Privacy Policy

This Privacy Policy describes how Sushi & Co. collects, uses, retains and protects the personal data of users of the website www.sushico.pt and of customers placing orders, in accordance with the Regulation (EU) 2016/679, the GDPR and the Law no. 58/2019 of 8 August.

1. Data controller

Personal data is processed, independently, by the selling entity matching the shop chosen by the Customer:

	Braga shop	Porto shop
Company name	POMPA E SUCESSO, LDA.	VANILLAFRIENDS, LDA.
NIPC	514 083 050	514 797 754
Registered office	Av. Alfredo Barros, n.º 72, 4715-350 Braga	Rua do Campo Alegre, n.º 1578, R/C Frente, 4150-176 Porto
Email	braga@sushico.pt	porto@sushico.pt

To exercise your rights or for privacy questions, you can contact any of the addresses/emails above or the general email privacidade@sushico.pt.

2. Categories of data collected

We collect only the data strictly necessary to provide the service:

• Identification data: name, VAT ID (if requested for an invoice);
• Contact details: email, phone, delivery address;
• Order data: products ordered, time, notes;
• Payment data: processed directly by IFTHENPAY, Lda.: we do not store card data;
• Browsing data: IP address, device type, pages visited, cookies (see Cookie Policy);
• Communications: email messages, phone calls (not recorded) or support requests.

3. Purposes and legal basis of processing

Purpose	Legal basis (art. 6 GDPR)
Order processing and delivery	Performance of a contract (point b)
Invoicing and compliance with tax obligations	Legal obligation (point c)
Customer support and complaint handling	Performance of a contract + legitimate interest (point f)
Fraud prevention and security	Legitimate interest (point f)
Direct marketing communications	Explicit consent (point a), always optional
Aggregated statistical analysis (analytics cookies)	Consent (point a)

4. Retention periods

• Billing and tax data: 10 years (art. 123 CIRC and art. 52 CIVA);
• Order data (non-tax): up to 5 years after the last interaction;
• Direct marketing data: until consent is withdrawn;
• Cookies: depending on the type (see Cookie Policy).

Once these periods end, data is deleted or anonymised.

5. Processors and recipients

To provide the service, we share data with processors acting on our behalf, under contract and with appropriate safeguards:

• IFTHENPAY, Lda. (NIPC 510450024): payment processing;
• Vendus / Moloni (depending on the active operator): issuing electronic invoices and reporting to the Tax Authority (SAF-T PT);
• Delivery companies (couriers): where applicable, only the strictly necessary data (name, address, contact);
• Hosting and email provider of the website;
• Google Analytics : with anonymised IP, subject to consent (see Cookies).

We do not sell or hand over personal data to third parties for commercial purposes unrelated to the service. Data may be disclosed to public authorities in strict compliance with a legal obligation.

6. International transfers

Data is processed within the European Economic Area. If transfers outside the EEA occur (notably Google Analytics), the European Commission's standard contractual clauses or another legal basis permitted by the GDPR apply.

7. Data subject rights

The Customer may exercise the following rights at any time:

• Access : know what data we hold;
• Rectification : correct inaccurate data;
• Erasure ("right to be forgotten"), subject to legal limits (e.g. invoicing);
• Restriction of processing;
• Portability : receive your data in a structured format;
• Objection to processing based on legitimate interest;
• Withdrawal of consent : at any time, without affecting the lawfulness of prior processing;
• Complaint with the Portuguese Data Protection Authority (CNPD).

Requests can be sent by email to privacidade@sushico.pt and are answered without undue delay and, in any case, within one month, extendable by a further two months where necessary (with notice to you within the first month). See details on the page Your rights (GDPR).

8. Security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or improper disclosure, including:

• Encrypted communications (HTTPS/TLS);
• Encrypted passwords (bcrypt), never in plain text;
• Credential-restricted access to internal systems;
• Backups and recovery procedures;
• Periodic risk assessment.

9. Minors

The service is not aimed at children under 16. We do not knowingly collect data from minors without the consent of those holding parental responsibility.

10. Changes

This Policy may be updated. The version in force is the one published on the website. Whenever changes are material, prominent notice will be given on the website and/or by email.