Controller and contact
David Mateus, Individual entrepreneur (empresário em nome individual), at Praceta Francisco Ramos da Costa, n.º 13, 1.º D, 2725-579 Mercês, Portugal, is the data controller. Privacy requests can be sent to support@originalpatches.com or by post to the business address.
Data we collect
- Identity and contact data: name, email, telephone number, billing and delivery address.
- Account and authentication data: account identifier, confirmation status, login, and security records.
- Order data: products and selected options, amounts, taxes, delivery, status, refunds, and support history.
- Payment references: Stripe processes payment-card details; we receive identifiers, payment status, and limited metadata, not full card numbers.
- Technical and consented analytics data: session identifier, pages, landing page, referrer, approximate location, device/browser information, and interaction events.
- Communication preferences, newsletter subscriptions, checkout-recovery consent, and messages sent to us.
Purposes and legal bases
- Contract: accounts, checkout, payment, delivery, returns, refunds, transactional emails, and customer service.
- Legal obligation: tax, accounting, consumer protection, product safety, and regulatory records.
- Legitimate interests: store security, fraud and abuse prevention, service administration, login alerts, and defence of legal claims, after balancing those interests against your rights.
- Consent: optional analytics, marketing communications, and abandoned-checkout reminders where requested. Consent can be withdrawn at any time.
Recipients and processors
We use Supabase for database, storage, and authentication; Stripe for payments and fraud prevention; Vercel for hosting and content delivery; Resend for transactional and consented email; and PostHog, Google Analytics, Google Ads, and Meta Pixel for analytics and advertising measurement after consent. Data is also shared as necessary with delivery providers, professional advisers, competent authorities, or a business successor. We do not sell personal data.
International transfers
Some providers may process data outside the EEA. Where GDPR applies, transfers rely on an adequacy decision, approved safeguards such as Standard Contractual Clauses, or another lawful mechanism. Information about relevant safeguards can be requested using the contact above.
Retention
We retain information only as long as needed for its purpose and applicable Portuguese tax, accounting, consumer-protection, product-safety, fraud-prevention, and limitation-period obligations. Account data remains while the account is active and is then deleted or anonymised unless retention is required. Marketing data remains until consent is withdrawn or the address becomes invalid. Security, support, consent, and analytics records are periodically reviewed and deleted or anonymised when no longer necessary.
Your rights
Subject to applicable conditions, you may request access, correction, deletion, restriction, or portability; object to legitimate-interest processing or direct marketing; and withdraw consent without affecting prior lawful processing. We may verify identity and must retain records where the law requires it. Send requests to support@originalpatches.com.
Complaints
You may complain to Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or another competent EEA supervisory authority.
Automated decisions and children
Stripe or other security providers may perform automated fraud-risk analysis. We do not independently make solely automated decisions producing legal or similarly significant effects. The store is not directed to children who cannot lawfully consent or contract in their jurisdiction.
Changes
We will publish updates here, change the revision date, and provide additional notice when a material change legally requires it.