Privacy Policy

Last updated: December 4, 2025

Privacy Policy
This Privacy Policy explains how we collect, use, and protect users' personal data when they visit our website or make a purchase. We have prepared this document in accordance with the General Data Protection Regulation (GDPR) and current Portuguese legislation.
By using the UMBOX.pt website or placing an order, the user accepts the terms of this Privacy Policy.

1. Controller
The entity responsible for data processing is CLEAN ME CLEANHOUSE LDA (UMBOX.pt), with registered office at R. Sá de Miranda 260, 2785-728, São Domingos de Rana, NIF 517710366.
UMBOX® is a registered trademark in Portugal, owned by CLEAN ME CLEANHOUSE LDA.
For questions related to data protection, please contact us by email: support@umbox.pt.

2. Integration with Shopify
Our online store uses the Shopify technology platform for hosting, order management, payments, and related features.
• Shopify generally acts as a data processor, handling personal data on our behalf so that we can operate the store.
• In certain situations, Shopify may process data as an independent controller, for example, for fraud detection, security, compliance with legal obligations, and general improvement of its platform.
The data you provide through our store may be stored and processed by Shopify in data centers outside of Portugal. To learn more about how Shopify handles personal data, we recommend reading the Shopify Consumer Privacy Policy available on their website.
However, we remain the primary point of contact for any questions related to the processing of your data in the context of UMBOX.pt.

3. Data Collected
We may collect the following categories of personal data:
• Identification data: name, NIF (taxpayer ID), address, date of birth (when necessary, for example, for billing or age verification).
• Contact information: email, phone number.
• Payment data: card information (processed directly by our payment partners), MB WAY data, and data related to payments in cryptocurrency or other digital methods.
• We do not store the full card number or security code (CVV); we only receive limited information (e.g., the last 4 digits of the card, card type, and transaction identifier) necessary to identify the payment.
• In the case of cryptocurrency payments or associated solutions (e.g., USDC, digital wallets, or third-party crypto payment partners), we only receive payment confirmation, the amount in euros, and, where applicable, the wallet identifier used. We never have access to the user's private keys.
• Browsing and device data: IP address, browser type, operating system, pages visited, time spent on the site, clicks, traffic source (e.g., marketing campaigns).
• Data provided in communications: messages sent via email, WhatsApp, Telegram, contact form, or other channels.
• Customer account data: If you create an account, we collect your email, password (encrypted), order history, communication preferences, and saved settings.

4. Purposes of Treatment
We collect and process personal data for the following purposes:
1) Order processing
• Management of the purchasing process, preparation and shipment of products, issuing invoices/receipts, managing returns and exchanges, after-sales support.
2) Marketing communications
• Sending newsletters, promotional campaigns, information about products or similar services, when you have given your consent.
• You can cancel these communications at any time by using the “unsubscribe” option in each email or by contacting us.
3) Customer support
• To answer questions, requests for information, complaints, and to address the exercise of data protection rights.
4) Service improvement and statistical analysis
• Analysis of navigation and aggregated behavior to optimize the website, user experience, product offerings, and the effectiveness of marketing campaigns.
5) Security and fraud prevention
• Verification of suspicious transactions, prevention of account misuse, protection of our technical infrastructure, and compliance with internal security rules.
6) Compliance with legal obligations
• Tax and accounting obligations, preservation of billing documents, responding to requests from public or judicial authorities.

5. Legal Foundations
The processing of personal data is based on several legal grounds, namely:
• Contract execution – to enter into and fulfill the purchase and sale agreement with the client.
• Consent – for marketing communications and the use of non-essential cookies; the user may withdraw consent at any time.
• Legitimate interest – to improve service, strengthen security, prevent fraud, and manage customer relationships, provided that these interests do not harm the rights of data subjects.
• Legal obligation – to comply with tax, accounting, or consumer protection regulations, or to respond to requests from competent authorities.

6. Data Sharing
We may share personal data with:
• Service providers:
• Transportation companies and logistics operators;
• Payment processors (e.g., banks, MB WAY, PayPal, installment payment solutions);
• cryptocurrency payment solution providers (where applicable);
• Hosting services, email platforms, marketing tools, and statistical analysis.
• Shopify platform, for hosting the store, payment processing, security, and additional features.
• Competent authorities, when required by law or necessary to protect our rights, prevent fraud, or respond to legal proceedings.
We never sell personal data to third parties. We carefully select our partners and require them to adopt appropriate levels of data protection in accordance with the GDPR.
In some cases, certain providers (e.g., payment providers) act as independent controllers, applying their own privacy policies and complying with their legal obligations (such as anti-money laundering). We recommend that users read the privacy policies of these third parties.

7. Data Subject Rights
Under the GDPR, the data subject has, among others, the following rights:
• Right of access – to obtain confirmation as to whether your data is being processed and to access it.
• Right of rectification – to correct inaccurate or incomplete data.
• Right to erasure – request the deletion of data when it is no longer necessary or when you withdraw your consent (provided there is no other legal basis for processing).
• Right to object – to object to processing for direct marketing purposes or based on legitimate interests.
• Right to data portability – to receive data in a structured, commonly used and machine-readable format and, when technically feasible, to transmit it to another data controller.
• Right to restriction – to request the suspension of treatment in certain circumstances.
To exercise these rights, the user can contact us at support@umbox.pt.
We will respond to your request within the timeframes stipulated by applicable law.
The data subject also has the right to lodge a complaint with the National Data Protection Commission (CNPD).

8. Cookies and Similar Technologies
Our website uses cookies to:
• ensure the basic functioning of the website (essential cookies, for example, keeping products in the cart, user session);
• Analyze usage and performance statistics;
• Personalize content and ads (analytical and marketing cookies).
Under the terms of the GDPR and applicable legislation, non-essential cookies are only activated with the user's consent, via the cookie banner, where you can manage your preferences at any time.
More detailed information about the types of cookies used can be found in our Cookie Policy.

9. Data Security
We have adopted appropriate technical and organizational measures to protect personal data against destruction, loss, alteration, unauthorized disclosure or access, including:
• Use of secure connections (HTTPS);
• Encryption and pseudonymization of certain data;
• Access control and internal security policies.
Despite these efforts, no transmission or storage method is completely secure. The user is also responsible for keeping their account credentials confidential and using secure devices.

10. International Transfers
Some of our service providers, including Shopify, may be located outside the European Economic Area (EEA).
When data is transferred to third countries, we guarantee that:
• the transfer occurs to countries with an adequacy decision from the European Commission, or
• Standard Contractual Clauses or other recognized mechanisms are used to ensure a level of data protection equivalent to that of the EU.

11. Policy Changes
We may update this Privacy Policy from time to time to reflect:
• changes in the law;
• Changes to our internal processes;
• Introduction of new services or features.
The most recent version will always be available at UMBOX.pt. We recommend that users consult this policy regularly. Significant changes may be communicated via email or through a notice on the website.

12. Contact
For any questions related to this Privacy Policy or the processing of your personal data, you can contact us through:
• Email: support@umbox.pt
• Address: CLEAN ME CLEANHOUSE LDA – UMBOX.pt,
R. Sá de Miranda 260, 2785-728, São Domingos de Rana, Portugal.
We are available to answer questions and resolve situations transparently.