Privacy policy

1. Data controller

Embalo.

Privacy contact: orders@embalo.eu · WhatsApp +351 926 235 152.

2. What data we process and why

When you request a quote or contact us (configurator, email or WhatsApp), we process your name, company, email, phone number, country, website or Instagram, notes and bag design, including the logo, to respond to your request, prepare the quote and digital proof and, if you go ahead, produce, deliver and invoice the order.

When you visit the site, the host (Vercel) processes technical data, such as your IP address, to display the pages and to limit the number of requests sent from the same address, to prevent form abuse.

3. Legal basis

• Pre-contractual steps at your request and performance of a contract (Article 6(1)(b) GDPR).
• When you contact us on behalf of a company, our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR).
• Invoicing: compliance with legal obligations (Article 6(1)(c) GDPR).
• Site security and abuse prevention: our legitimate interest (Article 6(1)(f) GDPR).

Without this data we cannot respond to your request. We do not make automated decisions or carry out profiling.

4. Who we share data with

To handle your request we use:

• Vercel Inc.: website hosting (USA);
• OVH SAS: Embalo domains and mailboxes (France, EU);
• Plus Five Five, Inc., which operates the Resend service: sending request emails (USA);
• Google LLC: receiving and internally logging requests and design images (Gmail, Google Sheets and Google Drive, USA);
• WhatsApp Ireland Ltd.: if you contact us via WhatsApp, WhatsApp's terms and privacy policy also apply;
• carriers and our certified accountant, as far as necessary.

The manufacturer, located outside the European Union, receives only the bag artwork and specifications, without your contact details. We do not sell data to third parties.

5. Transfers outside the European Union

Some of these providers are based in the USA and are certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). For providers that are not certified, the transfer is based on the standard contractual clauses approved by the European Commission. You can ask us for more information about these safeguards.

6. How long we keep data

• Requests that don't go ahead: up to 24 months.
• Orders and invoices: 10 years, as required by tax law.

7. Your rights

You can request access to your data, rectification, erasure, restriction of processing and portability, or object to processing, via the email or WhatsApp given above. You also have the right to lodge a complaint with the CNPD, the Portuguese data protection authority (www.cnpd.pt), or, in Spain, with the AEPD, the Spanish data protection authority (www.aepd.es), or with the data protection authority of your country.

8. In your browser

The configurator saves the bag design (without the logo and without the notes) in your browser's local storage for 7 days, just so you don't lose your work. Nothing is sent until you create the request, and you can delete it with the "Start over" button in the configurator. We do not use advertising or analytics cookies.

On the site's test addresses, a technical cookie stores the chosen language.

9. Who this site is for

This site is intended for businesses and professionals.