Privacy & Data Protection Notice

1. Who is responsible for your data

The data controller is Cecilia Gelato (Cecilia Gelato, Portugal). For any privacy question or request, write to privacidade@ceciliagelato.com.

This notice is provided under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Portuguese Law no. 58/2019 of 8 August.

2. What we collect

Guest Club sign-up: your name and email address (required), and optionally your mobile number, birthday and favourite flavour.

Club activity: the coupons issued to you, whether and when they were redeemed in the shop, your personal referral code, and which guests joined through your link.

Service notes: short notes our staff may add about your preferences (for example an allergy or a favourite table). We do not ask for, and you should not send us, health data or other special categories of data.

We do not collect payment card data through this app.

3. Why we use it, and on what legal basis

To run the Guest Club — issuing, showing and redeeming your coupons and tracking referrals: performance of the club membership you asked for (Article 6(1)(b) GDPR).

To send you marketing by email or SMS — new flavours, events and coupon reminders: your consent (Article 6(1)(a) GDPR and Article 13-A of Portuguese Law no. 41/2004 on privacy in electronic communications). You may give consent for email and SMS separately, and withdraw either at any time.

To keep the service secure and prevent coupon fraud or abuse: our legitimate interests (Article 6(1)(f) GDPR).

To meet accounting or legal obligations where applicable: compliance with a legal obligation (Article 6(1)(c) GDPR).

4. Consent is optional and reversible

Joining the club never requires you to accept marketing. If you tick nothing, you still receive your welcome coupon and referral link.

Every marketing email includes a one-click unsubscribe link, and every SMS explains how to stop. You can also just tell us at the counter or email privacidade@ceciliagelato.com and we will stop immediately. Withdrawing consent does not affect processing carried out before withdrawal.

5. How long we keep it

Guest Club records are kept while you are a member and for up to 24 months after your last visit, coupon redemption or interaction with our messages, after which they are deleted or anonymised.

Marketing consent records are kept for as long as we rely on them plus 5 years, so we can prove consent was given.

You can ask us to delete your data sooner at any time.

6. Who else sees it

Our shop staff, on a need-to-know basis, to look up your coupons and serve you.

Service providers acting as processors under written contracts (Article 28 GDPR): our application hosting and database provider, and our email/SMS delivery provider.

We do not sell your data and we do not share it for other companies' advertising.

Data are hosted within the European Union. If any transfer outside the EEA becomes necessary, it will be covered by an adequacy decision or the European Commission's Standard Contractual Clauses; you may request a copy of the safeguards.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent at any time.

To exercise any right, email privacidade@ceciliagelato.com. We reply within one month (extendable by two months for complex requests) and we may ask you to confirm your identity.

If you believe your rights were breached, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa, geral@cnpd.pt, www.cnpd.pt.

8. Automated decisions and profiling

We do not carry out automated decision-making with legal or similarly significant effects. Coupons are issued by simple, fixed rules: a welcome coupon on joining, a referral coupon when a friend joins through your link, and an optional birthday treat.

9. Children

The Guest Club is intended for people aged 13 or over, in line with Article 16 of Portuguese Law no. 58/2019. If you are under 13, please ask a parent or guardian to join on your behalf.

10. Cookies and local storage

This app does not use advertising or analytics cookies. It stores only strictly necessary technical data on your device — your language choice and, for staff, a sign-in session — which under Article 5(3) of the ePrivacy Directive does not require consent.

11. Security and changes

Access to guest data is restricted to authenticated staff accounts, protected by database-level access rules and encrypted in transit.

If we change this notice we will update the date above and, for material changes affecting your rights, notify you by email.