Privacy Policy
1. Introduction
This Privacy Policy explains how personal information is collected, used, disclosed, stored, and protected when you visit brakenso.com, place an order, make a payment, contact customer service, request a return or refund, or otherwise interact with our website and services.
We process personal information in accordance with applicable data protection and privacy laws. Where the General Data Protection Regulation (EU) 2016/679 (“GDPR”) applies, personal information is processed only where an appropriate legal basis exists.
2. Data Controller
brakenso.com is operated by LARA ALVES. For most personal information processed in connection with the operation of this online store, LARA ALVES acts as the data controller and determines the purposes and means of processing.
The data controller may be contacted through contact@brakenso.com, +351 211 919 176, or at Praça Marquês de Pombal, No. 13, 6th Floor, 1250-162 Lisbon, Portugal.
Certain third-party service providers, including payment providers, may act as independent data controllers for information they process under their own legal obligations and privacy practices.
3. Personal Information We Collect
Depending on how you interact with our website, we may collect your name, billing address, shipping address, email address, telephone number, order number, purchased products, order value, shipping information, account information where applicable, customer service communications, return and refund information, and other information you voluntarily provide to us.
We may also automatically receive technical information such as IP address, browser type, device information, operating system, referring pages, approximate location derived from technical information, website activity, session information, security logs, and cookie or similar technology identifiers where permitted by applicable law.
4. Information Received from Third Parties
We may receive limited information from service providers involved in your transaction or use of the website. This may include payment confirmation from payment providers, shipment and delivery status from carriers, fraud or security signals, technical information from hosting or security providers, and analytics information where the required consent has been obtained.
We do not require third-party providers to send us more personal information than is reasonably necessary for the relevant service.
5. Purposes and Legal Bases for Processing
Where the GDPR applies, we rely on one or more of the following legal bases depending on the purpose of the processing:
| Legal Basis | Typical Purposes |
|---|---|
| Performance of a Contract | Processing orders, confirming payments, arranging delivery, communicating about an order, handling returns, and issuing refunds. |
| Legal Obligation | Maintaining records required for accounting, taxation, regulatory compliance, lawful requests, and other obligations imposed by applicable law. |
| Legitimate Interests | Preventing fraud, protecting website security, maintaining service reliability, responding to customer requests, protecting legal rights, and improving business operations where these interests are not overridden by your rights and freedoms. |
| Consent | Certain marketing communications and the use of analytics, advertising, or other non-essential cookies and similar technologies where consent is required. |
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
6. Orders, Shipping, Returns, and Customer Service
We use information such as your name, contact details, shipping address, order information, and communication history to accept and process orders, arrange fulfillment and delivery, provide tracking information, respond to customer requests, investigate delivery problems, handle returns, and process refunds.
Where necessary to fulfill your order, relevant information may be shared with warehouses, fulfillment providers, postal services, logistics companies, and delivery carriers.
7. Payment Information
Payments may be processed through third-party payment providers such as Stripe and PayPal. Payment information submitted through their payment interfaces is processed by the applicable provider according to its own privacy and security practices.
We do not store customers’ full credit or debit card numbers, CVV security codes, PayPal passwords, or complete payment authentication credentials on our website.
We may receive limited transaction information such as payment status, transaction reference, payment method category, billing confirmation, refund status, and information reasonably necessary to investigate suspected fraud, payment errors, refunds, or transaction disputes.
8. How We Share Personal Information
We may disclose personal information to service providers where reasonably necessary to operate the website and provide our services. Categories of recipients may include payment processors, banks and payment networks, fulfillment providers, shipping carriers, hosting providers, website security providers, email service providers, professional advisers, customer service providers, analytics providers, and other technical service providers.
Personal information may also be disclosed where reasonably necessary to comply with applicable law, respond to a lawful request from a court or public authority, investigate fraud or security incidents, establish or defend legal claims, or protect the rights, property, and security of customers, the website, or other persons.
Depending on the nature of the service, a third-party provider may act as our processor or as an independent controller subject to its own privacy obligations.
9. Fraud Prevention and Website Security
We may process appropriate order, transaction, account, device, network, and security information to identify suspicious activity, prevent unauthorized transactions, protect customer accounts, maintain website security, and investigate suspected fraud or abuse.
Where necessary, relevant information may be provided to payment processors, financial institutions, security providers, or competent authorities for these purposes. We do not collect or retain information solely for the purpose of creating unnecessary payment dispute records.
10. Customer Communications
When you contact us through contact@brakenso.com, +351 211 919 176, or website forms, we may retain the information contained in your communication together with relevant order information so that we can respond to your request and maintain an appropriate record of customer service activity.
If your inquiry relates to a damaged, defective, missing, or incorrect product, we may also process photographs of the product, packaging, shipping label or waybill, and other evidence that you voluntarily provide.
11. Cookies and Similar Technologies
Our website uses cookies and similar technologies to operate essential website functions, maintain shopping sessions, remember certain preferences, protect checkout processes, understand website performance, and, where enabled and permitted, measure advertising or marketing activity.
