Privacy Policy – Emotiles

Last updated: November 5, 2026

Emotiles respects your privacy. This policy explains what personal data we process when you visit our website emotiles.pt, personalise your tiles, place an order or contact us, what we use it for, how long we keep it and what rights you have. We apply Regulation (EU) 2016/679 (GDPR), Law No. 58/2019 of 8 August, and Law No. 41/2004 of 18 August (electronic communications and cookies).

1. Who is the data controller

For any question about personal data or to exercise your rights, write to suporte@emotiles.pt.

2. What data we process, why, on what legal basis and for how long

Shopify enhanced services. The data that Shopify uses as a controller in its enhanced services (section 6.1) is processed by Shopify under its own policy, on the legal bases that Shopify indicates: consent for personalised advertising and, where applicable, Shopify's own legitimate interest.

Mandatory and optional data. To buy, you must provide the data needed for the order, delivery and invoicing; without it we cannot complete the purchase. The rest, such as subscribing to news, is optional and can be declined without consequences for the purchase.

Source of the data. We collect the data directly from you. We also receive from Shopify, the payment providers and the carrier information about the status of payment and delivery.

3. Your photographs

3.1 What we use them for

The photographs, images and texts you send us, and the options you choose (frame, size, framing, zoom, effect), are used only to produce and deliver your order and, during the time limits below, for support, guarantees, reprints and complaints.

• We do not use them in advertising, in our portfolio or on social media without your prior and express authorisation.
• The production team sees them in order to prepare printing. We do not use facial recognition.
• By sending the images, you declare that you are entitled to use them (including, if they show children, the authorisation of whoever holds parental responsibility) and you authorise us to use them only to produce the order. We may refuse content that is unlawful or that infringes the rights of third parties, without prejudice to consumer rights (see Terms and Conditions).

3.2 Where they are kept and who sees them

• Photographs are sent over an encrypted connection (HTTPS) to private Cloudflare storage (Cloudflare R2), configured to keep the files on servers in the European Union. The files are not public.
• Only the production team, with authenticated access, can see them. Access to the account where they are stored is protected by two-factor authentication.
• We keep the file exactly as you sent it, including any metadata the photograph has (for example, the date and, on some phones, the location). We do not use that metadata for any purpose.
• To make the experience faster, uploading of photographs may begin while you are still personalising the tiles. Therefore, if you give up before buying, photographs already uploaded are kept for the time limits in section 3.3.
• To prevent abusive automated uploads, we use the Cloudflare Turnstile security check.
• We also keep, on your own device (in the browser), a draft of the personalisation, so that you do not lose your work if you close the page. This draft stays only on your device.

3.3 When we delete the photographs

• We never delete photographs of an order that is still to be produced, in production or to be dispatched, or of a complaint, replacement or reprint in progress. Before deleting, the system checks the status of the order.
• Security quarantine: before permanent deletion, photographs spend up to 7 days in a reversible internal quarantine. Permanent deletion therefore takes place up to 7 days after the dates above.
• Backup: we keep an internal backup of the photographs, also in private, encrypted storage on servers in the European Union, to protect them from errors or loss. After we delete the original, the backup is deleted up to 30 days later (the time we have to correct a deletion made by mistake). In practice, a photograph and its backup disappear 37 days after the dates in the table at the latest.
• If you remove a photograph after uploading it, the file is not used in production, but it may remain in storage until the time limit that applies to the rest of the personalisation.
• Early deletion: you can ask us at any time to delete your photographs, by email to suporte@emotiles.pt. We delete them within one month at most, unless the order is still to be fulfilled, or we have to keep them by legal obligation or to resolve a complaint. The corresponding backup is deleted up to 30 days later.
• After deletion: if a tile has to be reproduced because of a defect within the legal guarantee, we may ask you for the photograph again. For that reason, we advise you to always keep the originals. Your guarantee rights remain (see Returns and Refunds Policy).

4. Marketing and communications

• We only send you news and offers if you expressly authorise it, for example by subscribing to the newsletter in the website footer or by ticking the marketing option at checkout. The option is never pre-selected.
• You can withdraw consent at any time, using the “unsubscribe” link in every email or by email to suporte@emotiles.pt. Withdrawing consent does not affect processing carried out before.
• We keep proof of consent (date, email and form) and a list of people who do not want to receive messages, so that we respect your request.
• Messages about your order (confirmation, dispatch, delivery, problems) are not marketing and we always send them.

5. Cookies and similar technologies

Cookies are small files that the website stores on your device. Browser local storage serves a similar function. The essential ones do not need your consent, because without them the shop does not work. Statistics and marketing cookies are only used after you accept them.

5.1 Your consent

• When you visit the website, we show a notice with three equally prominent options: Accept, Reject and Manage preferences. Under “Manage preferences” you can choose, by category, what you accept. Non-essential cookies are switched off until you choose.
• Rejecting non-essential cookies does not affect the purchase.
• You can change your mind at any time, using the “Cookie preferences” link in the website footer. Your choice is saved in your browser. You can also block or delete cookies in your browser: if you block the essential ones, the cart and checkout stop working.

