Privacy Policy

This Privacy Policy explains how Alma Mater — Estúdio Têxtil (an online shop operated by Regenerativa Cooperativa Integral, C.R.L.) collects, uses, retains and protects your personal data when you visit or make a purchase on this website. Personal data is processed in accordance with Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR) — and with Lei n.º 58/2019, de 8 de agosto (the Portuguese law implementing the GDPR).

Last updated: 2026-07-29.

1. Data controller

The controller of your personal data is:

Controller: Regenerativa Cooperativa Integral, C.R.L. (sales of the «Alma Mater — Estúdio Têxtil» brand, by Andreia Henriques, are carried out through the cooperative)
NIPC (Portuguese corporate tax number): 516912020
Registered office: Espaço Nativa – Garatuja, 7630-445 São Luís, Odemira, Portugal
E-mail: geral@regenerativa.pt

For any question relating to the protection of your personal data or to this Policy, you can contact us using the details above. No Data Protection Officer (DPO) has been appointed, as this is not required given the size and nature of the activity.

2. What personal data we collect

Depending on how you interact with us, we may collect the following data:

Order and invoicing data: name, billing and shipping address, telephone number, e-mail address, NIF (Portuguese tax number, when you ask for an invoice with a tax number), description of the items purchased and the order value.
Payment data: payments are processed by external providers (see point 5). We do not store your full bank card details; we receive only the payment confirmation and the data necessary to manage the order.
Account data (if you create a customer account): username, e-mail address, password (stored in encrypted form) and order history.
Contact data: the information you provide when contacting us (by WhatsApp, telephone or e-mail) or requesting a quote for bespoke pieces (for example, measurements, preferences and the messages you send us).
Browsing data: IP address, device and browser type, pages visited and data collected through cookies and similar technologies (see point 6).

The fields marked as mandatory in the forms are those that are indispensable in order to process the order or to reply to your request. If you do not provide them, we may not be able to complete the purchase or to give you an answer.

3. Purposes and legal basis for processing

We process your data only for specified purposes and on a legal basis provided for in article 6 of the GDPR:

To process and deliver your orders (including bespoke pieces and one-of-a-kind pieces), to manage your customer account and to provide customer support. Basis: performance of a contract — article 6(1)(b).
To comply with legal obligations, in particular tax and accounting obligations (issuing and retaining invoices) and consumer protection obligations. Basis: compliance with a legal obligation — article 6(1)(c).
To respond to contact requests and quote requests that you send us. Basis: steps taken prior to entering into a contract at the data subject’s request, or legitimate interest — article 6(1)(b) and (f).
To send marketing communications (for example, a newsletter), if you subscribe. Basis: consent — article 6(1)(a). You may withdraw your consent at any time, without affecting the lawfulness of processing already carried out.
To ensure the security, operation and improvement of the website and to prevent fraud. Basis: legitimate interest — article 6(1)(f).
To use non-essential cookies and analytics/statistics tools. Basis: consent — article 6(1)(a) (see point 6).

4. Retention periods

We keep your data only for as long as necessary for the purposes above or for the periods required by law:

Invoicing and accounting data: for the legal retention period for tax and accounting documents, currently 10 years, as required by Portuguese tax legislation.
Order and customer support data: for the duration of the contractual relationship and for the period necessary to fulfil the legal guarantee of conformity and to handle any complaints or disputes.
Customer account data: for as long as the account remains active. You may ask for the account to be deleted at any time.
Contact data / quotes not taken forward: for the period necessary to reply and, where applicable, for a reasonable time to allow for any follow-up to the request.
Marketing (newsletter): until you withdraw your consent or unsubscribe.
Cookies: for the periods indicated in the Cookie Policy (see point 6).

Once these periods have elapsed, the data is securely deleted or anonymised.

5. Processors, recipients and transfers

We do not sell your personal data. In order to provide the service, we may share strictly necessary data with providers acting as processors on our behalf, subject to confidentiality and security obligations:

Web hosting and infrastructure: dominios.pt, to keep the site running and to store the data.
Site platform (WordPress / WooCommerce) and its plugins: used to manage the shop, the orders and the customer accounts.
Payment processor: ifthenpay (Multibanco reference, MB WAY and bank card), for the secure processing of payments.
Carrier: CTT (and/or another transport company), for the delivery of orders, receiving the name, the shipping address and the contact details.
Invoicing and accounting software: the certified invoicing programme used by Regenerativa Cooperativa Integral, C.R.L., for issuing invoices and complying with tax obligations.
Public authorities: where required by law (for example, the Autoridade Tributária — the Portuguese tax authority).

Wherever possible, we choose providers that process data within the European Economic Area (EEA). If any provider involves a transfer of data outside the EEA, that transfer will only be made with the appropriate safeguards provided for in the GDPR (for example, an adequacy decision of the European Commission or standard contractual clauses).

6. Cookies

This site uses only strictly necessary cookies for its operation — for example, managing the shopping basket and the session and remembering the chosen language — which do not require consent. We do not currently use analytics, advertising or social media cookies. Should non-essential cookies be introduced, they will only be activated with your prior consent, and this Policy will be updated accordingly. You can also manage or delete cookies in your browser settings.

7. Automated decision-making and profiling

We do not take individual decisions based solely on the automated processing of your data, including profiling, which produce legal effects concerning you or similarly significantly affect you, within the meaning of article 22 of the GDPR.

8. Your rights

As a data subject, the law grants you the following rights:

Access: to know what data of yours we process and to obtain a copy.
Rectification: to correct inaccurate data or complete incomplete data.
Erasure («right to be forgotten»): to ask for your data to be deleted, in the situations provided for by law.
Restriction of processing: to ask for processing to be restricted in certain circumstances.
Portability: to receive the data you have provided to us, in a structured and commonly used format, and to transmit it to another controller.
Objection: to object to processing based on legitimate interest and, at any time, to the processing of your data for direct marketing purposes.
Withdrawal of consent: where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing already carried out.

To exercise these rights, contact us at geral@regenerativa.pt or at the address given in point 1. We may ask you to confirm your identity before acting on the request. We will, as a rule, reply within one month of receiving the request; this period may be extended in particularly complex cases, and you will be informed if that happens.

9. Right to lodge a complaint

If you consider that the processing of your data infringes data protection legislation, you have the right to lodge a complaint with the competent supervisory authority in Portugal:

Comissão Nacional de Proteção de Dados (CNPD — the Portuguese data protection authority)
Address: Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa
Telephone: +351 213 928 400
E-mail: geral@cnpd.pt
Website: www.cnpd.pt

We would be grateful if, before turning to the CNPD, you would give us the chance to resolve the matter by contacting us directly.

10. Consumer complaints and dispute resolution

For matters relating to the purchase (and not specifically to data protection), we would remind you that, as a consumer, you also have the following mechanisms provided for in Portuguese and European Union law:

The electronic Livro de Reclamações (the official Portuguese complaints book), available at www.livroreclamacoes.pt.
The 14-day right of withdrawal (right of free termination) on distance purchases, with no need to give a reason (subject to the legal exceptions, in particular for goods made to measure or clearly personalised — such as our bespoke pieces and one-of-a-kind pieces).
The legal guarantee of conformity on the goods purchased, under the terms of the law.

These matters are set out in more detail in our Terms and Conditions.

11. Security

We adopt appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure or destruction, including an encrypted connection (HTTPS) and access control to the systems.

12. Changes to this Policy

This Policy may be updated to reflect legal changes or changes to our services. The version in force is always the one published on this page, showing the date it was last updated. We recommend that you check it periodically.