Privacy Policy

The controller of the personal data processing is the company operating Terracotta Ceramic Cafe.

• Company name: Cumeada Em Flor - Lda
• Tax number: 519086031
• Registered address: Rua Estados Unidos da América, Edifício K8, Bloco D, 2º B, 9000-090 São Martinho, Funchal, Madeira, Portugal
• Physical venue: Terracotta Ceramic Cafe, Rua dos Netos 53, 9000-084 Funchal, Madeira, Portugal
• Website: https://terracotta-ceramic-cafe.pt
• General and privacy contact: terracottamadeira@gmail.com | +351 912 863 223
• As of the date of this policy, no Data Protection Officer has been formally appointed, as this is not currently considered legally mandatory in light of the nature and scale of the processing carried out.

Depending on the service used, we may collect and process the following categories of personal data:

• Identification and contact data: name, email address, phone number and, where relevant, the name of the purchaser, recipient or person responsible for the booking.
• Reservation and customer service data: date, time, number of guests, seating preferences, special requests, customer notes and data needed to manage table bookings, workshops, experiences, group bookings and events.
• Data relating to children's parties and family experiences: number of children by age bracket, logistical notes and data of the adult responsible for making the request or booking.
• Order and delivery data: address, city, postal code, country, shipping details, operational emails, phone contacts, order identifiers and internal references.
• Data related to gift cards and the online shop: purchaser name, purchaser email, recipient email, personalised message, ordered items, value, order status and gift card code.
• Technical and browsing data: IP address, online identifiers, device type, browser, visited pages, language, traffic source, cookies and browsing events collected by analytics or tag-management technologies when enabled.

We process personal data only for specific, explicit and legitimate purposes, including:

• Responding to contact requests, questions and information enquiries.
• Managing online reservations, confirmations, changes, cancellations and customer follow-up before and after the visit.
• Organising workshops, experiences, public or private events, group bookings and birthday parties.
• Managing shop orders, gift card issuance, logistics, in-store pickup and shipment of ceramic pieces or products.
• Sending operational and transactional communications, including confirmations, reminders, ready-for-pickup notices, shipping updates, delivery notifications and relevant service changes.
• Analysing website usage, improving content, performance, security, user experience and measuring commercial interest in the website.
• Complying with legal, tax and accounting obligations, protecting rights and preventing fraud or misuse of our systems.

Depending on the specific purpose, the processing of personal data relies on one or more of the following legal bases:

• Performance of a contract or pre-contractual steps, where processing is necessary to manage bookings, orders, workshop requests, events, gift cards, deliveries or other services requested by the data subject.
• Compliance with a legal obligation, including for tax, accounting, legal archiving, complaint handling and cooperation with authorities where required by law.
• Legitimate interests of the controller, namely to ensure the operation of the website, business administration, information security, abuse prevention and service improvement, provided such interests do not override the rights and freedoms of the data subject.
• Consent of the data subject whenever legally required, especially for non-essential cookies, certain analytics tools, promotional communications and any future newsletter subscriptions if implemented.

When you fill in contact or enquiry forms on the website, we process the data strictly necessary to review the request, reply to the user and follow up on the interaction. Providing these data is optional, but failure to complete fields marked as required may prevent us from answering or handling the request.

Requests received by form, email, telephone or other digital channels are used to provide information about availability, experiences, brunch, workshops, events, groups, birthdays, orders, gift cards or other services related to Terracotta Ceramic Cafe. These data will not be used for purposes incompatible with the original reason for the contact.

Online reservations may be managed through the website's own tools and/or through integration with an external booking system. For this purpose, we may process name, email, phone number, date, time, party size, preferences and booking notes. In the current setup, certain reservations are associated with the MenuToGo platform, which acts as a technological service provider in the reservation context. These data are processed to confirm, manage, amend, cancel or fulfil the reservation and to organise service at the physical venue.

In the context of workshops, experiences, public or private events, group bookings and children's birthday parties, we process the data necessary to organise the requested service, including details of the person making the booking, group size, preferred date, logistical notes and, where relevant, limited information on the age composition of a children's group. We do not intentionally request personal data directly from minors through the website; any requests involving minors should be made by parents or legal guardians.

We may send transactional and operational emails related to reservations, information requests, workshops, events, orders, gift cards, piece registration, ready-for-pickup notices, shipping, delivery and customer support. These communications are necessary for the provision of the service and do not depend on separate consent when they are directly connected to the performance of the contractual or pre-contractual relationship.

As of the date of this policy, the website does not offer an active standalone newsletter subscription. If a newsletter is introduced in the future, data will be processed on the basis of user consent or another legally valid basis, and this policy will then be updated to reflect the provider used, the subscription flow, preference management and unsubscribe mechanisms.

The website may use Google Analytics 4 to collect aggregated statistics about browsing behaviour, performance and user interaction with the website. This tool may process technical data and online identifiers such as truncated or approximate IP address, visited pages, session duration, traffic source, browsing events and device or browser information. Where legally required, the use of this technology should depend on the user's prior consent through the cookie management mechanism in place.

The website may use Google Tag Manager as a technical solution for managing tags and scripts. Google Tag Manager is not, by itself, intended to directly identify users, but it may enable the loading of other measurement, marketing or functionality technologies. Whenever the tags loaded involve the processing of personal data or the use of non-essential cookies, their activation must comply with the applicable legal basis, including consent where required.

