Your rights (GDPR)

The General Data Protection Regulation (EU 2016/679, GDPR) and the Law no. 58/2019 of 8 August grant you rights over your personal data. This page summarises them and explains how to exercise them. The full details of the processing (categories, purposes, retention, processors) are described in our Privacy Policy.

Available rights

Access

Know what data we hold about you and how we use it. You may request a copy.

Rectification

Correct inaccurate or incomplete data. You can do it directly at /profile.

Erasure ("right to be forgotten")

Request deletion of your data when it is no longer needed. Exception: a legal obligation to keep invoicing data for 10 years (art. 123 CIRC and art. 52 CIVA).

Restriction

Ask us to stop processing your data (we keep it stored, but unused).

Portability

Receive your data in a structured, machine-readable format (JSON) to transfer it.

Objection

Object to processing based on legitimate interest or direct marketing.

Withdraw consent

For processing based on consent (e.g. marketing), at any time, without affecting the lawfulness of prior processing. Toggle available at /profile.

Complaint to the CNPD

You can lodge a complaint with the Portuguese Data Protection Authority (CNPD), the competent supervisory authority in Portugal.

How to make a request

Email to privacidade@sushico.pt with:

• Name and the email linked to the account;
• The right you wish to exercise;

If we have reasonable doubts about the identity of the person making the request, we may ask for the additional information strictly necessary to confirm it (Article 12(6) GDPR). That information is used only for this verification and deleted as soon as the request has been handled.

Alternatively, you can use the shops' operational email addresses: braga@sushico.pt (Braga shop) or porto@sushico.pt (Porto shop).

Response time

We reply without undue delay and, in any case, within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months; in that case we inform you of the extension and the reasons for it within the first month (Article 12(3) GDPR).

Data controller

Personal data is processed, independently, by the selling entity matching the shop chosen by the Customer: POMPA E SUCESSO, LDA. (Braga, NIPC 514 083 050) or VANILLAFRIENDS, LDA. (Porto, NIPC 514 797 754). Full details in the Privacy Policy.