Privacy policy
Last updated: 29 October 2026
1. Who is the controller
Pompousweek Unipessoal Lda (trade name Dr3amToReal), company number (NIPC) 516406540, Travessa Cabo Luis, n.º 9, 3800-294 Aveiro, Portugal. Privacy contact: dr3amtoreal@gmail.com · +351 963 007 377.
We have not appointed a data protection officer, because we are not required to (article 37 of the General Data Protection Regulation, GDPR).
2. What data we process, why, on what basis and for how long
| Purpose | Data | Legal basis (GDPR art. 6(1)) | Retention |
|---|---|---|---|
| Answering questions and quote requests (WhatsApp, Instagram, Messenger, email, website forms) | name or username, contact details, message content | steps at your request before a contract (b) or legitimate interest in replying (f) | for as long as needed to answer your request; if no order follows, we delete the data once it is no longer needed |
| Preparing and performing your order (summary, production, shipping, support) | name, delivery address, phone, email, order details, personalisation details | performance of a contract (b) | for the contract and the legal guarantee period (3 years after delivery), then until the applicable limitation period ends |
| Photos, text and files for personalised pieces | images (which may show other people), text, measurements | performance of a contract (b) | only for as long as needed to make the piece and deal with questions about the order, unless you agree in writing that we keep them |
| Payments | transfer, MB WAY and Multibanco reference details; for cards, Stripe processes the card data and we never see it | performance of a contract (b) and legal obligation (c) | see invoicing |
| Invoicing and tax obligations | name, tax number (if given), address, amounts | legal obligation (c) | 10 years (Decree-Law no. 28/2019, art. 19) |
| Complaints, guarantee and legal claims | order and communication history | legitimate interest (f) and legal obligation (c) | until the applicable limitation period ends; Complaints Book entries: 3 years (Decree-Law no. 156/2005) |
| Website statistics and measurement (Google tag, including Google Analytics) — only with your consent | cookie identifiers, pages viewed, device, approximate location | consent (a) and art. 5 of Law no. 41/2004 | see the Cookie policy |
We do not make decisions based solely on automated processing that produce legal effects for you, and we do not profile you for that purpose.
If you do not give us the data needed for an order (for example, the delivery address), we cannot make or perform the contract.
3. Who we share your data with
We do not sell personal data. We only share what is necessary with:
| Organisation | Purpose | Role | Location / transfers |
|---|---|---|---|
| Meta (WhatsApp, Instagram, Messenger) | messages we exchange with you | independent controller for its own services | EU and US |
| Google (Gmail — dr3amtoreal@gmail.com mailbox) | email service provider | EU and US | |
| Google (Google tag, including Google Analytics) — only with your consent | website statistics and measurement | processor | EU and US |
| HighLevel (CRM, via the reseller Arcytex) | contact management and automated replies to Instagram and Facebook messages | processor | US |
| Stripe | card payments | payment service provider; independent controller for the processing it carries out for its own purposes (for example fraud prevention and legal obligations) | EU and US |
| Bank and payment service providers (bank transfer, MB WAY and Multibanco references) | payments | payment service providers | Portugal / EU |
| FIZ (invoicing software) | issuing invoices | processor | Portugal |
| Certified accountant | bookkeeping and tax compliance | processor | Portugal |
| CTT — Correios de Portugal | delivering orders | independent controller | Portugal |
| Vercel (website hosting) and Supabase (database and image storage) | hosting, database, images | processors | EU and US |
| Resend | sending messages submitted through the website forms to our mailbox | processor | US |
| Authorities (tax authority, ASAE, courts) | where the law requires | independent controllers | Portugal |
4. Transfers outside the European Economic Area
Some providers (for example Google, Meta, Stripe, HighLevel, Vercel, Supabase and Resend) may process data in the United States. These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, for certified organisations, or on standard contractual clauses approved by the Commission. You can ask us which safeguards apply to each provider.
5. Your rights
You have the right to:
- access your data and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- object to processing based on legitimate interest;
- receive the data you gave us in a structured format (portability);
- withdraw consent at any time, without affecting processing carried out before (for example, via "Cookie preferences" in the site footer).
To exercise any right, write to dr3amtoreal@gmail.com. We reply within one month, which can be extended in the cases the GDPR allows. We may ask for information to confirm your identity.
Where the law requires us to keep certain data (for example, invoices for 10 years), we can only erase it when that period ends (Law no. 58/2019, art. 21(5)); until then it is kept for that purpose only. You can also request erasure through the Data deletion page.
6. Complaints to the supervisory authority
If you believe we process your data unlawfully, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.
7. Security
We use providers with appropriate security measures and limit access to the accounts we use to manage orders. Please do not send us sensitive data (for example health or card details) by message.
8. Children
We do not knowingly collect data from children under 13. If this has happened, contact us and we will delete it.
9. Changes
We may update this policy. The current version is published here with the date of the last update.