Privacy

Controller

Hazel Tree Consulting, Unipessoal Lda, tax number 518072401, Rua Gonçalo Cristóvão 128, 9.º Esquerdo, 4000-408 Porto, Portugal. Contact: the contact form.

What we collect and why

• Orders: your name, e-mail address, delivery address, the objects ordered and payment status. Needed to perform the contract (Article 6(1)(b) of the General Data Protection Regulation) and to meet accounting and tax obligations (Article 6(1)(c)). Kept for ten years after the order, as Portuguese tax law requires; the delivery address is passed to the museum or carrier that ships the object.
• Messages: what you write through the contact form and our replies, with your e-mail address. Legitimate interest in answering you (Article 6(1)(f)); kept for two years.
• Newsletter: if you subscribe and confirm by e-mail, your e-mail address and language, with the time you asked and confirmed. Your consent (Article 6(1)(a)); kept until you unsubscribe through the link in every issue.
• Payments: card payments are processed by Stripe Payments Europe, Limited (Dublin, Ireland); your card details go directly to Stripe and never reach us. We keep the payment status and method, and for bank transfers the sender name and reference.
• Visits: pages viewed, searches, adds to basket and referring site, recorded against a hash of your address and browser that changes every day and cannot be traced back to you. This first-party record sets no cookies. Legitimate interest in understanding what visitors look for; kept for thirteen months.
• Google Analytics: we use Google Analytics, provided by Google Ireland Limited (Dublin, Ireland), to measure which pages and objects are viewed, searches, the basket and checkout steps, and orders, with the order number and amounts but never your name, e-mail or address. In the European Economic Area, the United Kingdom and Switzerland its cookies (_ga and _ga_VD2MW87SQW, kept up to two years) are set only after you accept in the cookie banner; before that, or if you decline, Google receives only cookieless signals without any identifier. Elsewhere the cookies are set unless you decline. Advertising and personalisation are switched off, Google signals are off, and the collected data are kept for fourteen months. Google may process data in the United States under the EU-U.S. Data Privacy Framework. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time under cookie settings.
• Errors: if a page breaks, the error message and page address are recorded, with the browser type, to fix it.
• Your browser's own storage: the basket, saved objects, followed museums and the address you last used are kept in your browser only (local storage), never on our servers until you order. Clear your browser data to remove them.

Who receives data

The museum or its shop that fulfils your shipment (name, address, objects); the carrier; Stripe, our payment provider; our e-mail delivery provider; our hosting provider (Base44, servers in the European Union and the United States under standard contractual clauses); and Google, for Google Analytics as described above. We do not sell or share data for advertising.

Your rights

You may ask for a copy of your data, correct it, have it deleted where we no longer need it, object to processing based on legitimate interest, and receive order data in a portable format. Write through the contact form; we answer within one month. You may complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (cnpd.pt), or the authority of your own country.

Museum partners

People who register a museum account give their name, e-mail address and role; these are used to run the partner desk and are kept while the museum is listed.

When a partner museum connects its shop (Shopify, WooCommerce or its own system through the Museum Edit partner API), Museum Edit sends each paid order there with the buyer's name, delivery address and telephone for the carrier, and reads back only that order's status and tracking, the shop's products, stock and prices. Museum Edit does not read the museum's own customers. The access keys are stored encrypted, used only by Museum Edit's order system, and deleted when the museum disconnects or removes the app; a museum's store data is erased within thirty days of a removal request.

Security

Data are encrypted in transit (TLS 1.2 or higher) and at rest, backups included (AES-256, at our hosting provider). Test runs use test shops and invented data, never real buyers. Only Museum Edit's administrator can see buyers' personal data and shop access keys; every sending and reading of buyers' data to and from museum shops, every export and every connection is recorded in an access log kept for thirteen months. If a personal data breach occurs, we act under a written incident response procedure and notify the Portuguese data protection authority within 72 hours and the people and museums affected without undue delay.