Privacy policy

PRIVACY POLICY

Last updated: August 13, 2026

At CeNa Personalized Creations, we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, place an order, contact us or otherwise interact with our online store.

Our processing of personal data is carried out in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and other applicable data protection legislation.

1. WHO WE ARE

The data controller responsible for your personal data is:

CeNa Personalized Creations
Sole proprietorship operated by Nathalia Costa das Neves

Business Address:
Rua da Corujeira, 474
4300-150 Porto
Portugal

NIF: 315 020 199

Email: nathalia_costa_neves@hotmail.com
Phone: +351 936 214 366

For privacy-related questions or requests concerning your personal data, you can contact us using the information above.

2. WHAT PERSONAL DATA WE COLLECT

Depending on how you interact with our store, we may collect the following categories of personal information:

Contact information

  • Full name;
  • Email address;
  • Telephone number;
  • Billing address;
  • Shipping address.

Order information

When you place an order, we may process information such as:

  • Products purchased;
  • Order number;
  • Order date;
  • Product personalization details;
  • Delivery information;
  • Order status;
  • Communication relating to your order.

Personalization information

Because CeNa Personalized Creations sells customized products, you may provide information necessary to personalize your order, such as:

  • Names;
  • Dates;
  • Ages;
  • Short phrases;
  • Design preferences;
  • Images or artwork supplied by you.

Please do not provide sensitive personal information unless it is strictly necessary for your request.

Payment information

Payments are processed through third-party payment providers.

We do not normally have access to or store your complete payment card details.

Payment providers may process information necessary to authorize and complete your payment in accordance with their own privacy policies.

Technical and usage information

When you visit our website, certain technical information may be automatically collected, such as:

  • IP address;
  • Browser type;
  • Device type;
  • Operating system;
  • Pages visited;
  • Approximate location derived from technical information;
  • Date and time of visits;
  • Website interaction information.

The exact information collected may depend on the Shopify features, applications, analytics and cookies enabled on our store.

3. HOW WE USE YOUR PERSONAL DATA

We use personal data only where there is a lawful basis for doing so.

Your information may be used to:

  • Process and fulfil your orders;
  • Create personalized products;
  • Process payments;
  • Arrange delivery through CTT;
  • Communicate with you about your order;
  • Respond to customer service requests;
  • Handle refunds, complaints and product issues;
  • Maintain records required by law;
  • Prevent fraud and protect our store;
  • Improve our website, products and services;
  • Maintain the security of our website;
  • Send marketing communications where you have provided the required consent;
  • Comply with legal and regulatory obligations.

4. LEGAL BASES FOR PROCESSING

Depending on the circumstances, we process your personal data based on one or more of the following legal bases under the GDPR:

Performance of a contract

We process information necessary to accept, process and fulfil your order.

This includes your contact information, delivery address, order information and personalization details.

Legal obligations

We may process and retain certain information where required by applicable tax, accounting, consumer protection or other legal requirements.

Legitimate interests

We may process certain information where necessary for legitimate business purposes, such as:

  • Protecting our website and systems;
  • Preventing fraud;
  • Responding to customer enquiries;
  • Managing and improving our business;
  • Defending or exercising legal claims.

We will only rely on legitimate interests where those interests are not overridden by your fundamental rights and freedoms.

Consent

Where consent is required, such as for certain marketing communications or non-essential cookies, we will request your consent before carrying out the relevant processing.

You may withdraw consent at any time.

Consent must be freely given, specific, informed and unambiguous under the GDPR.

5. PERSONALIZED PRODUCTS

Some of our products require information supplied by the customer to create the requested personalization.

This may include names, dates, phrases, photographs, artwork or other design information.

We use this information only as necessary to produce and fulfil your personalized order and provide customer support.

If you provide an image, logo, artwork or other material for personalization, you are responsible for ensuring that you have the necessary rights or permissions to use that material.

We do not use customer-provided personalization materials for unrelated purposes without an appropriate legal basis or permission.

6. SHARING YOUR PERSONAL DATA

We do not sell your personal data.

We may share personal information with trusted third parties where necessary to operate our business and fulfil your order.

These may include:

Shopify

Our online store is operated using Shopify.

Shopify provides the e-commerce infrastructure necessary to operate our website, process orders and provide related services.

Payment providers

Payment information may be processed by the payment provider selected during checkout.

CTT – Correios de Portugal

We may provide CTT with the information necessary to deliver your order, including your name, delivery address and relevant shipment information.

Service providers

Depending on the services enabled on our store, we may use third-party providers for services such as:

  • Website functionality;
  • Analytics;
  • Email communication;
  • Fraud prevention;
  • Customer support;
  • Marketing;
  • Technical services.

These providers may process personal data only as necessary to provide their services and subject to applicable data protection requirements.

7. INTERNATIONAL DATA TRANSFERS

Some of our service providers, including Shopify and other technology providers, may process personal data in countries outside the European Economic Area.

Where personal data is transferred outside the EEA, appropriate safeguards required by applicable data protection law will be used where necessary.

