Privacy policy

PRIVACY POLICY

This Privacy Policy explains how ASMA BEAUTY CARE COSMETICS Lda, (“ASMA Beauty Cosmetics”, “we”, “us”, or “our”) collects and processes personal data when you visit our website and purchase products online.

Asma Beauty Care Cosmetics Lda is a company incorporated in Portugal with registered office at Rua Carlos da Mota Pinto, nº 17, 3º A, 1070-313 Lisboa, Portugal, NIPC 516369032.

By using our website and services, you acknowledge that you have read this Privacy Policy.

1. DATA CONTROLLER AND CONTACT

ASMA BEAUTY COSMETICS, NIPC 516369032, Rua Carlos da Mota Pinto, nº17, 3º A, 1070-313 Lisboa, Portugal. For privacy matters, please contact our data protection contact using the contact details provided on our website or by post to our registered office, addressed “Data Protection”.

2. APPLICABLE LAW

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), Law no. 58/2019 (Portuguese Data Protection Law), and Law no. 41/2004 (as amended) on electronic communications and privacy.

3. CATEGORIES OF PERSONAL DATA

We may process:

• Identification and contact data (name, email, phone number, billing and shipping address, tax number where provided on invoices).

• Account data (username, password, order history, preferences).

• Transaction and payment data (order details, payment method, payment confirmation; we do not store full card details when processed by certified payment providers).

• Technical data (IP address, device and browser type, cookies, usage data, log data).

• Communications data (customer service requests, complaints, messages).

• Marketing preferences and consent records.

4. PURPOSES AND LEGAL BASES OF PROCESSING

We process personal data for the following purposes and legal bases:

• Performance of a contract or pre-contractual steps: to register your account, process and deliver orders, provide customer support, manage returns and refunds, and provide warranty assistance.

• Compliance with legal obligations: invoicing and tax obligations; consumer protection and guarantee obligations; responses via the electronic complaints book and ADR/ODR frameworks; product safety obligations.

• Legitimate interests: to improve our website, prevent fraud and abuse, ensure network and information security, and maintain records of interactions. We balance these interests against your rights and freedoms.

• Consent: to send marketing communications by email/SMS and to place non-essential cookies or similar technologies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. COOKIES AND SIMILAR TECHNOLOGIES

We use necessary cookies for site functionality and optional analytics/marketing cookies with your consent.

You can manage cookie preferences through our cookie banner or your browser settings. For further details, please consult our cookie information available on our website.

6. RECIPIENTS AND INTERNATIONAL TRANSFERS

We may share personal data with:

• Payment service providers and banks for payment processing.

• Logistics and courier partners for order delivery and returns.

• IT and hosting providers, website analytics and security providers.

• Professional advisers and auditors, where necessary.

• Public authorities where required by law or to protect our rights.

Where service providers are located outside the EEA, we ensure appropriate safeguards for international transfers (e.g., adequacy decisions or Standard Contractual Clauses), and implement supplementary measures as needed.

7. RETENTION PERIODS

We retain personal data only for as long as necessary for the purposes collected, and to comply with applicable legal obligations. Typical retention includes:

• Customer account data: for the lifetime of the account and a reasonable period thereafter for recordkeeping and legal claims.

• Order and invoicing data: retained in accordance with Portuguese tax and commercial law retention periods.

• Customer service records: retained for the limitation periods applicable to consumer law claims.

• Marketing data: until you withdraw consent or object to processing.

8. YOUR RIGHTS

Under the GDPR and Portuguese law, you may:

1. Request access to your personal data.

2. Request rectification of inaccurate data.

3. Request erasure where applicable (e.g., when data are no longer necessary or processing is based on withdrawn consent).

4. Request restriction of processing in certain cases.

5. Object to processing based on legitimate interests, including profiling, and object to direct marketing.

6. Data portability, when processing is based on consent or contract and carried out by automated means.

7. Withdraw consent at any time for consent-based processing.

8. Lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD).

To exercise your rights, contact us using the details above and provide sufficient information to verify your identity.

9. Security

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Despite these measures, no online transmission or storage system is completely secure.

10. MINORS

Our website is not intended for children under 18 years of age. We do not knowingly collect personal data from children under 18. If you believe a child has provided us personal data, please contact us to delete it.

11. CHANGES TO THIS POLICY

We may update this policy to reflect legal or operational changes. Changes will be posted on our website with an updated “Last updated” date. Material changes may be notified by appropriate means.

Last updated: 15 January 2026