Privacy Policy.

1. Personal data collected

"Personal data" means any information that can identify a person, directly or indirectly. Malumi may collect:

• Identification data: name, address, phone number and email.
• Billing data: name, tax ID (NIF), billing address and payment details.
• Browsing data: IP address, device type, browser and interactions on the website.
• Communication data: records of contacts made via email or forms.

This data is collected when you visit the website, fill out a contact form, make a purchase, or contact us by email or social media.

2. Purpose and legal basis

• Contract execution: processing orders, issuing invoices and delivering products.
• Compliance with legal obligations: accounting and responding to regulatory authorities.
• Communication: responding to contact requests and, with your consent, sending updates.
• Improving the website: aggregated statistical analysis of browsing.

3. Data sharing

Malumi does not sell or trade personal data. Data may only be shared with:

• Service providers that support payment processing, website hosting and order shipping.
• Legal authorities, when required by law.

If data needs to be transferred outside the European Economic Area, Malumi ensures the transfer complies with legally required safeguards, namely Standard Contractual Clauses approved by the European Commission.

4. Your rights

• Right of access: request a copy of stored data.
• Right to rectification: correct incorrect or outdated information.
• Right to erasure: request deletion of your data, unless legally required to retain it.
• Right to data portability: receive your data in a structured format.
• Right to object: contest the use of your data for certain purposes.
• Right to restriction of processing: temporarily restrict the use of your data.

You can exercise these rights by emailing studio@malumi.pt. If unsatisfied with our response, you may file a complaint with the Portuguese Data Protection Authority (CNPD), at www.cnpd.pt.

5. Data retention

• Billing data: 10 years, per tax law.
• Marketing data: until you withdraw consent.
• Contact records: 2 years after the last interaction.

You may request deletion of your data at any time, except where retention is legally required.

6. Security

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, alteration or destruction, including encryption of sensitive data and restricted access control.