The website embeds Google Maps content to allow users to view the venue location and obtain directions. When viewing or interacting with an embedded map, the user may connect to Google's servers, and Google may collect technical data such as IP address, device, browser and usage information under its own policies.

The website includes links to profiles and content on social media platforms, namely Instagram, Facebook and TikTok. When a user clicks those links, they begin interacting with third-party platforms subject to their own privacy and cookie policies. We do not fully control the processing carried out by those platforms, and we therefore recommend reviewing their policies before interacting with their services.

The website may include WhatsApp sharing features and, where applicable, contact channels through that application. If you choose to use WhatsApp, your data may be processed by Meta Platforms and entities within its group in accordance with that service's own terms and policies. The use of WhatsApp for contact or sharing is always voluntary on the part of the user.

We use cookies and similar technologies to ensure the operation of the website, store preferences, measure performance, understand how the website is used and support integrations with third-party services. Whenever required by law, users may manage their preferences through the cookie management mechanism made available on the website.

• Strictly necessary cookies: enable the technical functioning of the website, security, session management and essential features.
• Preference cookies: store user choices such as language or certain functional settings, where applicable.
• Analytics cookies: measure audiences, interactions, browsing behaviour and performance, including integrations such as Google Analytics 4 when enabled.
• Third-party and embedded-content cookies: may be set by services such as Google Maps or other external tools embedded on the website.

We keep personal data only for as long as necessary to fulfil the purposes for which they were collected, to comply with legal obligations or to defend rights and legitimate interests. As a general rule, we apply the following retention criteria:

• Contact requests and information enquiries: up to 12 months after the last interaction, unless the contact develops into a booking, order or separate legal obligation.
• Reservations, workshops, group bookings, events and operational requests: up to 24 months after the service takes place or the request is closed, unless a longer retention period is required for legal or evidentiary reasons.
• Order, gift card, invoicing and accounting data: for the legally applicable retention period, which may extend up to 10 years under tax and accounting rules.
• Shipping and order-tracking data for ceramic pieces or products: for the period necessary to manage logistics and after-sales support, and up to 24 months after completion, without prejudice to additional legal obligations.
• Analytics data and non-essential cookies: for the periods configured in the relevant tool or until consent is withdrawn, subject to periodic deletion.
• Technical records and security logs: for the period strictly necessary for security, diagnostics, abuse prevention and service continuity.

We implement appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, implementation costs, the nature of the data and the risks involved in the processing.

• Internal access controls and limitation of access to data to persons who need them to perform their duties.
• Use of technological channels and infrastructures with reasonable security, authentication and credential management mechanisms.
• Monitoring measures, misuse prevention, service updates and good practices of data minimisation and segregation.
• Despite the measures adopted, no transmission or system is completely invulnerable, and we therefore cannot guarantee absolute and permanent security in all scenarios.

We may share personal data with third parties only where necessary for service provision, compliance with legal obligations or the technical and operational management of the website and business.

• Hosting, infrastructure and deployment providers for the website.
• Database, storage, internal management and cloud service providers required for the application to operate.
• Email and transactional communication providers.
• Google, for services such as Analytics, Tag Manager and Maps, where used.
• MenuToGo and other technology providers linked to the reservation system, where applicable.
• Cloudinary or equivalent services for image storage and management for the business and certain internal operations.
• Logistics operators and carriers, such as CTT or other shipping partners, where needed to send ceramic pieces or orders.
• Consultants, accountants, legal advisers, public authorities or courts where required by law or necessary for the defence of rights.

Some service providers used by the website and the business may be located outside the European Economic Area or may rely on international subprocessors. In such cases, we seek to ensure that transfers of personal data are based on appropriate legal mechanisms, such as adequacy decisions, standard contractual clauses approved by the European Commission or other safeguards recognised under the GDPR. The use of international service groups such as Google, Meta or other global technology providers may imply transfers to jurisdictions outside the EEA.

Under applicable law, data subjects may exercise, where relevant, the following rights:

• Right of access to personal data relating to them.
• Right to rectify inaccurate or incomplete data.
• Right to erasure, where legally applicable.
• Right to restriction of processing in certain circumstances.
• Right to object to processing based on legitimate interests or certain communications.
• Right to data portability, where applicable and technically feasible.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be subject to decisions based solely on automated processing with significant effects, except where permitted by law.

To exercise their rights, data subjects may contact us at terracottamadeira@gmail.com or by post at the registered address indicated above, clearly identifying the request and, where necessary, proving their identity for the protection of their data. We will seek to respond within the legally applicable time limits. In particularly complex cases or where there is a high volume of requests, this period may be extended under the GDPR.

Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with the competent supervisory authority in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), through the website www.cnpd.pt or the institutional contacts published by it.

We reserve the right to update or amend this Privacy Policy at any time, in particular to reflect legislative, technological or operational changes or changes in the services made available. The most recent version will always be available on the website together with the date of the latest update. Where a change is materially relevant, we may adopt additional information measures where appropriate.

For any question relating to privacy, personal data protection, exercise of rights or requests for clarification, you may contact:

• Cumeada Em Flor - Lda
• Email: terracottamadeira@gmail.com
• Phone: +351 912 863 223
• Registered address: Rua Estados Unidos da América, Edifício K8, Bloco D, 2º B, 9000-090 São Martinho, Funchal, Madeira, Portugal