Privacy Policy

Last updated: September 2026

This Privacy Policy explains how Grain by Grain Unipessoal, Lda. collects, uses, stores and protects the personal data of users who visit and use our website and online store, as well as customers who make purchases or contact us.

Grain by Grain is committed to processing personal data in a transparent and secure manner and in accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679), applicable Portuguese legislation and other relevant data protection laws.

By using our website, you acknowledge that you have read this Privacy Policy. Whenever applicable law requires your consent for a specific processing activity, we will request such consent separately and you may withdraw it at any time.


1. DATA CONTROLLER

The controller responsible for the processing of personal data collected through this website is:

Grain by Grain Unipessoal, Lda.
Avenida Visconde Valmor, No. 43, 2nd floor
1050-237 Lisbon
Portugal

VAT number: PT518955524
Email: info@grainbygrain.de

For questions relating to the protection of personal data or to exercise your rights, you may contact us at info@grainbygrain.de or in writing at the postal address above.


2. PERSONAL DATA WE COLLECT

Depending on how you use our website and the services you access, we may collect the following categories of personal data:

Identification and contact information

  • First and last name;
  • Billing address;
  • Shipping address;
  • Telephone number;
  • Email address.

Purchase and transaction information

  • Products purchased;
  • Products added to your cart or wishlist, where applicable;
  • Order history;
  • Returns, exchanges and cancellations;
  • Billing information;
  • Order status and confirmation.

Payment information

Payments made through our online store are processed by specialised payment service providers.

Grain by Grain does not intend to directly collect or store the complete payment card details used to make payments. The information required to process payments is handled by the relevant payment service providers in accordance with their own privacy policies and security measures.

Communication information

We may process information you provide when you:

  • contact us;
  • send us a message;
  • request customer support;
  • submit a complaint;
  • ask a question about our products or services.

Technical and usage information

When you visit our website, certain information may be collected automatically, including:

  • IP address;
  • browser type and version;
  • device used;
  • operating system;
  • pages visited;
  • date and time of access;
  • information about how you use and navigate our website;
  • cookies and similar technologies.

The use of cookies and similar technologies is explained in more detail in our Cookie Policy.


3. HOW WE COLLECT YOUR PERSONAL DATA

Personal data may be collected:

Directly from you, when you:

  • create an account;
  • make a purchase;
  • complete forms;
  • subscribe to our newsletter;
  • contact us;
  • participate in campaigns or promotional activities;
  • leave a review, where this functionality is available.

Automatically, through your use of our website, including through cookies and similar technologies, in accordance with your preferences and applicable law.

Through service providers, who process certain data on our behalf to enable the operation of our online store, payment processing, delivery of orders, customer support, hosting, analytics and other functionalities.

Through third parties or partners, where this is necessary to provide the services requested or where there is a lawful basis for such processing.


4. HOW WE USE YOUR PERSONAL DATA

Your personal data may be used for the following purposes:

Processing and managing orders

We use your personal data to:

  • process and confirm orders;
  • process payments;
  • issue invoices;
  • prepare and ship products;
  • communicate with you regarding your order;
  • process returns, exchanges and refunds;
  • provide customer support.

Legal basis: performance of a contract or taking steps at your request prior to entering into a contract, pursuant to Article 6(1)(b) GDPR.

Compliance with legal obligations

We may process your personal data to comply with legal, tax, accounting or other obligations imposed by law.

Legal basis: compliance with a legal obligation, pursuant to Article 6(1)(c) GDPR.

Website operation and improvement

We may use certain information to ensure the technical operation and security of our website, understand how it is used and improve our products, services and shopping experience.

Legal basis: legitimate interests, pursuant to Article 6(1)(f) GDPR, where applicable.

Where cookies or tracking technologies require consent under applicable law, these will only be used after obtaining the relevant consent.

Communications and customer support

We use your personal data to respond to your questions, requests, complaints and other communications.

Legal basis: performance of a contract, taking steps prior to entering into a contract, or legitimate interests, depending on the nature of the communication.

Marketing and newsletters

Where you have provided your consent, we may use your email address to send newsletters, news, product launches, campaigns, promotions and other marketing communications from Grain by Grain.

You may withdraw your consent at any time by using the unsubscribe link included in our communications or by contacting us.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Legal basis: consent, pursuant to Article 6(1)(a) GDPR, where applicable.

Security and fraud prevention

We may process certain information to protect the security of our website, prevent or detect fraud, misuse, illegal activity or other security threats.

Legal basis: legitimate interests and, where applicable, compliance with legal obligations.

Compliance with legal obligations and protection of rights

Your personal data may be processed where necessary to comply with legal obligations, respond to legitimate requests from public authorities, exercise or defend legal rights in judicial or non-judicial proceedings, and enforce our terms and policies.

Legal basis: compliance with a legal obligation or legitimate interests, as applicable.


5. SHARING OF PERSONAL DATA

We may share your personal data with third parties only where necessary for the purposes described in this Privacy Policy and in accordance with applicable law.

These third parties may include:

  • Shopify, which provides the technology platform used to operate our online store;
  • payment service providers;
  • shipping and delivery companies;
  • hosting and technology infrastructure providers;
  • customer support providers;
  • marketing and communication service providers;
  • analytics and statistics providers;
  • accountants and administrative service providers;
  • public authorities, courts or other entities where legally required.

These service providers may only process personal data to the extent necessary to provide their respective services and, where they act as processors, in accordance with our instructions and the obligations established under the GDPR.

We do not sell your personal data.


