Privacy Policy
Last updated: 13 July 2026 · Version 1.1
This Privacy Policy explains how Com Tradições Lda, a company incorporated in Portugal with tax identification number (NIF) 503797430 ("Lojini", "we", "us", or "our"), collects, uses, and protects personal data when you use the Lojini platform, websites, and related services (the "Service"). It is provided in accordance with the EU General Data Protection Regulation (GDPR) and applicable Portuguese data protection law.
This policy covers personal data we process about Merchants (people who register to create and operate a store on Lojini) and visitors to our own websites. It does not govern how Merchants handle the personal data of their own customers; in that context the Merchant is the controller and Lojini acts as a processor, as described in our Data Processing Agreement.
1. Who is the data controller
For the personal data described in this policy, the controller is Com Tradições Lda (NIF 503797430), with registered office at Rua do Cruzeiro 39 B, 1300-162 Lisboa. You can contact us about privacy matters at [email protected].
Our Data Protection Officer is João Diogo Pinto (NIF 250089955), who can be contacted using the details above.
2. What personal data we collect
We collect the following categories of personal data:
- Account and identity data — name, email address, password (stored in hashed form), and, where applicable, business name, billing address, VAT/NIF, and phone number.
- Subscription and billing data — your chosen plan, billing history, and payment status. Card details are handled by our payment provider; we do not store full card numbers.
- Usage and technical data — log data, IP address, device and browser type, pages viewed, and actions taken within the dashboard, collected to operate and improve the Service.
- Usage analytics (with your consent) — pseudonymous first-party events such as pages viewed, products viewed, cart and checkout steps, and errors, linked to random device and session identifiers (and to your account when you are signed in). Collected only after you accept analytics in the cookie banner, kept for up to 13 months, and never shared with third parties.
- Communications — messages you send to our support team and your contact preferences.
- Cookies and similar technologies — as described in our Cookie Policy.
3. How and why we use your data (legal bases)
Under the GDPR we must have a legal basis for each purpose for which we process your personal data. The table below summarises these:
| Purpose | Legal basis |
|---|---|
| Creating and managing your account and providing the Service | Performance of a contract |
| Processing subscription payments and managing billing | Performance of a contract; legal obligation (accounting/tax) |
| Providing customer support and responding to your requests | Performance of a contract; legitimate interests |
| Operating, securing, and improving the Service | Legitimate interests in running a safe, reliable platform |
| Sending service and administrative messages | Performance of a contract; legitimate interests |
| Sending marketing communications | Consent (which you may withdraw at any time) |
| Measuring how the Service is used (first-party usage analytics) | Consent (which you may withdraw at any time) |
| Complying with legal, tax, and regulatory obligations | Legal obligation |
| Establishing, exercising, or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You may object to such processing as described below.
4. Marketing communications
We will only send you marketing emails where you have consented or where otherwise permitted by law. You can opt out at any time by using the unsubscribe link in any marketing email or by contacting us. Opting out of marketing does not stop essential service messages, such as billing notices or important changes to the Service.
5. Who we share your data with
We do not sell your personal data. We share it only as necessary, with:
- Service providers (processors) who help us run the Service, such as cloud hosting, payment processing, email delivery, and analytics providers. These act on our instructions under data processing agreements.
- Professional advisers, such as accountants and lawyers, where necessary.
- Authorities or third parties where required by law, to enforce our terms, or to protect our rights, users, or the public.
- A successor entity in the event of a merger, acquisition, or sale of assets, subject to this policy.
6. International transfers
We aim to keep personal data within the European Economic Area (EEA). Where a provider processes data outside the EEA, we ensure an appropriate safeguard is in place, such as a European Commission adequacy decision or Standard Contractual Clauses. You may request more information about these safeguards using the contact details above.
7. How long we keep your data
We keep personal data only as long as necessary for the purposes described in this policy. Account data is retained for the life of your account and for a reasonable period afterwards. Billing and tax records are kept for the period required by Portuguese law. Where data is no longer needed, we delete or anonymise it.
8. How we protect your data
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including encryption in transit, access controls, and regular review of our security practices. No system is completely secure, and we cannot guarantee absolute security, but we work to protect your data and to notify you and the relevant authority of a breach where the law requires.
9. Your rights
Subject to conditions in the GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent; and
- lodge a complaint with a supervisory authority.
To exercise any of these rights, contact us using the details above. In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD); if you are in another EU country, you may contact your local authority.
10. Cookies
We use cookies and similar technologies as described in our Cookie Policy, which forms part of this Privacy Policy.
11. Children
The Service is intended for businesses and adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or through the Service before they take effect. The "last updated" date at the top shows when this policy was last revised.
13. Contact
For any questions about this policy or your personal data, contact Com Tradições Lda (NIF 503797430) at [email protected] or at our registered office, Rua do Cruzeiro 39 B, 1300-162 Lisboa.