cookie consent.

You can clear this data at any time in your browser settings. If you clear the session cookies, you will need to sign in again.

We use secure connections (HTTPS), encrypted passwords and access rules that only let each customer see their own orders. No system is infallible: if a data breach affects you, we will inform the authorities and, where required, you.

We may update this policy. The date of the last update is at the top of this page; where changes are significant, we will let you know on the site.

General protective text, to be reviewed by a qualified person.