Privacy Policy

1. Privacy Statement and Scope

360 Merchandising is a brand owned and operated by CRIATIVALCANCE, UNIPESSOAL LDA. Protecting the privacy and personal data of its customers, potential customers, users, commercial contacts, suppliers and other interlocutors is a priority in the organisation of its services.

This Privacy Policy explains in a transparent way what personal data is processed by 360 Merchandising, how it is collected, for what purposes it is used, what legal bases apply, how long it is kept, with whom it can be shared and what the rights of the data subjects are.

This Policy applies to the 360-merchandising.com website and to interactions carried out through the customer area, forms, quote requests, orders, email, telephone, WhatsApp, social networks, campaigns, competitions, evaluations, recommendations and other commercial channels used by 360 Merchandising, including B2C and B2B relationships.

360 Merchandising accepts orders destined for different countries. Whenever the processing of personal data is subject to Regulation (EU) 2016/679 — General Data Protection Regulation («GDPR») — and applicable national legislation, these laws will be observed.

Simply using the website does not replace the specific consents required by law. Where processing relies on consent, that consent will be requested in a freely given, specific, informed and unambiguous manner and may be withdrawn as described in this Policy.

2. Data Controller

The entity responsible for processing personal data in connection with the 360 Merchandising brand is:

CRIATIVALCANCE, UNIPESSOAL LDA did not designate, at the date of this version, a Data Protection Officer. Questions regarding privacy and the exercise of rights should be directed to the email address indicated above.

3. Personal Data, Subjects and Data Categories

3.1. What are personal data?

Under the GDPR, personal data is any information relating to an identified or identifiable natural person. A person may be identifiable directly or indirectly, namely through name, identification number, location data, electronic identifiers or other elements relating to their identity.

3.2. Who are the data subjects?

This Policy applies, among others, to customers and potential customers, website users, representatives and employees of corporate customers, recipients of orders, participants in competitions, subscribers to communications, people who contact customer support, users who post reviews or comments and contacts provided through recommendation features.

3.3. How do we collect personal data?

Data may be collected directly from the data subject, particularly when he/she:

• create or use a customer account;
• place an order or request a quote;
• upload a logo, image, file, document or other content for personalisation;
• use the product editor or customizer and approve a design or mockup;
• contact 360 Merchandising by email, telephone, WhatsApp, social media or form;
• subscribe to newsletters or other commercial communications;
• participates in competitions, campaigns or promotional actions;
• post a review, comment or other content;
• use the recommendation or “refer a friend” functionality;
• interacts with the website, cookies, analytical tools or advertising technologies.

Data may also be received from third parties involved in the execution of orders, payments, shipping, technical support, fraud prevention, advertising and other operations necessary to provide the services.

3.4. What categories of data do we process?

Depending on the interaction and when applicable, the following data may be processed:

• identification and contact data: name, email, telephone, address and country;
• tax and business data: NIF, company name, billing data and other elements necessary for issuing commercial documents;
• account and authentication data: account identifiers and credentials necessary to access the reserved area;
• order data: purchased products, quantities, variants, customisations, observations, order status, purchase history and associated communications;
• billing and delivery data: addresses, recipient, data necessary for transport and, when applicable, information required by tax or customs authorities;
• data relating to personalisation: logos, images, texts, files, documents, designs, mockups and respective approvals;
• customer support data: content of emails, messages, calls, requests, complaints and their follow-up;
• marketing data: communication preferences, subscriptions, consents, interactions with emails, campaigns, advertising and abandoned carts;
• public data: name or designation presented by the user, content of evaluations, comments and respective publication date;
• technical and usage data: IP address, device identifiers, browser, operating system, pages visited, origin of visit, browsing events and other data associated with cookies or similar technologies;
• payment data of a non-sensitive nature received from the payment provider, such as payment status, amount and transaction reference.

3.5. Files, logos, images and customisations

The 360 Merchandising allows the uploading and retention of files intended for product customisation. These contents may, in certain circumstances, contain personal data of the customer or third parties.

The user is responsible for ensuring that they have the legitimacy to provide, use and have the submitted content reproduced, including when they contain names, photographs, logos, brands, third party data or other protected information. 360 Merchandising does not, as a rule, request special categories of personal data and recommends that sensitive information that is not strictly necessary is not included in these files.

Mockups and customisations may be kept in the customer area and in the order history, to the extent necessary for performance, evidence, repeat orders or assistance relating to the order and in accordance with the retention periods set out in this Policy.

3.6. Third-party data provided by the user

Whenever the user provides data about another person — for example, an order recipient or a contact indicated through the “refer a friend” functionality — they must ensure that they are authorised to do so and that the person in question has been duly informed when required.

The data received through a referral will be used to manage the referral or invitation and will not be used for continued commercial communications without an appropriate legal basis.

