top of page

Privacy Policy

Last updated: 2 November 2026

​

Protecting the personal data of our customers, users, suppliers and anyone else who interacts with Zé dos Frangos is important to us.

This Privacy Policy explains what personal data we process, why we process it, the legal basis for doing so, how long we keep it, who it may be shared with and the rights available to data subjects.

​

1. DATA CONTROLLER

The controller responsible for the processing of personal data is:

ILUSTRENTREGA, UNIPESSOAL, LDA.
Portuguese Company Tax ID (NIPC): 513127283

Registered office:
Largo António Duarte Sacavém, no. 3
1685-562 Caneças
Portugal

Business premises:
Rua Santa Joana, no. 16, rear shop
2675-499 Odivelas
Portugal

Email: ilustrentrega@gmail.com
Telephone: 219 340 991

For the purposes of this Policy, references to “Zé dos Frangos”, “the Company”, “we”, “us” or “our” mean ILUSTRENTREGA, UNIPESSOAL, LDA.

​

2. DATA PROCESSING PRINCIPLES

We process only the personal data that is necessary for the purposes for which it is collected.

We seek to ensure that personal data is:

  • processed lawfully, fairly and transparently;

  • collected for specified purposes;

  • adequate, relevant and limited to what is necessary;

  • kept accurate and up to date where required;

  • retained only for as long as necessary or legally required;

  • protected against unauthorised access, use, alteration or disclosure.

​

3. PERSONAL DATA WE MAY PROCESS

Depending on the service used, we may process the following categories of personal data.

Identification and contact details

  • name;

  • telephone number;

  • email address;

  • delivery address;

  • Portuguese tax identification number (NIF), where requested for invoicing purposes.

Order data

  • products ordered;

  • quantities and selected options;

  • order value;

  • time the order was placed;

  • expected collection or delivery time slot;

  • order status and operational history;

  • delivery instructions;

  • information relating to cancellations, refunds or incidents.

Customer account data

  • account identifiers;

  • email address;

  • history relevant to the operation of the account;

  • Loyalty Credit and related transactions;

  • use of promotions or benefits.

Payment data

Zé dos Frangos does not directly store the full bank card details used for online payments.

Payments are processed by specialist payment service providers.

We may receive and retain information required to manage the transaction, such as:

  • payment confirmation or status;

  • payment method used;

  • transaction reference or identifier;

  • amount paid or refunded;

  • information required to handle disputes or chargebacks.

Technical data

We may process technical information such as:

  • IP address;

  • device and browser type;

  • technical session information;

  • security logs;

  • data associated with cookies or similar technologies.

The use of cookies is explained separately in our Cookie Policy.

​

4. HOW WE COLLECT PERSONAL DATA

Personal data may be collected directly when the data subject:

  • creates an account;

  • places an online order;

  • places a telephone order;

  • requests home delivery;

  • provides invoicing details;

  • contacts Zé dos Frangos by telephone, email, form or another communication channel;

  • submits a complaint;

  • subscribes to marketing communications;

  • participates in a promotion or the Loyalty Programme;

  • uses our website.

We may also receive data required to fulfil an order through platforms or technology providers used by the Customer, such as ordering platforms, logistics operators or payment services.

Where the Customer contracts directly through an external platform, that platform may also act as an independent data controller for its own purposes, in accordance with its own Privacy Policy.

​

5. TELEPHONE ORDERS

To process a telephone order, we may temporarily record:

  • name;

  • telephone number;

  • order details;

  • time the order was placed;

  • expected collection time slot.

The legal basis for this processing is taking the steps requested by the Customer and performing the corresponding contractual relationship.

These operational records are retained for 7 calendar days and are then deleted or anonymised.

This period may be extended where the data is required for:

  • resolving a complaint or incident;

  • investigating fraud or misuse;

  • establishing, exercising or defending legal rights;

  • complying with a legal obligation;

  • cooperating with a competent authority.

This rule does not apply to tax or accounting documents that are subject to their own statutory retention periods.

​

6. ONLINE ORDERS, COLLECTION AND DELIVERY

Personal data provided during an online order is processed in order to:

  • receive and process the order;

  • prepare the products;

  • manage collection or delivery;

  • contact the Customer where necessary;

  • process payment;

  • issue tax documentation;

  • manage cancellations and refunds;

  • resolve issues relating to the order.

The main legal basis for this processing is the performance of the contract entered into with the Customer.

Data required to complete a delivery may be shared with the logistics operator responsible for that delivery, including:

  • name;

  • address;

  • telephone number;

  • information required for delivery;

  • relevant operational information, including, where applicable, the presence of products subject to special delivery requirements, such as alcoholic drinks.

Only the data necessary to perform that function will be shared.

​

7. CUSTOMER ACCOUNT AND LOYALTY PROGRAMME

When a Customer creates an account, we process the data required to manage and operate that account.

As part of the Loyalty Programme, we may process:

  • account identification;

  • eligible orders;

  • Loyalty Credit earned;

  • Loyalty Credit used;

  • transactions and adjustments;

  • use of promotions;

  • information required to detect misuse.

