Merendinha do Arco

Privacy Policy

Last updated: October 14, 2026

1. Data Controller

The controller of personal data collected through this website (merendinhadoarco.pt) is Merendinha do Arco, VAT number 500477531, with registered office at R. dos Sapateiros 230, 1100-581 Lisboa.

For questions regarding data protection, you can contact us at Afkastro@hotmail.com.

2. Principles

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Portuguese Law No. 58/2019, based on the principles of lawfulness, transparency, data minimisation and security.

3. Data Collected and Purposes

3.1. Website browsing

When a user visits the website, we record in aggregate form the IP address, the date of the visit and the selected language. This data is used solely for counting unique daily visitors, based on our legitimate interest in understanding the use of the site (Art. 6(1)(f) GDPR). It is not combined with other sources and is not used for profiling.

3.2. Contact form

If the user sends us a message through the contact form, we collect the data provided (name, email and message) in order to respond to the request. Legal basis: performance of pre-contractual steps or legitimate interest in replying to the user (Art. 6(1)(b) and (f) GDPR).

3.3. Reviews

If the user submits a review, the data they provide (name and comment) will be published on the website. Legal basis: consent, given upon submission (Art. 6(1)(a) GDPR).

4. Cookies and Similar Technologies

This website uses only strictly necessary cookies for its operation (session, CSRF protection and language preference). These cookies are exempt from prior consent under Article 5(2) of Directive 2002/58/EC (ePrivacy) and the CNPD's interpretation.

We do not use analytics, advertising or third-party tracking cookies. Visit counting is performed server-side, without cookies.

5. Retention Periods

  • Visit logs: retained for up to 12 months for aggregated statistical purposes.
  • Contact messages: retained for up to 24 months after the last interaction.
  • Reviews: retained while they are published on the website.

After these periods, the data is deleted or anonymised, unless there is a legal obligation to retain it for longer.

6. Transfer to Third Parties

We do not sell or share personal data with third parties for commercial purposes. We may use processors (for example, web hosting providers) who process data exclusively on our behalf and under a contract ensuring GDPR compliance. Data is hosted within the European Economic Area.

7. Data Subject Rights

Under the GDPR, you have the right to:

  • Access your personal data;
  • Rectify inaccurate or incomplete data;
  • Erase your data ("right to be forgotten");
  • Restrict processing;
  • Object to processing based on legitimate interest;
  • Portability of the data;
  • Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, please contact us at Afkastro@hotmail.com.

8. Complaints to the Supervisory Authority

You have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD), via cnpd.pt.

9. Security

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including encrypted connections (HTTPS) and access controls.

10. Changes to this Policy

We reserve the right to update this Privacy Policy. The version in force is always the one published on this page.