6. SHOPIFY

Our online store is provided through Shopify, an e-commerce platform that provides the technology infrastructure required to operate our store.

In relation to the processing of our customers’ personal data, Grain by Grain is generally the controller of our customers’ personal data, while Shopify acts as a processor in relation to processing carried out on our behalf, without prejudice to situations where Shopify determines the purposes and means of processing and acts as an independent controller.

Shopify may process certain personal data to provide, maintain, protect and improve its services.

Data may also be processed by Shopify group companies and Shopify’s service providers, including entities located outside the European Economic Area, in accordance with the legal mechanisms applicable to international data transfers.

Shopify provides additional information about how it processes personal data and the mechanisms used for international transfers through its privacy policy.


7. INTERNATIONAL DATA TRANSFERS

Some of our service providers, including certain technology providers, may be located outside the European Economic Area.

Whenever personal data is transferred outside the European Economic Area, we will seek to ensure that the transfer is carried out in accordance with the GDPR and using a legally recognised transfer mechanism, including:

  • an adequacy decision adopted by the European Commission;
  • Standard Contractual Clauses approved by the European Commission;
  • Binding Corporate Rules;
  • or another legally recognised mechanism.

Shopify states that certain European customer data is stored in Europe, without prejudice to international transfers that may take place for processing and provision of its services.


8. COOKIES AND SIMILAR TECHNOLOGIES

Our website uses cookies and similar technologies to ensure its operation, improve the user experience, analyse website traffic and, where applicable and subject to consent, provide personalised content or advertising.

Strictly necessary cookies may be used where they are required for the operation of the website.

Other cookies, including certain analytics, advertising or personalisation cookies, will only be used where legally required after obtaining the user’s consent.

For detailed information about the cookies we use, their purposes, duration and how you can manage your preferences, please consult our Cookie Policy and the relevant cookie consent banner.

You may change or withdraw your cookie preferences through the tools made available on our website.


9. DATA RETENTION

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including, where applicable:

  • for as long as necessary to manage your account;
  • for as long as necessary to process and manage an order;
  • for the legally required periods for tax, accounting or other purposes;
  • for as long as necessary to resolve complaints or disputes;
  • for as long as necessary to exercise or defend legal rights;
  • for as long as valid consent exists for certain activities, such as marketing, unless withdrawn earlier.

When personal data is no longer necessary, it will be deleted or anonymised, unless we are legally required to retain it for a longer period.


10. DATA SECURITY

We implement appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised access or other unlawful processing.

However, no security system or method of transmitting data over the Internet can guarantee absolute security.

If a personal data breach occurs that is likely to result in a risk to the rights and freedoms of individuals, we will take the measures required by applicable law, including, where necessary, notifying the relevant supervisory authority and/or affected individuals.


11. YOUR DATA PROTECTION RIGHTS

Under the GDPR, you may, in certain circumstances, exercise the following rights in relation to your personal data:

Right of access

You may request information about the personal data we hold about you and obtain a copy of that data.

Right to rectification

You may request that inaccurate or incomplete personal data be corrected.

Right to erasure

You may request that your personal data be deleted where the conditions set out in the GDPR are met.

Right to restriction of processing

You may request that the processing of your personal data be restricted in certain circumstances provided for by law.

Right to object

You may object to the processing of your personal data where the processing is based on certain grounds, including legitimate interests.

You also have the right to object at any time and free of charge to the processing of your personal data for direct marketing purposes.

Right to data portability

Where applicable, you may request that your personal data be provided in a structured, commonly used and machine-readable format, or request that it be transmitted to another controller.

Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

The exercise of these rights is generally free of charge. We may request additional information to verify your identity where necessary to protect personal data.


12. HOW TO EXERCISE YOUR RIGHTS

To exercise any of your rights or to ask a question relating to the protection of your personal data, please contact:

Grain by Grain Unipessoal, Lda.
Email: info@grainbygrain.de
Avenida Visconde Valmor, No. 43, 2nd floor
1050-237 Lisbon
Portugal
VAT number: PT518955524

Where possible, your request should indicate which right you wish to exercise and provide the information necessary for us to identify and process your request.

We may request reasonable proof of identity where necessary.


13. RIGHT TO LODGE A COMPLAINT

If you believe that the processing of your personal data violates the GDPR or applicable law, you may contact us so that we can try to resolve the matter.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

In Portugal, the supervisory authority responsible for data protection is:

Comissão Nacional de Proteção de Dados (CNPD)
Rua de São Bento, No. 148 – 3rd floor
1200-821 Lisbon
Portugal

Website: CNPD

Lodging a complaint with the supervisory authority does not affect any other rights or judicial remedies you may have.


14. CHILDREN’S DATA

Our website and services are not specifically intended for children.

We do not knowingly seek to collect personal data from children who do not have the legal capacity to use our services.

If a parent or legal guardian believes that a child has provided us with personal data improperly, they may contact us to request that the data be reviewed and, where legally applicable, deleted.


15. THIRD-PARTY WEBSITES AND SERVICES

Our website may contain links to websites, applications, social media platforms or other third-party services.

These websites are operated by independent entities and may have their own privacy policies and terms of use.

Grain by Grain is not responsible for the privacy practices, security or content of such third parties. We recommend that you review their respective privacy policies before providing any personal data.


16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our practices, services, technologies or legal and regulatory requirements.

Whenever we make changes, we will update the date shown at the beginning of this Privacy Policy.

We recommend that you periodically review this page to remain informed about how we process your personal data.