Processing required for the operation of the Loyalty Programme is based on the performance of the contractual relationship with the Customer.

We may also process information strictly necessary to prevent fraud or misuse on the basis of our legitimate interests in protecting the programme, the Company and other customers against fraudulent or improper use.

The artificial creation of multiple accounts, misuse of promotions or other situations described in the Terms and Conditions may be subject to verification.

​

8. FRAUD PREVENTION AND PROTECTION OF THE COMPANY’S RIGHTS

We may process personal data where necessary to:

  • detect or investigate fraud;

  • analyse fictitious orders;

  • prevent misuse of accounts, promotions or Loyalty Credit;

  • investigate chargebacks or payment disputes;

  • document breaches or non-compliance;

  • protect people and property;

  • establish, exercise or defend legal rights in judicial, administrative or out-of-court proceedings.

Depending on the circumstances, this processing is based on compliance with legal obligations or on the Company’s legitimate interests in preventing fraud, protecting its business and establishing, exercising or defending its rights.

Only data that is necessary and proportionate to the circumstances will be retained.

​

9. PAYMENTS

Electronic payments are processed through specialist payment service providers.

Zé dos Frangos does not need to know or retain the full details of the card used by the Customer.

Payment providers may process the data required for:

  • payment authorisation;

  • fraud prevention;

  • authentication;

  • transaction processing;

  • refunds;

  • handling disputes and chargebacks.

These providers may act as processors on behalf of Zé dos Frangos or as independent controllers for certain processing activities required by law or by their own regulatory obligations.

​

10. INVOICING AND TAX OBLIGATIONS

Data required to issue invoices and comply with tax and accounting obligations is processed on the basis of compliance with legal obligations.

This information may include:

  • name or business name;

  • Portuguese tax identification number (NIF);

  • address, where applicable;

  • products or services purchased;

  • amounts and other information required on tax documentation.

Tax-relevant documents and records are retained for the periods required by applicable law.

A request to erase personal data does not allow us to delete documentation that we are legally required to retain.

​

11. COMPLAINTS, ENQUIRIES AND CUSTOMER SUPPORT

When a Customer submits a complaint, request for information or other enquiry, we process the data required to:

  • identify the matter;

  • review the relevant order;

  • respond to the Customer;

  • investigate the issue;

  • make any necessary correction or refund;

  • document the resolution;

  • protect the rights of the parties where a dispute exists.

Depending on the circumstances, the legal basis may be performance of the contractual relationship, compliance with a legal obligation or the Company’s legitimate interests.

Complaints and related documentation will be retained for as long as required to resolve the matter and, afterwards, for as long as necessary to comply with legal obligations or establish, exercise or defend legal rights.

​

12. MARKETING AND NEWSLETTERS

Promotional communications by email are sent where the data subject has provided consent or where another legal basis permits such communications.

Where processing is based on consent, that consent may be withdrawn at any time.

The Customer may unsubscribe:

  • through the unsubscribe option included in the communications themselves; or

  • by contacting Zé dos Frangos.

Withdrawing consent does not affect the lawfulness of communications sent before the withdrawal.

Choosing not to receive marketing does not affect the Customer’s ability to place orders or use our other services.

​

13. CCTV

The establishment uses CCTV systems to protect people and property, as permitted by law and in accordance with the signage displayed on the premises.

CCTV footage is not used for commercial or marketing purposes.

Unless there is a legal basis for longer retention, footage is kept for the period permitted by applicable law and is then deleted.

Where footage is relevant to an incident, investigation or criminal proceedings, the necessary images may be preserved and made available to the competent authorities in accordance with the law.

Access to CCTV footage is restricted to persons or entities legally authorised to view it.

​

14. SUPPLIERS AND PROFESSIONAL CONTACTS

We may process identification and contact data relating to suppliers, representatives, technicians and other professional contacts for:

  • managing the business relationship;

  • performing contracts;

  • invoicing and accounting;

  • technical support;

  • operational communications;

  • establishing, exercising or defending legal rights.

Data will be retained for the duration of the contractual relationship and afterwards for the periods necessary to comply with legal obligations or defend legal rights.

​

15. WHO WE MAY SHARE PERSONAL DATA WITH

Personal data may be shared, strictly to the extent necessary, with entities that provide services to Zé dos Frangos, including:

  • ordering platforms;

  • website hosting and management providers;

  • payment service providers;

  • logistics operators and delivery drivers;

  • invoicing and POS system providers;

  • IT service providers;

  • email and communications services;

  • accountants, auditors or consultants;

  • banks;

  • public, judicial, police, tax or regulatory authorities where required by law.

Whenever an entity processes personal data on behalf of Zé dos Frangos, we seek to ensure that the processing is carried out under appropriate instructions and in accordance with the applicable data protection requirements.

​

16. INTERNATIONAL DATA TRANSFERS

Some technology providers used by Zé dos Frangos may operate or store information outside the European Economic Area.

Where an international transfer of personal data requires additional safeguards, the mechanisms provided for by law will be used, including:

  • adequacy decisions adopted by the European Commission;

  • Standard Contractual Clauses;

  • or another valid mechanism provided for under the GDPR.

