Privacy policy

1. Controller

Sociedade Agrícola Pedra da Fraga, Lda, company no. 510583431, Rua João de Barros 90, 4150-414 Porto, Portugal. Contact: welcome@mittostudio.com.

2. What data we process

• Orders: name, email, address, phone (if given), items and amounts, to sell and deliver. Legal basis: contract. Without this data the purchase cannot be completed.
• Invoicing: invoice details, including your tax number if you give it. Legal basis: legal obligation.
• Payments: handled by Stripe or MEO Wallet (Altice Pay). We only receive the confirmation, the method and the transaction reference.
• Newsletter: email, language and a record of your consent. Legal basis: consent, which you can withdraw at any time through the link in every email.
• Customer account (optional): email, saved addresses and order history, so you can sign in without a password and see your orders. Legal basis: contract.
• Contact: the emails you send us, to answer them. Legal basis: legitimate interest.
• Visit statistics: pages viewed, where the visit came from (for example the campaign or referring site), country, device type and browser, and the link to the order when you buy. No cookies: your IP address is turned into a code that changes every day and is not stored. Legal basis: legitimate interest in understanding and improving the shop.
• Google Analytics (only if you accept): pages viewed, interactions and purchases, linked to an identifier in a cookie. Legal basis: consent, which you can withdraw at any time through the "Cookies" link in the footer.

3. Providers

The providers below process data on our behalf under contract. Where they are outside the European Economic Area, the transfer relies on an adequacy decision or on the European Commission's standard contractual clauses.

When you open the site, your IP address also reaches Garnstudio (product images).

4. Retention

Orders and invoices: 10 years, as required by tax law. Newsletter: until you unsubscribe; after that, only the record of consent and unsubscription. Support emails: up to 2 years after the last contact.

Visit statistics: 25 months. Google Analytics: 14 months.

Customer account: until you ask for it to be deleted; orders follow the period above.

5. Cookies

Necessary: our hosting sets a technical cookie against automated traffic (__cf_bm), which expires after 30 minutes. Your browser stores the cart, a technical checkout identifier that prevents duplicate payments, and your cookie choice, for 6 months. The Stripe and MEO Wallet payment pages use their own cookies to prevent fraud. If you choose a country or language, the site stores that choice in a cookie (mitto_market) for one year, so it always opens your shop.

Statistics (only with your consent): Google Analytics (_ga and _ga_*), up to 2 years. Marketing (only with your consent): ad measurement cookies from Google, Meta and Pinterest, when we use them. With marketing accepted, when you buy we send Google your email in irreversible form (SHA-256 hash) to measure how well our ads work. You can accept, reject or change your choice at any time through the "Cookies" link in the footer.

If you sign in, the site stores a strictly necessary session cookie (mitto_customer) that expires after 7 days.

6. Your rights

You can request access, rectification, erasure, restriction or portability of your data, object to processing and withdraw consent by emailing welcome@mittostudio.com. We reply within one month. Data we must keep by law, such as invoices, cannot be erased.

You can complain to the Portuguese data protection authority, CNPD (cnpd.pt), or to the authority in your country.