Concept site: Orrin, Lda. is fictional, and the company details are placeholders (addresses and emails use the reserved .example domain). On a real site, every page is filled with the real business details and reviewed by a lawyer in the business's country.
Privacy Policy
Last updated: 17 October 2026
This policy explains what personal data Orrin, Lda. collects, why, how long we keep it and what you can ask us to do with it. We wrote it to be read, not to be skimmed past.
1. Who we are
Orrin, Lda., Rua Exemplo 10, 1100-000 Lisboa, Portugal ("we") is the controller of the personal data described here. Questions: privacy@orrin.example.
Our representative in the UK: Orrin UK Representative, 1 Example Road, London EC1A 1AA, United Kingdom (placeholder, UK GDPR Art. 27).
2. What we collect and why
We only collect what we need for the purposes below. We don't buy data about you and we don't sell or rent it to anyone.
| What | Data | Why | Legal basis (GDPR) |
|---|---|---|---|
| Order | name, email, delivery address, items, discount code | to sell and deliver your order | contract |
| Payment | handled only by our payment provider; we never see your full card number | to take payment | contract |
| Returns, guarantee and support | messages and order number | to handle returns, refunds, guarantee claims and questions | contract, legal obligation |
| Newsletter | email address, only if you subscribed | to send news and offers | consent |
| Privacy requests | name, email, request type, your message | to answer and document your request | legal obligation |
| Accounting | invoices | to keep records the law requires | legal obligation (kept 10 years in Portugal) |
Do you have to give it? You need to give us your contact and delivery details to buy; without them we can't take or deliver your order. Everything else is optional. We don't make decisions about you based solely on automated processing.
3. Who we share it with
Service providers that help us run the business, under written contracts that let them use the data only for our instructions: web hosting, our payment provider, shipping carriers, email delivery and accounting software. We may also share data when the law requires it, or to protect our rights in a dispute.
Payment providers and carriers also use some data for their own legal obligations (for example fraud prevention and customs), as independent controllers under their own privacy notices.
4. International transfers
Some providers may process data outside the EU/EEA or the UK. When they do, we use the European Commission's Standard Contractual Clauses (and the UK addendum) or an adequacy decision, such as the EU-US Data Privacy Framework for certified US companies.
5. How long we keep it
Order, guarantee and warranty records: for the legal guarantee and warranty period plus 3 years for possible claims. Invoices: as long as tax law requires (see the table). Newsletter: until you unsubscribe. Privacy requests: 3 years. Server logs: 30 days. Then we delete or anonymise it.
6. Your rights
Wherever you live, you can ask us to:
- See the data we hold about you and get a copy (access, portability).
- Correct it if it's wrong.
- Delete it ("right to be forgotten"), unless we must keep it by law.
- Stop or limit how we use it, or object to it.
- Withdraw consent at any time, for example by unsubscribing from emails with the link in every email.
We reply within one month (GDPR), or 45 days for California requests. It's free. If you're not happy with our answer, you can complain to the Portuguese data protection authority (CNPD), or the authority of your own country.
California residents (CCPA/CPRA): we don't sell or "share" personal information for cross-context advertising, and we don't use sensitive personal information to infer characteristics. You can make the same requests as above, and we won't treat you differently for using your rights. We honour the Global Privacy Control signal.
Israel: requests under the Protection of Privacy Law are handled the same way.
7. Children
This site is not for children under 16 and we don't knowingly collect their data. If you think a child gave us data, write to us and we will delete it.
8. Security
Encryption in transit (HTTPS), access only for staff who need it, and payment details handled only by a certified (PCI DSS) payment provider. If a breach puts your data at risk, we will tell you and the authority as the law requires.
9. Cookies
See our Cookie Policy. You can change your choice any time with Cookie settings.
10. Changes
If we change this policy in a way that matters, we'll say so on the site and, if you're a customer, by email, before the change applies.
11. Make a privacy request
Use this form, or write to privacy@orrin.example. We'll confirm it's you before we act, using the email address on your account or order.