Privacy and Cookie Policy

Last updated: March 2026

1. Who is responsible for processing your data?

The entity responsible for collecting and processing your personal data is Inês Diogo Varela, NIF 256588830, a self-employed professional operating under the commercial brand Blooming Creative Studio, hereinafter referred to as "Blooming" or "we", who operates this store and associated services, including the Etsy (Bloomingcs), Shopify platforms and the bloomingcreativestudio.pt website.

Contact:

•       Email: info@bloomingcreativestudio.pt

•       Website: bloomingcreativestudio.pt

2. What personal data do we collect and how do we obtain it?

We collect the following personal data, depending on how you interact with us:

•       Identification and contact data: name, email address;

•       Transaction data: items purchased, purchase history, payment confirmations (processed by Etsy, Shopify or Stripe — we do not store credit card data);

•       Communication data: messages you send us via Etsy, email or contact form;

•       Usage data: information about your interaction with our website (IP address, browser type, pages visited), collected through cookies and similar technologies.

This data is obtained directly from you (when you make a purchase, fill out a form or contact us), automatically (through the website), or through the platforms we use (Etsy, Shopify, Templett, Canva).

We do not collect sensitive data (racial origin, health data, religious beliefs, sexual orientation, among others).

3. For what purposes do we use your data and on what grounds?

Your data is processed based on the following legal grounds and for the following purposes:

Performance of a contract (Art. 6(1)(b) of the GDPR)

•       Processing your order and delivering the purchased digital files;

•       Sending the template access link (Templett or Canva) after confirmed purchase;

•       Providing customer support and answering order-related questions.

Legal obligation (Art. 6(1)(c) of the GDPR)

•       Complying with applicable tax and accounting obligations.

Legitimate interest (Art. 6(1)(f) of the GDPR)

•       Improving our products and services based on received feedback;

•       Ensuring website security and preventing fraudulent use.

You can object to any processing based on legitimate interest by contacting us at info@bloomingcreativestudio.pt.

Consent (Art. 6(1)(a) of the GDPR)

•       Sending marketing communications (newsletter), only if you have given express consent.

You can withdraw your consent at any time, without affecting the lawfulness of previous processing.

4. With whom do we share your data?

We do not sell or rent your data to third parties. We share your data only in the following circumstances and with the following categories of recipients:

•       Sales and hosting platforms: Etsy, Inc. and Shopify Inc., which host and process transactions. Consult their respective privacy policies at etsy.com and shopify.com;

•       Template platforms: Templett and Canva, for delivery of digital files after purchase. These providers may process data in accordance with their own privacy policies;

•       Payment processing: Stripe, PayPal or the native payment systems of Etsy/Shopify — we never store card data;

•       Public authorities: when legally obliged (tax, judicial or regulatory authorities);

•       Analytics tools: Google Analytics (anonymized), to understand website visitor behavior.

5. How long do we retain your data?

Your data is retained only for the period necessary for the purpose for which it was collected:

•       Transaction and billing data: 10 years, due to tax obligations;

•       Customer support data: as long as the contractual relationship is maintained and for the applicable statute of limitations;

•       Marketing data (newsletter): until consent is withdrawn;

•       Browsing data (cookies): according to the periods defined in our Cookie Policy.

6. What are your rights?

Under the GDPR, you have the following rights regarding your personal data:

•       Access: obtain confirmation as to whether we process your data and access it;

•       Rectification: correct incomplete or inaccurate data;

•       Erasure ("right to be forgotten"): request the deletion of your data, unless there are legal grounds for its retention;

•       Restriction: restrict the processing of your data in certain circumstances;

•       Objection: object to processing based on legitimate interest;

•       Portability: receive your data in a structured, commonly used and machine-readable format;

•       Withdraw consent: at any time, when processing is based on your consent.

To exercise any of these rights, please contact us at: info@bloomingcreativestudio.pt

We will respond within a maximum of 30 days. The exercise of rights is free of charge, except in cases of manifestly unfounded or excessive requests.

7. Right to complain to the supervisory authority

You have the right to lodge a complaint with the National Data Protection Commission (CNPD), the Portuguese supervisory authority, if you consider that the processing of your personal data violates the GDPR or applicable national legislation. You can contact the CNPD via www.cnpd.pt.

8. International data transfers

Some of our service providers (such as Etsy, Shopify, Templett or Canva) may be located outside the European Economic Area (EEA). In these cases, we ensure that transfers are carried out based on legally recognized mechanisms, such as Standard Contractual Clauses approved by the European Commission, or to countries with an adequacy decision.

9. Cookie Policy

Our website uses cookies — small text files installed on your device when you visit us — to ensure its operation and improve your experience.

We use the following types of cookies:

•       Strictly necessary cookies: essential for the website's operation. They do not require consent;

•       Analytical cookies: allow us to understand how visitors use the website (e.g., Google Analytics). They require your consent;

•       Marketing cookies: used to display relevant advertising. They require your consent.

You can manage your cookie preferences through your browser settings or through the cookie banner displayed on your first visit to the website.

10. Automated decisions

We do not make exclusively automated decisions that produce legal effects or significantly affect you. We may use automation tools (such as email marketing platforms) to personalize communications, but always with human supervision.

11. Changes to this Policy

We may update this Privacy Policy periodically to reflect legal, operational, or tool changes. The date of the last update is always indicated at the top of the document. We recommend that you review this page regularly.