Depending on the circumstances, these safeguards may include an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism.

8. HOW LONG WE KEEP YOUR DATA

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Different information may be retained for different periods.

For example:

  • Order and transaction information may need to be retained for accounting, tax, legal and consumer protection purposes.
  • Customer service communications may be retained for as long as reasonably necessary to handle the enquiry and protect our legitimate interests.
  • Marketing information may be retained until you withdraw your consent or otherwise object to the relevant processing.
  • Personalization information may be retained for as long as reasonably necessary to fulfil the order, provide customer support and comply with legal obligations.

When personal data is no longer required, it will be deleted or anonymized where reasonably possible.

9. YOUR RIGHTS UNDER THE GDPR

Depending on the circumstances and applicable legal requirements, you have rights concerning your personal data, including:

Right of access

You may request confirmation as to whether we process your personal data and request a copy of the information we hold about you.

Right to rectification

You may request correction of inaccurate or incomplete personal data.

Right to erasure

You may request deletion of your personal data in circumstances where the GDPR gives you this right.

Right to restriction

You may request restriction of processing in certain circumstances.

Right to object

You may object to certain processing based on legitimate interests and may object to direct marketing.

Right to data portability

Where applicable, you may request your personal data in a structured, commonly used and machine-readable format and request its transmission to another controller.

Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The GDPR provides these rights subject to certain conditions and exceptions.

10. HOW TO EXERCISE YOUR RIGHTS

To exercise your privacy rights, please contact us:

Email:
nathalia_costa_neves@hotmail.com

Subject: GDPR Data Request

Please describe your request clearly and provide enough information for us to identify the relevant personal data.

We may need to verify your identity before fulfilling certain requests in order to protect your personal information.

We will normally respond to valid requests without undue delay and, in principle, within one month, subject to the conditions and extensions permitted by the GDPR.

11. MARKETING COMMUNICATIONS

We may send promotional emails or other marketing communications where we have a lawful basis to do so.

Where consent is required, we will only send marketing communications after obtaining the appropriate consent.

You may unsubscribe from marketing communications at any time by using the unsubscribe option included in the communication or by contacting us directly.

Withdrawing marketing consent does not affect your ability to purchase from our store or receive essential communications relating to your orders.

12. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and similar technologies to:

  • Keep the website functioning;
  • Maintain shopping cart functionality;
  • Remember certain preferences;
  • Improve website performance;
  • Understand how visitors use our website;
  • Provide analytics;
  • Support marketing or advertising features where enabled.

Some cookies are necessary for the operation and security of the website, while others may require your consent depending on their purpose and applicable law.

Where consent is required, non-essential cookies should only be activated after the appropriate consent has been obtained.

You can manage your cookie preferences through the cookie settings available on our website.

The Portuguese data protection authority, CNPD, notes that website operators are responsible for ensuring compliance with applicable requirements concerning cookies, including information and consent where required.

13. SHOPIFY AND THIRD-PARTY SERVICES

Our online store is hosted and operated using Shopify.

Shopify and other service providers may process personal data as necessary to provide their respective services.

The use of third-party services may change over time as we add, remove or update functionality on our website.

Where appropriate, these providers act as processors or independent controllers depending on the nature of the processing.

We recommend that customers also review the privacy information provided by relevant third-party services.

14. DATA SECURITY

We take reasonable technical and organizational measures to protect personal data against:

  • Unauthorized access;
  • Accidental loss;
  • Destruction;
  • Alteration;
  • Unauthorized disclosure; and
  • Other unlawful processing.

However, no method of transmitting or storing information online can be guaranteed to be completely secure.

The GDPR requires appropriate security measures taking into account the risks associated with the processing.

15. CHILDREN'S PRIVACY

Our website is not specifically directed at children.

We do not knowingly collect personal data from children where such collection is not permitted by applicable law.

If you believe that a child has provided personal information to us improperly, please contact us so that we can assess and, where appropriate, delete the information.

16. DATA BREACHES

If we become aware of a personal data breach that requires notification under applicable data protection law, we will take the appropriate steps required by the GDPR and applicable Portuguese law.

This may include notifying the competent supervisory authority and, where legally required, affected individuals.

17. SUPERVISORY AUTHORITY

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent data protection supervisory authority.

In Portugal, the supervisory authority is:

Comissão Nacional de Proteção de Dados (CNPD)

Website: CNPD – Comissão Nacional de Proteção de Dados

You may contact the CNPD if you believe your data protection rights have been infringed. The GDPR expressly provides individuals with the right to lodge a complaint with a supervisory authority.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our business, website, services, technology or applicable legal requirements.

The latest version will always be made available on this page.

The "Last updated" date at the top of this Privacy Policy indicates when it was most recently revised.

19. CONTACT US

If you have any questions about this Privacy Policy or the way we process your personal data, please contact us:

CeNa Personalized Creations
Rua da Corujeira, 474
4300-150 Porto
Portugal

NIF: 315 020 199
Email: nathalia_costa_neves@hotmail.com
Phone: +351 936 214 366