4. Purposes and Legal Basis of Processing

360 Merchandising processes personal data only when there is a specific purpose and an adequate legal basis. Depending on the context, the following grounds may apply:

4.1. Contract execution and pre-contractual measures

This basis is used, in particular, to:

• customer account creation and management;
• responding to information requests, contact enquiries and requests for quotations;
• processing, management and tracking of orders;
• management of customisation options, files, mockups and respective approvals;
• invoicing, collection and payment status management;
• production, preparation, dispatch and delivery of products;
• customer support, complaints management and after-sales assistance;
• management of returns, cancellations, corrections or other operations related to the contract.

4.2. Compliance with legal obligations

Data will be processed when necessary to comply with tax, accounting, commercial, customs, consumer protection obligations, cooperation with authorities or other applicable legal obligations.

4.3. Consent

Consent may be used, when legally required, to send certain marketing communications, use cookies or non-essential advertising technologies, participate in specific campaigns and other purposes that depend on an expression of the data subject’s wishes.

Consent can be withdrawn at any time, without compromising the lawfulness of the processing carried out before its withdrawal.

4.4. Legitimate interest

360 Merchandising may process data based on its legitimate interests, provided that, after consideration, the interests, rights and fundamental freedoms of the data subject do not prevail. This basis may cover:

• improving the quality, security, operation and performance of the website and services;
• prevention and detection of fraud, abuse, misuse or security incidents;
• management of B2B commercial contacts and relationships with existing customers, when legally permissible;
• statistical analysis and improvement of user experience;
• defense, exercise or demonstration of rights in judicial or extrajudicial proceedings;
• recovery of initiated purchase processes, including abandoned carts, when legally permitted and the rules applicable to electronic communications are respected.

5. Marketing, Communications and Advertising

360 Merchandising may use contact data and information relating to the commercial relationship to send newsletters, news, campaigns, offers, product information, promotional communications and other marketing messages, always in accordance with applicable legislation.

The sending of promotional communications may be based on consent or, where the law allows, on another appropriate legal basis. Each marketing communication sent by email must provide a simple means of unsubscribing (“unsubscribe”).

360 Merchandising uses or may use advertising and remarketing mechanisms, including Google Ads and Meta Ads/Meta Pixel, to measure campaigns, create audiences, limit or optimize the presentation of ads and understand the performance of marketing actions. When these technologies depend on cookies or other non-essential identifiers, they will be activated in accordance with the user's consent preferences, whenever legally required.

Automatic communications related to purchasing processes may also be sent, including messages about abandoned carts, to the extent permitted by applicable legislation and respecting user preferences.

5.1. Competitions and promotional actions

When the user participates in a competition, prize draw or promotional action, the data is processed to manage participation, check eligibility, contact participants or winners, deliver prizes and comply with any legal obligations. Additional rules may be included in the specific regulations for each initiative.

5.2. Public ratings and comments

Reviews, comments or content published in public areas of the website may be visible to other users and, depending on the technical configuration, be indexed by search engines. The user must not publish personal data of third parties or information that they do not intend to make public.

5.3. Phone calls

360 Merchandising provides customer support by telephone and can, in certain situations, record calls. When there is a recording, the interlocutor will be informed appropriately, including the purpose of the recording. Depending on the context, the recording may be intended to prove communications or transactions, quality control, training, security or defense of rights, with a legal basis appropriate to the specific purpose.

Recordings, when existing, will only be kept for the necessary and legally permissible period, depending on the respective purpose.

6. Payments

Payments made on the website are processed through specialized providers. 360 Merchandising uses Stripe to process electronic payments.

360 Merchandising does not store complete payment card data. This data is entered and processed in the context of the payment provider's service. 360 Merchandising may receive information necessary to manage the transaction, such as payment status, amount, currency, transaction references and information necessary for reconciliation, fraud prevention or refund.

The payment provider may act as an independent controller or data processor in relation to certain operations, according to the nature of the processing and its own terms and policies.

7. Data Sharing with Third Parties

360 Merchandising does not sell personal data. The data may, however, be communicated or made available to third parties when necessary for the provision of services, the operation of the website, the fulfillment of legal obligations or the pursuit of legitimate purposes.

Among the recipients or categories of recipients may be:

• Stripe, for payment processing and associated operations;
• Supabase, for technological database, authentication, storage and application infrastructure services;
• Vercel, for hosting, provision and technical infrastructure of the website;
• Google, including Google Analytics, Google Tag Manager and Google Ads, for measurement, tag management, analytics, advertising and remarketing, in accordance with applicable preferences;
• Meta, when Meta Ads, Meta Pixel or communication services such as WhatsApp are used, according to the applicable context and preferences;
• suppliers of products, customisation services, production, order preparation, shipping and other operational partners necessary to execute the order;
• carriers, logistics operators and their partners, with the selection of the delivery operator being made within the scope of the supply chain applicable to the order;
• providers of technology, support, security, fraud prevention, accounting, auditing, legal consulting or other professional services;
• tax, customs, judicial, police, regulatory or administrative authorities, when there is a legal obligation or legitimate request.

For the execution of personalised orders and their delivery, the name of the customer or recipient, email, delivery address, order information, personalisation files or logos, mockups and other elements essential to production, validation, shipping and delivery may be communicated, when necessary.

