Privacy policy
Last updated: March 24, 2026
Who we are
Past Lives Jewellery is the data controller responsible for your personal information.
Owner: Ana Maria Brandão Esmeraldo
NIF: 258092726
Address: Avenida da República 23, 1050-185 Lisboa, Portugal
Email: contact@pastlivesjewellery.com
This Privacy Policy describes how we collect, use, and disclose your personal information when you visit or make a purchase from pastlivesjewellery.com, or otherwise communicate with us. By using our store, you acknowledge that you have read and understood this policy.
Personal information we collect
Depending on how you interact with us, we may collect:
- Contact details — name, email address, phone number, billing and shipping address
- Financial information — payment card details and transaction records (card data is processed securely and never stored on our servers)
- Account information — username, password, preferences
- Transaction information — items viewed, added to cart, purchased, returned, or exchanged
- Communications — messages you send us via email, WhatsApp, or our contact form
- Device and usage information — IP address, browser type, pages visited, and interaction data collected via cookies and similar technologies
How we use your information
We use your personal information for the following purposes, with the legal basis for each:
- Processing and fulfilling orders — necessary for the performance of our contract with you
- Sending order confirmations, shipping updates, and support responses — necessary for the performance of our contract with you
- Issuing invoices and complying with tax obligations — legal obligation (Portuguese fiscal law requires invoice data to be retained for 10 years)
- Fraud prevention and security — legitimate interest
- Improving our store and understanding how customers use it — legitimate interest (using anonymised and aggregated data)
- Sending marketing emails and showing personalised ads — your consent only. You may withdraw consent at any time by clicking unsubscribe in any marketing email or contacting us directly
How long we keep your data
- Order and invoice data: 10 years (required by Portuguese fiscal law)
- Account data: for the duration of your account, plus 2 years after closure
- Marketing data: until you withdraw consent
- Cookie and browsing data: as set out in each cookie's lifespan — see our cookie banner for details
Who we share your data with
We only share your personal information with the following third-party service providers, strictly as necessary to operate our store:
- Shopify Inc. — e-commerce platform and infrastructure (USA, SCCs applied)
- Invoicexpress — invoicing and AT communication (Portugal)
- IFTHENPAY / Easypay — MB WAY and Multibanco payment processing (Portugal)
- Shopify Payments / Stripe — card payment processing
- PayPal — payment processing
- CTT / DHL / GLS — order shipping and delivery
- Google LLC — Google Analytics 4, traffic analysis (USA, SCCs applied)
- [Klaviyo / Shopify Email] — email marketing, only if you have given consent
We never sell your personal data to third parties.
International transfers
Some of our service providers (Shopify, Google) are based in the United States. All transfers of personal data outside the European Economic Area are carried out under the European Commission's Standard Contractual Clauses (SCCs), which ensure an adequate level of data protection.
Cookies
We use cookies for essential store functionality, traffic analysis (Google Analytics). Non-essential cookies are only activated after you give your consent via our cookie banner. You can manage or withdraw your cookie preferences at any time through the banner on our website.
Your rights
Under the RGPD (GDPR), if you are based in the EU or UK you have the following rights regarding your personal data:
- Access — request a copy of the data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data ("right to be forgotten")
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing for marketing purposes at any time
- Restriction — ask us to limit how we process your data
- Withdrawal of consent — withdraw consent for marketing or cookies at any time, without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at contact@pastlivesjewellery.com. We will respond within 30 days. We may need to verify your identity before processing your request.
Complaints
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Portuguese data protection authority:
CNPD — Comissão Nacional de Proteção de Dados www.cnpd.pt Rua de São Bento 148-3º, 1200-821 Lisboa Tel: +351 21 392 84 00
If you are based in another EU country, you may also contact your local data protection supervisory authority. A full list is available at: ec.europa.eu/justice/article-29/structure/data-protection-authorities
Relationship with Shopify
Our store is hosted by Shopify Inc., which processes personal data on our behalf as a data processor. Shopify also operates certain enhanced features that may involve data collected across multiple merchants. In those cases, Shopify acts as an independent data controller. For more information on how Shopify processes your data, visit: privacy.shopify.com. To exercise rights related to Shopify's processing, visit: privacy.shopify.com/en.
Third-party links
Our store may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites and recommend you review their privacy policies independently.
Children
Our store is not intended for children under the age of 16. We do not knowingly collect personal data from minors. If you believe a child has provided us with their data, please contact us and we will delete it promptly.
Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date. Continued use of our store after changes are posted constitutes acceptance of the updated policy.
Contact
For any questions about this Privacy Policy or to exercise your rights:
contact@pastlivesjewellery.com