  • ​

17. RETENTION PERIODS

We do not apply a single retention period to all personal data.

Data is retained according to its purpose.

In particular:

  • operational telephone-order records: 7 days, unless further retention is required;

  • tax and accounting records: for the statutory period, currently 10 subsequent calendar years;

  • CCTV footage: generally 30 days, followed by deletion in accordance with applicable law, unless preservation is legally justified;

  • marketing data: until consent is withdrawn or the legal basis for processing otherwise ends;

  • complaints, fraud and disputes: for the period required to resolve the matter and subsequently to establish, exercise or defend legal rights;

  • customer account and Loyalty Programme data: while the account or corresponding relationship remains active and afterwards for the period required to comply with legal obligations, prevent misuse or defend legal rights.

When there is no longer a lawful basis for retaining identifiable personal data, it will be deleted or anonymised.

​

18. ACCOUNT DELETION

The Customer may request the closure or deletion of their account.

Closing an account does not necessarily result in the immediate deletion of all personal data associated with it.

We may retain certain information where this is necessary to:

  • comply with tax or accounting obligations;

  • resolve outstanding orders;

  • prevent or investigate fraud;

  • respond to complaints;

  • establish, exercise or defend legal rights;

  • comply with another legal obligation.

Data for which there is no longer a lawful basis for retention will be deleted or anonymised.

Deleting the account may result in the loss of associated features and benefits, including Loyalty Credit, in accordance with the applicable terms.

​

19. AUTOMATED DECISION-MAKING AND FRAUD CONTROLS

Our technology systems may carry out automated checks relating to payments, security, use of promotions or the detection of unusual behaviour.

These checks may, for example, result in additional verification being required or in the temporary suspension of a transaction.

Where a solely automated decision produces legal effects or similarly significantly affects the Customer within the meaning of the GDPR, the rights required by law will be provided, including, where applicable, the possibility of human intervention.

​

20. COOKIES AND SIMILAR TECHNOLOGIES

The website uses cookies and similar technologies.

Strictly necessary cookies may be used to enable the website and the features requested by the user to function.

Cookies used for other purposes, such as analytics, personalisation or advertising, will be used in accordance with the user’s choices and applicable law.

For detailed information, please refer to our Cookie Policy and the settings available through the relevant consent manager.

​

21. DATA SUBJECT RIGHTS

Under the GDPR, and where the relevant legal conditions are met, the data subject may exercise the following rights.

Right of access

To obtain confirmation as to whether personal data is being processed and access to that data.

Right to rectification

To request the correction of inaccurate data or the completion of incomplete data.

Right to erasure

To request deletion of personal data where it is no longer necessary or another legal ground for erasure applies.

This right does not apply where continued retention is necessary, including for compliance with a legal obligation or for the establishment, exercise or defence of legal rights.

Right to restriction of processing

To request, in the circumstances provided for by law, that processing be temporarily restricted.

Right to object

To object to processing based on legitimate interests, in accordance with the GDPR.

The data subject may object to direct marketing at any time and without having to provide a reason.

Right to data portability

Where processing is based on consent or a contract and is carried out by automated means, the data subject may request the relevant data in a structured, commonly used and machine-readable format, subject to the applicable legal requirements.

Right to withdraw consent

Where processing depends on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

​

22. HOW TO EXERCISE YOUR RIGHTS

Requests may be sent to:

Email: ilustrentrega@gmail.com

or in writing to:

ILUSTRENTREGA, UNIPESSOAL, LDA.
Largo António Duarte Sacavém, no. 3
1685-562 Caneças
Portugal

We may request additional information strictly necessary to confirm the identity of the person making the request and to prevent personal data from being disclosed to third parties.

Requests will be answered within the applicable statutory period, generally within 30 days of receipt, except where the law allows that period to be extended.

Where a request cannot be fulfilled in full or in part, the reasons will be provided.

​

23. COMPLAINTS TO THE SUPERVISORY AUTHORITY

The data subject has the right to lodge a complaint with the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados — CNPD
(Portuguese Data Protection Authority)

Av. D. Carlos I, 134, 1st floor
1200-651 Lisboa
Portugal

Up-to-date contact details and information are available on the official CNPD website.

Lodging a complaint with the CNPD does not prevent the data subject from contacting Zé dos Frangos first in an attempt to resolve the matter.

​

24. SECURITY

We use technical and organisational measures appropriate to the nature of the personal data processed and the associated risks, with the aim of preventing:

  • unauthorised access;

  • loss;

  • destruction;

  • improper alteration;

  • unauthorised disclosure;

  • misuse.

No IT system can guarantee zero risk, but we seek to restrict access to personal data to the persons and entities that need it to perform their respective functions.

​

25. CHANGES TO THIS PRIVACY POLICY

This Policy may be updated where relevant legal, technological or operational changes occur.

The updated version will be published on this page together with its effective date.

Where a change has a material impact on processing based on consent, new consent will be requested where legally required.

bottom of page