Privacy policy

The controller of your personal data is the company that runs the Esten Works shop, based in Portugal.

• Registered office: Rua António Sérgio 11, 2780-189 Oeiras
• Email: our Contact page

For any question about your data, you can use the form on the Contact page. We do not have a data protection officer, because the law does not require one for this activity.

• Identification and contact: name and email
• Delivery: name and postal address
• Order: products, amounts, personalisation text and the files you upload
• Payment: processed by Stripe; we do not see or store your full card details
• Messages you send through the contact form
• Newsletter: your email, if you subscribe
• Technical: IP address stored only as a hash, for security and abuse prevention; usage statistics only with your consent

• Processing, making and delivering orders: performance of the contract
• Invoicing and tax records: legal obligation
• Answering your messages: steps at your request and legitimate interest
• Newsletter: consent, which you can withdraw at any time
• Security and abuse prevention: legitimate interest
• Statistics and marketing: consent

We only share data with the providers needed to run the shop:

• Stripe: payments. Stripe is also an independent controller for fraud prevention and the legal obligations of payments (policy at stripe.com/privacy)
• Supabase: database, file storage and request limiting against abuse (in its Postgres database)
• Vercel: website hosting
• Google Workspace: email
• Resend, when enabled: sending the shop's emails
• Brevo (Sendinblue SAS, France): sending the shop's emails as a backup, when the main sender fails
• PostHog, hosted in the EU: usage statistics, only with consent
• The carrier that delivers your order: delivery details

With your marketing consent, we also use:

• Meta (Facebook and Instagram): the Meta pixel, to measure campaigns and show ads
• Google (Google Ads and Google Analytics): the Google tag, to measure campaigns and visits
• Pinterest: the Pinterest tag, to measure campaigns

Meta, Google and Pinterest also process this data as independent controllers, under their own privacy policies.

When a provider processes data outside the European Economic Area (for example in the United States), the transfer relies on the EU-US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission.

• Order and invoicing data: 10 years, the retention period for accounting and tax records in Portugal
• Personalisation files: 12 months after delivery, or 30 days after cancellation if the order is never shipped; then deleted
• Contact messages: while needed to answer and follow up
• Newsletter: until you unsubscribe; after that we keep only the proof of your consent and of the unsubscription for 3 years
• Statistics: while your consent is valid

After those 10 years, personal data on old orders (name, address) is automatically anonymised; the order itself is kept for accounting.

Under the GDPR you can ask for:

• Access to your data
• Rectification
• Erasure
• Restriction of processing
• Portability
• Objection to processing
• Withdrawal of consent, at any time

Make your request through the form on the Contact page. You can also write to our Contact page. You can also lodge a complaint with the Portuguese data protection authority, CNPD (www.cnpd.pt).

You can also export your data or request deletion of your account directly in My account > Your data.

Essential cookies keep the shop working and do not need consent. Statistics and marketing cookies are only used after you accept them in the consent banner, and you can change that choice at any time in "Cookie settings", in the footer. Third-party cookie durations are set by those providers.

Essential:

• ew_consent (Esten Works): stores your cookie choice; 180 days
• sb-...-auth-token (Supabase): keeps you signed in to your account; until you sign out, 400 days at most
• NEXT_LOCALE (Esten Works): remembers the language you chose; until you close the browser
• ew_auth_pending (Esten Works): briefly holds the sign-in link you opened until you confirm signing in; 10 minutes
• ew_cart_v1 (browser local storage, not a cookie): keeps your cart on this device; until you empty it
• ew_checkout_v1 (browser session storage, not a cookie): remembers the country, postcode, coupon and shipping option you chose between the cart and checkout; until you close the tab

Statistics (only with consent):

• ph_..._posthog (PostHog, cookie and local storage): measures visits and use of the site; 1 year

Marketing (only with consent):

• _fbp (Meta): measures campaigns and ads; 90 days
• _ga and _ga_... (Google Analytics): tells visitors and sessions apart; 2 years
• _gcl_au (Google Ads): measures ad conversions; 90 days
• _pin_unauth and _epik (Pinterest): measure campaigns; 1 year

We may update this policy. The date of the current version is shown at the top of this page.