5.2 Which cookies we use

• Browser local storage (configurator). It stores the language, the draft of your tiles and the Decorative Art (Arte Decorativa) works you chose, only on your device, so that you do not lose your work. It is requested by you when you use the configurator and does not need consent.
• Security when uploading photographs. We confirm that the upload is made by a person and not by a robot (Cloudflare Turnstile), which involves processing technical data at the time of verification. It is necessary for security and does not need consent.
• Other tools. With your consent, we use the Meta Pixel (Meta Platforms Ireland Limited) to measure the effectiveness of our advertising and to show it to people with similar interests, and Google Analytics 4 (Google Ireland Limited) for website usage statistics. These services store cookies on your device (for example, _fbp, _ga and _ga_*) and may transfer data outside the European Economic Area. They only work if you accept the statistics or marketing categories, and they stop working if you withdraw your consent under «Cookie preferences».
• This list matches the cookies that Shopify documents and may change as Shopify updates them.

6. Who we share data with

We do not sell personal data. We share it only with providers that process it on our behalf, bound by contract, and with the bodies to which the law requires us to provide it.

Some providers, such as Shopify or the payment providers, may also process certain data as independent controllers, for their own purposes (for example, fraud prevention), in accordance with their own privacy policies.

6.1 Shopify enhanced services (Shopify Network Intelligence)

Our shop is hosted on Shopify. Shopify processes the data of visitors and customers to provide us with the service and, while the «Shopify Network Intelligence» feature is active in our shop, also to provide enhanced features (for example, personalisation, analytics and advertising) that use data from your interactions with our shop, with other shops and with Shopify itself. For these purposes, Shopify acts as a controller, under its Consumer Privacy Policy (https://www.shopify.com/legal/privacy/consumers). Other shops do not have access to our customers' data. The data may be shared with Shopify and with third parties, who may be in other countries.

Shopify only uses data from your device (cookies and similar technologies) for non-essential purposes, including advertising, if you have accepted the corresponding categories of cookies in our cookie notice. You can withdraw consent at any time under «Cookie preferences», in the footer of the website. For these purposes you can also exercise your rights directly with Shopify, including objecting to the processing or withdrawing consent, at https://privacy.shopify.com. Shopify states that it relies on consent to show personalised advertising and, where applicable, on its own legitimate interests, such as improving its products, analytics and testing features.

7. Transfers outside the European Economic Area

Shopify, Cloudflare, Meta, Google and some payment providers belong to groups headquartered outside the European Economic Area, for example in the United States and Canada. Photographs are kept on servers in the European Union. Whenever other data is processed outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, where applicable to the provider) or on standard contractual clauses, with the safeguards required by the GDPR. You can ask us for information about these safeguards.

8. Security

We use appropriate technical and organisational measures: encrypted connections (HTTPS), private storage of photographs, authenticated access restricted to the production area, two-factor authentication on the account where the photographs are stored, and separation between order data and payment data, which is processed by the payment provider. No system is infallible. If a personal data breach occurs, we notify the CNPD (Comissão Nacional de Proteção de Dados, the Portuguese data protection authority) as required by law and, where there is a high risk to you, we also inform you.

9. Your rights

You can, at any time:

• access your data and obtain a copy;
• request rectification of inaccurate data;
• request erasure of the data, in the cases provided for by law;
• request restriction of processing, in the cases provided for by law, and object to processing based on legitimate interest;
• receive the data you provided to us in a structured, commonly used format, or ask us to transmit it to another controller (portability);
• withdraw the consent you have given, without affecting earlier processing.

To exercise a right, write to suporte@emotiles.pt. We reply within one month (extendable by a further two months in complex cases, in which case we will tell you). We do not charge for the request. We may ask you to confirm your identity. We may refuse erasure when we have to keep the data by legal obligation, such as invoices.

You also have the right to lodge a complaint with the supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, www.cnpd.pt, without prejudice to any other administrative or judicial remedy.

10. Automated decisions and minors

• We do not take decisions based solely on automated processing that produce legal effects on you. The payment and fraud-detection systems of Shopify and the banks may automatically refuse a suspicious payment; if that happens, you can contact us or your bank to ask for a review by a person.
• The website is intended for people aged 18 or over and we do not knowingly collect data from minors. If you send photographs of children for printing, it is the adult who contracts and who is responsible for that use.

11. Changes to this policy

We may update this policy. The date of the last update is at the top and, for significant changes, we give notice on the website. If we start using your data for a new purpose, we will inform you beforehand.

12. Contacts

Privacy questions: suporte@emotiles.pt, or by letter to EMOTILES, LDA, Estrada de Santarém, No. 232, 2040-336 Rio Maior, Portugal.