Privacy policy
1. Who we are
This Privacy Policy explains how we collect and use your personal data when you visit contrastmatters.com, buy from us online or in our Lisbon stores, or contact us. It is written in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese Law no. 58/2019 of 8 August, which implements the GDPR in Portugal.
The data controller responsible for your personal data is:
- Highcontrast, Lda. (trading as contrast)
- Tax/registration number (NIPC): 515073610
- Registered office: Rua Ivens, n.º 49, 3.º Esq., 1200-226 Lisboa, Portugal
- Email for privacy matters: info@contrast.pt
We have not appointed a Data Protection Officer, as this is not legally required for our activity. Any privacy question or request can be sent to the email above.
By "personal data" we mean any information that identifies you or can reasonably be linked to you. Anonymous or de-identified information is not personal data.
2. Personal data we collect
Depending on how you interact with us, we may collect:
- Contact details: name, billing and shipping address, phone number and email address.
- Order and transaction data: products viewed, added to cart or wishlist, purchased, returned, exchanged or cancelled; order history; invoicing data, including your tax number (NIF) if you ask for it on the invoice.
- Payment data: payment method and payment confirmation. Card details are entered directly with our payment providers and are never stored by us.
- Account data: login email, password (stored encrypted by Shopify), preferences and settings.
- Communications: the content of your emails, contact form messages and customer service requests.
- Marketing preferences: whether you subscribed to our newsletter and how you interact with our emails (e.g. opens and clicks).
- Device and usage data: IP address, browser and device type, pages visited and how you navigate the website, collected through cookies and similar technologies (see section 9).
We collect this data directly from you, automatically when you use the website, and from our service providers (for example, payment and delivery confirmations).
Providing contact, order and payment data is necessary to conclude and deliver your purchase; without it we cannot process your order. All other data is optional.
3. Why we use your data and on what legal basis
Under Article 6 of the GDPR, we only process your personal data when we have a legal basis to do so:
|
Purpose |
Legal basis (GDPR) |
|---|---|
|
Processing and delivering your order, payments, returns and exchanges; managing your account |
Performance of a contract (Art. 6(1)(b)) |
|
Answering your questions and customer service requests |
Performance of a contract, or our legitimate interest in replying to you (Art. 6(1)(b) and (f)) |
|
Issuing invoices and keeping accounting and tax records |
Legal obligation (Art. 6(1)(c)) |
|
Sending our newsletter and promotional emails or SMS |
Your consent (Art. 6(1)(a)), which you can withdraw at any time |
|
Non-essential cookies, website analytics and personalised advertising |
Your consent (Art. 6(1)(a)), given through our cookie banner |
|
Preventing fraud, keeping the website and payments secure |
Our legitimate interest (Art. 6(1)(f)) |
|
Establishing, exercising or defending legal claims; responding to authorities |
Legal obligation or legitimate interest (Art. 6(1)(c) and (f)) |
Where we rely on legitimate interest, we have balanced it against your rights, and you may object at any time (see section 7).
Automated decisions and profiling. We do not take decisions that produce legal or similarly significant effects on you based solely on automated processing. If you consent to personalised advertising, our advertising partners may use your browsing activity to show you ads that are more relevant to you. You can refuse or withdraw this consent in the cookie settings.
We do not sell your personal data. We only share it with the following recipients, and only to the extent needed:
- E-commerce platform: Shopify, which hosts our online store and processes data on our behalf.
- Payment providers: Shopify Payments, PayPal, Klarna and other payment methods you choose at checkout. Each processes your payment data under its own terms and privacy policy.
- Delivery partners: DHL, Batch and other carriers, which receive your name, address and phone number to deliver your order.
- Email marketing: MailerLite, which sends our newsletter if you have subscribed.
- Analytics and advertising partners (Google and Meta), only if you have accepted the relevant cookies.
- Professional advisers: our certified accountant and, where necessary, lawyers and auditors.
- Public authorities: the Portuguese Tax Authority and other authorities, when required by law.
Service providers acting on our behalf (processors) may only use your data according to our instructions and under a data processing agreement that complies with Article 28 of the GDPR.
