What we do with your data.

Who is responsible

The controller of your personal data, in the sense of the General Data Protection Regulation (EU) 2016/679, is:

We have not appointed a Data Protection Officer. We are not required to have one, because our core activity is selling clothing rather than large-scale monitoring or processing of special categories of data. The address above reaches the people who actually make these decisions.

What we collect, why, and for how long

This is the substance of the policy. Each row states the purpose, the data involved, the legal basis under Article 6 GDPR that permits it, and how long the data survives.

Where we rely on legitimate interests, we have weighed our interest against your rights and concluded the processing is what you would reasonably expect. You can ask us for that assessment, and you can object to it — see your rights.

Giving us your data is not optional for an order

We are not asking for more than we need, but we do need what we ask for. Without a name, a delivery address, an email address and a payment, we cannot form a contract with you, produce a lawful invoice, or get a parcel to you. If you do not want to provide it, we cannot accept the order. Everything beyond that — an account, the newsletter, analytics — is genuinely optional and refusing it does not affect your ability to buy.

Who else receives your data

We do not sell personal data and we never have. We do share it with the companies below, each of which processes it for us or as a controller in its own right for the purpose stated.

We may also disclose data where we are legally required to — to a court, a tax authority or a regulator acting within its powers — and, if the business is ever sold or merged, to the acquirer as part of the transaction. In that case the data stays subject to a policy no less protective than this one.

Transfers outside the European Economic Area

Some of the companies above are in the United States. Where data reaches them, the transfer is made under Chapter V GDPR — either because the recipient is certified under the EU–US Data Privacy Framework, or under the European Commission’s Standard Contractual Clauses together with supplementary measures where the assessment requires them.

You can ask us which mechanism applies to a particular recipient and we will tell you.

Cookies and tracking

Cookies and similar technologies fall into two groups, and the distinction matters legally.

• Strictly necessary. Your shopping bag, your login session, the checkout, security tokens and your cookie choice itself. These do not require consent because the site cannot function without them, and refusing them is not possible while still using the shop.
• Everything else — analytics, advertising and measurement. These require your prior consent, they are set by the services named in the table above, and you may refuse or withdraw at any time without losing access to anything you paid for.

You can change or withdraw your choice at any time through the cookie settings on this site, and you can clear cookies in your browser independently of us. Withdrawing consent does not undo processing that already took place lawfully before you withdrew it.

Our cookie policy lists the individual cookies, what each one does and how long it lasts.

Automated checks on orders

Two automated checks run on orders. Neither of them decides anything about you on its own.

The first is ours. Every order is scored for risk when it is placed, using signals we can already see: whether the delivery address matches the billing address, how old the account is, how many orders have come from the same email or connection in a short time, failed payment attempts, and how the order compares with what that customer usually spends. A long clean history lowers the score. An order that scores above our threshold is put on hold and looked at by a person — nothing is cancelled, refused or refunded automatically, and the score is a prompt to check rather than a verdict. The score and the reasons behind it are stored with the order.

The second belongs to our payment providers, who run their own fraud screening on the transaction. A payment can be declined as a result. That decision is theirs rather than ours, and we are not told the detail of it.

Because a person reviews every held order before anything happens to it, this is not a decision based solely on automated processing within the meaning of Article 22 GDPR. You can still ask us about it. If your order was held or refused and you believe it was wrong, write to us. We will look at it, tell you what we can see, and where the decision was the payment provider’s we will say so, so that you can take it up with them.

The chat window

There is a chat window on this site. Most of the time you are talking to an AI assistant: software that writes its replies with Claude, a language model made by Anthropic, using our own published pages, our catalogue and, when you ask about an order, our order records. When it cannot help, or when you ask, the conversation is passed to a person on our team. Either way, what follows applies.

What is kept

We keep the conversation. That includes exchanges where nobody from our team ever joined, because reading what people ask the assistant is how we find out what our pages fail to explain. Alongside the messages we store your IP address, the browser and device you are using, the language your browser asks for, and the page you were on when you started. If you are signed in we also note your account and how many orders you have placed, so whoever answers is not asking you questions we can already answer ourselves.

An IP address is personal data. We record it to tell one conversation apart from another, to deal with abuse of the chat, and because a support record without it is of little use if a dispute follows. We do not use it to build a profile of you, and we do not send it to anyone.

What the AI model is sent

To write each reply, the assistant sends Anthropic Ireland, Limited, which processes it for us under a data processing agreement, the text of your message and of up to twelve earlier messages in the conversation, the address of the page you are on, what is in your basket, and whatever the assistant looks up to answer you: product details, stock, delivery options and our policies. Once you have shown that an order is yours, that order’s status, date, items, totals and delivery progress are sent too. If you are signed in, it is told the name on your account and, when you ask about your orders, the numbers, dates, status and totals of your five most recent ones.

