Privacy policy
Last updated: 6 August 2026
1. Data Controller
Eliza Grosu Unipessoal Lda | Brand: EELLA Concept
Rua de Parque Norte 23, RC04, 4700-103 Braga, Portugal
NIPC: 518778991 | geral@eellaconcept.com | +351 917 787 800
2. Personal Data Collected
- Identification data: name, email, phone number
- Billing and delivery data: address, country, postal code
- Browsing data: IP address, browser type, pages visited, interactions with the site
- Transaction data: purchase history, payment method (we do not store card details)
- Communication data: messages exchanged with our customer support
3. Purpose and Legal Basis for Processing
| Purpose | Legal Basis (GDPR) |
|---|---|
| Order and customer management | Art. 6(1)(b) — performance of a contract |
| Compliance with legal and tax obligations | Art. 6(1)(c) — legal obligation |
| Marketing communications | Art. 6(1)(a) — consent |
| Analytics and performance cookies | Art. 6(1)(a) — consent |
| Advertising and remarketing cookies | Art. 6(1)(a) — consent |
| Fraud prevention and security | Art. 6(1)(f) — legitimate interest |
4. Sub-processors and Third Parties
To operate our website and marketing campaigns, we share data with the following sub-processors, all under data processing agreements (DPA):
4.1 E-commerce Platform
Shopify International Ltd (Ireland) — online store platform, payment processing and order management.
4.2 Google (Analytics and Advertising)
Google LLC (USA) / Google Ireland Ltd (Ireland) — we use Google Analytics 4, Google Ads, YouTube and Google Merchant Center. Data may be transferred to the USA under Standard Contractual Clauses (SCCs). Google Privacy Policy
4.3 Meta — Facebook & Instagram
Meta Platforms Ireland Ltd (Ireland) — we use the Meta Pixel for conversion tracking, Custom Audiences and remarketing. Data may be transferred to the USA under SCCs. Users can manage their preferences at facebook.com/ads/preferences. Meta Privacy Policy
4.4 Pinterest
Pinterest Europe Ltd (Ireland) — we use the Pinterest Tag for conversion tracking, remarketing and behavioural analysis. Data may be transferred to the USA under SCCs. Users can manage their preferences at pinterest.com/settings/privacy. Pinterest Privacy Policy
4.5 Email Marketing and Messaging
Shopify International Ltd (Ireland) — we use Shopify Email and Shopify Messages for marketing communications and customer support. Data is processed by Shopify under their privacy policy and the DPA in place with EELLA Concept.
4.6 Logistics and Shipping
Shiptimize (Portugal) — shipping management platform used to generate shipping labels and coordinate deliveries with CTT and DHL. Delivery data (name, address, contact) is shared for fulfilment purposes.
4.7 Invoicing
Weoinvoice — invoicing software used for issuing invoices and tax documents. Billing data (name, address, tax ID where applicable) is processed to comply with legal and tax obligations.
4.8 Carriers
CTT — Correios de Portugal (domestic shipments) | DHL Express (international shipments)
5. International Data Transfers
Data transfers to the USA (Google, Meta, Pinterest) are carried out under Standard Contractual Clauses (SCCs) approved by the European Commission, pursuant to Art. 46 GDPR, ensuring an equivalent level of protection to that required within the European Union.
6. Data Retention
- Customer and order data: 10 years (legal and tax obligations)
- Marketing data: until unsubscription or deletion request
- Browsing data and cookies: as per the retention periods in the cookies section below
7. Cookies
7.1 What are cookies
Cookies are small text files stored on your device when you visit our website. They allow us to recognise your browser and improve your browsing experience.
7.2 Essential Cookies (no consent required)
| Cookie | Origin | Duration | Purpose |
|---|---|---|---|
| _shopify_y | Shopify | 1 year | Visitor identification |
| _shopify_s | Shopify | 30 min | Browsing session |
| cart | Shopify | 2 weeks | Shopping cart |
| secure_customer_sig | Shopify | 20 years | Customer authentication |
7.3 Analytics Cookies (consent required)
| Cookie | Origin | Duration | Purpose |
|---|---|---|---|
| _ga | Google Analytics | 2 years | User identification |
| _ga_* | Google Analytics | 2 years | GA4 session state |
| _gid | Google Analytics | 24 hours | User identification |
7.4 Marketing Cookies (consent required)
| Cookie | Origin | Duration | Purpose |
|---|---|---|---|
| _fbp | Meta (Facebook) | 3 months | Advertising identification |
| _fbc | Meta (Facebook) | 2 years | Ad click tracking |
| _pinterest_ct_ua | 1 year | Advertising identification | |
| _pinterest_sess | 1 year | Pinterest session | |
| _gcl_au | Google Ads | 3 months | Google Ads conversions |
| IDE | Google (DoubleClick) | 13 months | Personalised advertising |
7.5 Consent Management
When you first access our website, a cookie notice is displayed where you can accept or decline each category. You can change your preferences at any time via the Manage Cookies link in the footer.
8. Data Subject Rights
Under the GDPR (Regulation (EU) 2016/679), you have the following rights:
- Right of access — obtain confirmation of whether your data is being processed and access it
- Right to rectification — correct inaccurate or incomplete data
- Right to erasure — request deletion of your data ("right to be forgotten")
- Right to restriction of processing — restrict processing in certain circumstances
- Right to object — object to processing based on legitimate interest or for direct marketing purposes
- Right to data portability — receive your data in a structured, machine-readable format
- Right to withdraw consent — at any time, without affecting the lawfulness of prior processing
- Right to lodge a complaint — with the Comissão Nacional de Proteção de Dados (CNPD) at www.cnpd.pt
To exercise any of these rights: geral@eellaconcept.com (response within 30 days)
9. Data Security
EELLA Concept adopts appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration. Our website uses SSL/TLS encryption for all communications.
10. Marketing Communications
You may unsubscribe at any time via the unsubscribe link in any of our emails, or by contacting us at geral@eellaconcept.com.
11. Minors
Our website is not directed at individuals under the age of 16 and we do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact us so we can proceed with its deletion.
12. Changes to this Policy
EELLA Concept reserves the right to update this Privacy Policy. In the event of significant changes, we will notify users via the website or by email. The date of the last update is indicated at the top of this document.
13. Contact
EELLA Concept — Eliza Grosu Unipessoal Lda
geral@eellaconcept.com | +351 917 787 800
Rua de Parque Norte 23, RC04, 4700-103 Braga, Portugal