Whenever a third party processes data on behalf of CRIATIVALCANCE, UNIPESSOAL LDA, appropriate contractual and organisational measures will be adopted to ensure that the processing is carried out in accordance with applicable instructions and data protection legislation.

8. International Data Transfers

Some technological providers, digital platforms or partners involved in services may operate outside Portugal or the European Economic Area («EEA»), or use internationally distributed infrastructures.

Whenever an international transfer of personal data is subject to the GDPR and has its destination in a country that does not benefit from an applicable adequacy decision, CRIATIVALCANCE, UNIPESSOAL LDA will seek to ensure the use of a transfer mechanism recognized by law, such as standard contractual clauses approved by the European Commission, appropriate additional measures or other applicable legal basis.

Carrying out international deliveries may also require the communication of data to logistics operators, local partners and customs or tax authorities of the countries involved, when this is necessary to execute the order or comply with legal obligations.

9. Storage of Personal Data

Personal data are kept only for the period necessary for the purposes for which they were collected, without prejudice to longer periods imposed by law or necessary for the exercise or defense of rights.

Once the applicable retention period has expired, the data will be deleted or irreversibly anonymised. It will be retained beyond that period only where a legal basis justifies doing so.

10. Data Security

360 Merchandising adopts risk-appropriate technical and organisational measures to protect personal data against unauthorised, accidental or unlawful destruction, loss, alteration, disclosure or access.

Measures may include, depending on the nature of the system and data:

• use of secure connections and encryption in transit;
• authentication and access control mechanisms;
• permissions management according to access need principles;
• monitoring, recording and application and infrastructure security measures;
• adequate backups and continuity mechanisms;
• selection of providers with appropriate security and data protection guarantees;
• incident response procedures and vulnerability assessment.

No information system is absolutely immune to risks. For this reason, 360 Merchandising reviews and adjusts its security measures based on technological developments, the nature of the data and the risks identified.

The user must also protect their access credentials, use appropriate passwords and inform 360 Merchandising if they suspect unauthorised use of their account.

11. Rights of Data Subjects

Under applicable legislation and subject to the respective conditions, the data subject may exercise the following rights: Right of access: obtain confirmation about the processing and access their personal data and relevant information about that processing. Right to rectification: request the correction of inaccurate data or the completion of incomplete data. Right to erasure: request the deletion of data when legal requirements are met and there is no basis that imposes or legitimizes its retention. Right to restriction of processing: request that processing be restricted in situations provided for by law. Right to data portability: receive, where applicable, the data provided in a structured, commonly used and machine-readable format, or request its transmission to another controller. Right to object: object to certain processing based on legitimate interest and, at any time, to processing for direct marketing. Right to withdraw consent: withdraw consent at any time regarding processing based on it, without affecting the lawfulness of previous processing. Right to complain: lodge a complaint with the competent supervisory authority, namely the National Data Protection Commission («CNPD»), without prejudice to other means of protection.

The exercise of rights must be carried out through info@360-merchandising.com or in writing to the address indicated in this Policy. To protect the data subject's data, 360 Merchandising may request additional information reasonably necessary to confirm the identity of the applicant.

Requests will be processed within the legally applicable deadlines. In certain situations, a right may be limited or denied when there is a legal obligation, need for retention, protection of third party rights or other exception provided for in legislation.

12. Cookies, Analytics and Similar Technologies

The website uses cookies and similar technologies to ensure its functioning, maintain sessions, protect security, save preferences, measure use and performance and, when authorised, support advertising and remarketing activities.

The following categories and technologies may be used, among others:

• cookies and storage strictly necessary for the website to function, session, authentication, cart and security;
• technologies associated with Supabase necessary for authentication, session and operation of the client area;
• technologies associated with Stripe necessary for secure payment processing and fraud prevention;
• Google Analytics 4 (GA4), for statistical analysis and usage measurement;
• Google Tag Manager, for technical management of tags and integrations;
• Google Ads, for measuring conversions, advertising and remarketing;
• Meta Pixel and Meta Ads, for measurement, audience creation and advertising, when implemented and legally authorised.

Cookies and technologies that are not strictly necessary will be used in accordance with the user's choices and applicable legal requirements. The user can change their preferences through the consent management mechanism available on the website and can also manage cookies through the browser settings, although deactivating certain elements may affect functionality.

13. Contacts, Complaints and Supervisory Authority

For questions related to privacy, processing of personal data or exercise of rights, you can contact:

• Email: info@360-merchandising.com
• Telephone: +351 913 784 204
• Address: CRIATIVALCANCE, UNIPESSOAL LDA, Avenida Fernão de Magalhães, N.º 481, 2.º Andar - Sala D, 3000-177 Coimbra, Portugal.

The holder also has the right to lodge a complaint with the National Data Protection Commission (CNPD) or another competent supervisory authority, in accordance with applicable legislation.

14. Changes to the Privacy Policy

CRIATIVALCANCE, UNIPESSOAL LDA may review or update this Privacy Policy whenever necessary, particularly as a result of legislative, regulatory, technological, organisational changes or changes to the services provided by 360 Merchandising. The updated version will be published on the website indicating the revision date and, when the changes are materially relevant, additional means of informing users may be used.