Cookies are small pieces of information stored on or accessed from your browser or device. Some cookies exist only for the duration of your browsing session, while others may remain for a defined period so that the website or an authorized service provider can recognize your browser on a later visit.
| Cookie Category | Purpose | Consent |
|---|---|---|
| Strictly Necessary Cookies | Support essential functions such as shopping carts, checkout sessions, authentication, security, fraud prevention, load balancing, and other services specifically requested by the user. | Generally do not require consent where they meet the applicable legal exemption for strictly necessary technologies. |
| Functional or Preference Cookies | Remember certain choices or preferences and provide enhanced website functionality. | Used with consent where required by applicable law. |
| Analytics Cookies | Help us understand website traffic, page performance, navigation patterns, and how visitors interact with website functions. | Activated only after consent where prior consent is required. |
| Advertising or Marketing Cookies | May be used to measure advertising effectiveness, attribute visits or purchases to campaigns, limit repeated advertisements, or support interest-based advertising where such services are enabled. | Activated only after consent where required by applicable law. |
Where prior consent is legally required, non-essential cookies and similar tracking technologies will not be activated solely because you visit the website. You will be given an opportunity to make a choice before the relevant technologies are used.
Cookie preference controls may allow you to Accept All, Reject Non-Essential, or Manage Preferences. You may change or withdraw your consent through the available cookie preference controls. Withdrawing consent does not affect processing that lawfully occurred before the withdrawal.
Rejecting non-essential cookies does not prevent the use of cookies that are strictly necessary for services you specifically request, such as maintaining a shopping cart, protecting checkout security, or maintaining a user session.
Some cookies may be placed by third-party providers whose services are integrated into the website. These providers may receive information such as cookie identifiers, device information, IP address, browser information, page activity, or transaction-related events depending on the service being used and the permissions you have provided.
The lifespan of cookies varies according to their purpose. Session cookies normally expire when the browser session ends, while persistent cookies remain until their specified expiration date, until you delete them, or until consent is withdrawn where applicable.
You can also control or delete cookies through your browser settings. Blocking certain cookies may affect some website functions. Browser controls are separate from any consent preferences provided directly through our website.
12. Marketing Communications
Where we send promotional or marketing communications that require consent, we will do so only after obtaining the required permission. You may withdraw consent or unsubscribe from marketing communications at any time using the unsubscribe method provided in the communication or by contacting us at contact@brakenso.com.
Transactional communications necessary to process an order, provide customer service, communicate important service information, or fulfill a contract are not treated as optional marketing communications.
13. Data Security
We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, misuse, or destruction.
Depending on the relevant system, these measures may include HTTPS and SSL/TLS encrypted transmission, access restrictions, account authentication, administrative access controls, secure payment integrations, system and plugin maintenance, security monitoring, data minimization, and limiting access to information according to operational need.
No method of electronic transmission or storage is completely secure. Although we take reasonable measures to protect personal information, absolute security cannot be guaranteed.
14. Data Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for any additional period required to comply with accounting, tax, regulatory, contractual, fraud-prevention, dispute-resolution, or legal obligations.
| Type of Information | General Retention Approach |
|---|---|
| Order, transaction, accounting, and tax records | Retained for the period reasonably necessary to fulfill the transaction and any period required by applicable accounting, taxation, or other legal obligations. |
| Shipping, return, refund, and customer service records | Retained while the relevant request or transaction is active and afterward where reasonably necessary for customer service, legal claims, compliance, or dispute resolution. |
| Fraud prevention and security records | Retained for as long as reasonably necessary to investigate incidents, protect the website and customers, prevent recurring fraud, and meet applicable legal obligations. |
| Marketing information | Retained until consent is withdrawn, you object where applicable, the information is no longer required for the stated purpose, or retention is otherwise required by law. |
| Cookie and similar technology information | Retained according to the relevant cookie lifespan, consent preference, service configuration, and applicable legal requirements. |
When personal information is no longer reasonably necessary and no legal basis requires continued retention, it may be deleted, anonymized, or securely removed from active systems in accordance with our data management procedures.
15. International Data Transfers
Some service providers involved in payments, hosting, analytics, security, customer communication, fulfillment, or other website operations may process personal information in countries outside the country in which you reside.
Where personal information protected by the GDPR is transferred outside the European Economic Area and the destination does not benefit from an applicable adequacy decision, we will rely on an appropriate transfer mechanism or other safeguard required by applicable data protection law where necessary.
16. Your Data Protection Rights
Where the GDPR applies, you may have the right to request access to personal information concerning you, request correction of inaccurate information, request deletion in applicable circumstances, request restriction of processing, obtain certain information in a portable format, and object to certain processing based on legitimate interests.
Where processing is based on consent, you may withdraw consent at any time. Where personal information is used for direct marketing, you may object to that processing in accordance with applicable law.
Some rights are subject to legal exceptions. For example, we may be required to retain certain transaction or accounting records even after receiving a deletion request where retention is required by law.
To exercise an applicable privacy right, please contact us at contact@brakenso.com. We may request reasonable information to verify your identity and protect personal information against unauthorized disclosure.
You may also have the right to lodge a complaint with the competent data protection supervisory authority. Where appropriate, this may include Portugal’s Comissão Nacional de Proteção de Dados (CNPD).
17. Privacy Rights in Other Jurisdictions
Depending on your place of residence, applicable privacy laws may provide additional rights concerning access, correction, deletion, portability, restriction, consent, objection, or the use and disclosure of personal information. We will review valid privacy requests according to the law applicable to the individual making the request.
18. Children’s Privacy
Our website is intended for individuals who are legally able to enter into online purchase transactions. We do not knowingly seek to collect personal information from children in circumstances where parental or guardian authorization is legally required. If we become aware that personal information has been collected contrary to applicable law, we will take reasonable steps to address the matter.
19. Changes to This Privacy Policy
We may update this Privacy Policy when reasonably necessary to reflect changes in our website, services, service providers, data processing activities, security practices, or applicable legal requirements. The current version will be published on this page.
If you have questions about this Privacy Policy or how personal information is handled through brakenso.com, please contact the data controller through contact@brakenso.com.