Privacy

The short version

This site sets no analytics cookies and no advertising cookies. It does not track you. The typefaces are served from this domain, so your browser does not contact Google to read this page.

The only third-party content anywhere on the site is a Google map on the contact page, and it loads only if you ask it to.

Who is responsible

Cathia Carine Pontes, Rua Luís de Camões 12, 6000-621 Retaxo, Portugal, tax number 244156450. Write to ithos@outlook.pt about anything on this page.

What we hold, and why

When you order. Your name, address, email, telephone and what you bought. We need it to make the thing, send it, and issue an invoice. The legal basis is the contract between us, and tax law for the invoice.

What you type into an engraving. A name, a date, a phrase. We keep it as part of the order, because it is what we made.

When you write to us. Whatever is in your message, for as long as it takes to answer and a reasonable time afterwards.

If you withdraw using the form on the site. Your name, the order number, the email address you enter (it may not be the one you ordered with) and, if you give them, the items. We use them to deal with your withdrawal and to send you the acknowledgement of receipt, and we keep them for 3 years from the last withdrawal made for that order, as proof of when you sent us the withdrawal. The legal basis is the contract between us and the legal obligation to acknowledge receipt; keeping them afterwards is the legitimate interest, yours and ours, in being able to prove that date.

Your IBAN, but only if we owe you money on a payment that has no way back. A Multibanco reference cannot be reversed, so if you cancel an order paid that way we ask you for an IBAN to transfer the refund. We use it for that transfer and nothing else, and it is kept with the invoice for as long as tax law requires.

Your basket. While you are choosing, it lives in your own browser and we never see it. It reaches us the moment you press Order and pay: we save the order — your name, address, telephone, tax number and what you chose — before we ask for the payment, because a payment that arrives with nothing to attach it to is a payment nobody can fulfil. Paid or not, that order is deleted after ninety days; after that, what remains is the invoice, if you paid, and what the next paragraph describes.

After you pay. For a consumer purchase, we keep the order number, your name, your email, the names of the items, the date and time of payment and the language of the order for 18 months, so that the withdrawal function on the site works for the whole period in which you can withdraw, even if the piece takes a while to be made and to reach you. The legal basis is the legal obligation to keep that function available and the contract between us.

If you are a reseller. Your company name, NIF, registered address and the email addresses you gave us, so that you can sign in to see your prices and so that your invoices carry the right details. The legal basis is the contract between us. When you sign in, your browser keeps a signed session for the tab you are in, and on the device only if you tick "keep me signed in"; nothing is kept if you never sign in. When you stop being a reseller we delete the record; invoices are kept for as long as tax law requires.

Who else sees it

• ifthenpay, to take the payment: your name, your email and the

amount. We never see your bank or card details. If you pay by MB WAY, your telephone number goes to them too, because that is how the request reaches your phone.

• MRW, to deliver the parcel: your name, address and telephone.
• Resend, to deliver our emails to you: the confirmation carries your name,

what you ordered and the address it is going to, so Resend handles all of it on the way. Their servers for this domain are in Ireland.

• Cloudflare, which runs the checkout and holds the order from the moment

you press Order and pay until it is deleted, what remains of it for withdrawals, the withdrawals made on the site and the records of our resellers. They are also who our shop emails leave through, and they serve these pages to your browser, so they see the request, including your IP address. Cloudflare may process this data outside the European Union, under the European Commission's standard contractual clauses.

• Our accountant, and the tax authority, for invoices.

Nobody else. Your details are not sold, and not used to advertise at you.

How long

Invoices are kept ten years, because tax law requires it. Orders, paid or not, are deleted from the shop's system after ninety days — long enough for a Multibanco reference to be paid late and for us to answer a question about it. Of an order paid by a consumer, the number, the name, the email, the names of the items, the date and time of payment and the language remain for 18 months, for the withdrawal function. A withdrawal made on the site is kept for 3 years from the last withdrawal made for that order. Emails are kept for as long as they are useful and then deleted.

What you can ask for

Access, correction, erasure, restriction, portability, and to object. Write to ithos@outlook.pt and we will answer within a month.

If you think we have handled your data badly, you can complain to the Portuguese data protection authority, the CNPD — cnpd.pt.