Pickpantrystorypuls
Order ahead
Legal

Privacy policy

This policy explains what personal data Pickpantrystorypuls Padaria Lda. collects through pickpantrystorypuls.com and in the café, why we collect it, who we share it with and the rights you have over it.

Effective 1 January 2026 · Version 3.1

1. Who we are

The data controller is Pickpantrystorypuls Padaria Lda., a private limited company registered in Portugal under company number (NIPC) 516 402 887, with its registered office at Rua da Bica de Duarte Belo 42, 1200-054 Lisboa, Portugal. You can reach us at [email protected]. Our data protection officer can be contacted directly at [email protected].

2. Data we collect

We collect only the data we need to run a bakery and a website about it. Specifically:

  • Contact form data — your name, email address, the subject you choose and the message you write, when you use the form on our contact page.
  • Booking data — name, email, phone number, group size, dietary requirements and payment confirmation when you book a workshop, private hire or catering order.
  • Technical data — IP address, browser type, device type, pages visited and referring page, collected automatically by our hosting provider's server logs and, if you consent, by our analytics cookies.
  • Cookie preferences — your consent choice, stored in your browser's local storage so we do not ask again.

We do not collect special category data. If you tell us about an allergy for a booking, we treat that as health data, use it only to keep you safe, and delete it after the event.

3. Why we process it and on what legal basis

  • Answering enquiries and fulfilling bookings — performance of a contract, or steps prior to entering one (GDPR Article 6(1)(b)).
  • Keeping accounting and tax records — legal obligation under Portuguese law (Article 6(1)(c)).
  • Website security and server logs — our legitimate interest in running a secure site (Article 6(1)(f)).
  • Analytics and functional cookies — your consent, which you can withdraw at any time (Article 6(1)(a)).
  • Occasional email about new workshop dates, only if you opted in — consent.

4. Cookies

We use essential cookies to make the site work and, with your permission, analytics cookies to understand which guides people read and functional cookies to remember preferences. A full list, with durations and opt-out instructions, is in our cookie policy. You can change your choice at any time by clearing your browser's local storage for this site, after which the consent banner will reappear.

5. Third-party processors

We share data with a small number of processors, each bound by a data processing agreement:

  • Stripe Payments Europe Ltd (Ireland) — card payments for workshops and catering. We never see your full card number. Stripe privacy policy.
  • Google Ireland Ltd — Google Analytics 4, only if you accept analytics cookies; IP addresses are anonymised. Google privacy policy.
  • Mailchimp (Intuit Inc.) (USA) — workshop newsletter, only for people who opt in. Transfers are covered by the EU–US Data Privacy Framework. Mailchimp privacy policy.
  • Our hosting provider, located in the European Union, which stores server logs for 30 days.

We do not sell personal data and we do not share it with advertisers.

6. Retention

  • Contact form messages: 12 months from our last reply, then deleted.
  • Booking and invoice records: 10 years, as required by Portuguese tax law.
  • Dietary and allergy notes: deleted within 7 days of the event.
  • Server logs: 30 days.
  • Analytics data: 14 months, the shortest retention setting Google Analytics offers.
  • Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not email you again.

7. Your rights under the GDPR

If you are in the European Economic Area or the United Kingdom you have the right to access the data we hold about you, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing that took place before withdrawal. To exercise any of these, email [email protected]. We respond within one month. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados, or with the authority in your own country.

8. Your rights under the CCPA

If you are a California resident, the California Consumer Privacy Act gives you the right to know what personal information we collect and how it is used, to request deletion, to opt out of the sale or sharing of personal information (we do neither), and not to be discriminated against for exercising these rights. Requests can be made at the email address above. We will verify your identity by matching the email address you write from against the data we hold. More information is available from the California Attorney General.

9. Security

The site is served over HTTPS. Booking data is held in access-controlled systems available only to staff who need it. Paper booking sheets in the café are shredded weekly. No system is perfectly secure; if we become aware of a breach that puts your rights at risk we will notify you and the CNPD within 72 hours.

10. Children

Our website is not aimed at children under 16 and we do not knowingly collect their data online. Family workshop bookings are made by an accompanying adult, and we record only the child's first name and age for kitchen safety.

11. Changes to this policy

We will post any changes on this page and update the version number and effective date. Material changes affecting how we use your data will be notified to newsletter subscribers by email.