Our relationship with Shopify
Most of the processing described here is carried out by Shopify on our behalf. In addition, Shopify uses some data about your interactions with our store, other merchants and Shopify itself to provide enhanced features. For these features Shopify acts as an independent controller and is responsible for responding to your requests. You can learn more in the Shopify Consumer Privacy Policy and exercise your rights through the Shopify Privacy Portal.
5. International transfers
Some of our service providers, including Shopify, process data outside the European Economic Area (EEA), for example in Canada and the United States. When this happens, we make sure your data is protected by one of the safeguards set out in Chapter V of the GDPR:
- a European Commission adequacy decision (for example, for Canada, or for US companies certified under the EU-US Data Privacy Framework); or
- the European Commission's Standard Contractual Clauses.
You can ask us for more information about these safeguards using the contact details in section 1.
6. How long we keep your data
We keep personal data only for as long as necessary for the purpose it was collected for:
|
Data |
Retention period |
|---|---|
|
Invoices and accounting records |
10 years, as required by Portuguese tax law |
|
Order data |
For as long as needed to deliver the order and handle returns, exchanges and warranty claims (3 years for goods under Portuguese consumer law), then for as long as needed to comply with legal obligations |
|
Customer account |
Until you delete your account or ask us to delete it |
|
Newsletter subscription |
Until you unsubscribe or withdraw your consent |
|
Customer service communications |
Up to 3 years after the matter is closed |
|
Cookies |
For the period indicated in the cookie banner, up to a maximum of 13 months |
When these periods end, we delete or anonymise your data.
7. Your rights
Under Articles 15 to 22 of the GDPR, you have the right to:
- Access: obtain confirmation of whether we process your data and receive a copy of it.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: have your data deleted, unless we are legally required to keep it (for example, invoices).
- Restriction: ask us to limit the processing of your data in certain circumstances.
- Portability: receive the data you gave us in a structured, commonly used format, or have it sent to another controller.
- Object: object at any time to processing based on our legitimate interest, and to direct marketing.
- Withdraw consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can unsubscribe from our emails using the link at the bottom of each one.
- Not be subject to automated decisions that produce legal or similarly significant effects on you.
To exercise any of these rights, email info@contrast.pt. We may need to confirm your identity before acting on your request. We will reply within one month. This may be extended by two further months for complex requests, in which case we will let you know. Exercising your rights is free of charge.
You may appoint someone to make a request on your behalf, provided they show proof that you have authorised them.
Complaints
If you are unhappy with how we handle your personal data, please contact us first and we will try to resolve it. You also have the right to lodge a complaint with a supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt. If you live in another EU country, you can also complain to your local data protection authority.
8. Marketing communications
We only send you our newsletter and promotional emails or SMS if you have given your consent, for example by subscribing on our website or ticking the box at checkout. You can unsubscribe at any time using the link in each email or by contacting us. After you unsubscribe, we may still send you service emails about your orders or account.
We use cookies and similar technologies on our website, in accordance with Portuguese Law no. 41/2004. Strictly necessary cookies (for example, to keep items in your cart and process checkout) are always active. Analytics, personalisation and advertising cookies are only used if you accept them in our cookie banner. You can change your choices at any time through the cookie settings on the website or in your browser.
10. Children
Our website is not intended for children. We do not knowingly collect personal data from anyone under 13 years old, the age of digital consent in Portugal under Law no. 58/2019. If you are a parent or guardian and believe your child has given us personal data, please contact us and we will delete it.
11. Security
We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. Our website uses SSL/TLS encryption, and payment card data is handled only by certified payment providers. No system is completely secure, so please avoid sending sensitive information through unsecured channels. If you have an account, keep your password confidential.
12. Third-party websites
Our website may link to other websites and social networks, such as Instagram. We are not responsible for their privacy practices; please read their own policies. Information you share publicly on social networks may be seen by others.
13. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or in the law. The latest version will always be published on this page, with the date of the last update below. If the changes are significant, we will let you know by appropriate means.
14. Contact
For any question about this policy or your personal data, contact Highcontrast, Lda. at info@contrast.pt or by post at Rua Ivens, n.º 49, 3.º Esq., 1200-226 Lisboa, Portugal.
Last updated: 30 September 2026