Email addresses, phone numbers, card numbers and bank account numbers are replaced by placeholders before anything leaves this site, whether you typed them or they came from an order, so Anthropic never receives them. Your IP address and your browser details are not sent, and neither are the photos you attach.

Anthropic’s terms do not allow it to use these messages to train its models. It deletes them within 30 days, unless its automated safety checks flag a message as breaking its usage policy, in which case it may keep that message for up to two years. The processing takes place outside the EU, mainly in the United States, under the European Commission’s Standard Contractual Clauses (see Transfers outside the European Economic Area, above).

We rely on our legitimate interest in answering your questions quickly and accurately (Article 6(1)(f) GDPR) and, when you ask about your order, on what we need to do to perform our contract with you (Article 6(1)(b)). If you would rather nothing you write is sent to an AI model, use our contact form or email us instead: neither goes through the assistant.

Photos and documents you send

If you attach a photograph of a faulty item, it is stored on this website under a randomly generated filename and is reachable only by that address. It is not added to our public media library and it is not indexed. It is deleted when the conversation is deleted.

How long

Conversations are deleted automatically after 90 days, with any files attached to them. The one exception is a conversation nobody has answered yet: those are left alone however old, because an unanswered customer is a problem for us to fix rather than a record to discard.

If you gave us an email address, we send you the full transcript when the conversation is closed. That is the only email the chat itself generates.

What we do not do

The assistant cannot refund, cancel or alter an order, and it cannot change your account. It will not tell you anything about an order until you give the order number and either the email address on it, or its delivery postcode together with the surname on it — an order number on its own proves nothing, and we treat it that way. It is instructed never to ask for a card number or a password; if you type one anyway, do not: we do not want it and it does not belong in a chat window.

Your conversation is also kept in your own browser for a day so that the window survives you moving between pages. That copy is on your device, not ours. Clearing your browser data removes it.

Asking us to delete it

Write to privacy@eurofashion24.com with the reference shown in the chat window and we will delete the conversation and anything attached to it. You do not have to wait for the 90 days.

Your rights

Under the GDPR you have the following rights. They are free to exercise, and we will answer within one month.

• Access — a copy of the personal data we hold about you, and the information in this policy applied to your case.
• Rectification — correction of anything inaccurate, and completion of anything incomplete.
• Erasure — deletion, where we no longer need the data and no legal obligation requires us to keep it.
• Restriction — a pause on processing while a dispute about accuracy or legitimacy is resolved.
• Portability — the data you gave us, in a structured, commonly used, machine-readable format.
• Objection — to processing based on legitimate interests. Where you object to direct marketing we will stop, with no balancing test and no argument.
• Withdrawal of consent — at any time, for anything we do on the basis of consent.
• Complaint — to a supervisory authority, as set out below.

Write to privacy@eurofashion24.com. We may ask you to confirm your identity, because handing your data to someone impersonating you would be the worse failure. If we cannot do what you ask, we will tell you why rather than ignore the request.

One limit, stated plainly: invoices and accounting records are kept for 10 years because Portuguese law requires it. A request to erase those cannot be granted, and no retailer in Portugal can grant it.

Security

The site runs entirely over HTTPS. Passwords are stored as cryptographic hashes and cannot be read by us or recovered. Card details are entered into the payment provider’s own environment and never reach our server. Access to order data is limited to the people who need it to do their jobs, and we keep our software patched.

What we will not claim is that any of this is a guarantee. No website or transmission over the internet can be made perfectly secure, and anyone who tells you otherwise is selling something. If a breach occurs that is likely to result in a high risk to your rights, we will notify you and the CNPD as Articles 33 and 34 require.

Children

This shop is not directed at children and we do not knowingly collect data from anyone under 16. We sell clothing for children, but the customer is the adult placing and paying for the order. If you believe a child has given us personal data, tell us and we will delete it.

Other sites

Where we link to another website — a carrier’s tracking page, a regulator, a social network — that site has its own privacy policy and we are not responsible for what it does. Following a link takes you outside this policy.

Changes to this policy

We update this policy when what we do changes, and the date at the top always reflects the current version. Where a change materially affects how we use data you have already given us, we will tell you rather than rely on you noticing.

Complaints

If you think we have handled your data badly, tell us first — it is usually faster and we would rather know. If that does not resolve it, you have the right to complain to a supervisory authority: in Portugal that is the CNPD, and you may also complain to the authority in the EU country where you live or work.