Privacy policy

1. Who is responsible for your data

For the website and the newsletter: André Verde, [[morada para o Impressum]], [[e-mail]].
For sales data: [[Nome da ONG brasileira]], the organisation that sells the books.

[[To define with the lawyer: joint controllers, separate controllers, or a processor.]]

2. What data we process and why

• Visiting the site: technical data needed to deliver the pages (IP address, date and time, browser), kept by the host in short-lived logs.
• Preferences: the language and region you choose, in a technical cookie.
• Contact: name, e-mail and message, only to reply to you.
• Purchases: name, e-mail, delivery address and order details, to perform the contract. Card data is handled only by Stripe; we never see it.
• Members area: your account and a log of sign-ins (see point 6).
• Newsletter: e-mail, language, region and interests, only with your consent confirmed by e-mail.

3. Legal bases

Performance of a contract (purchases and access), consent (newsletter) and legitimate interest (site security and preventing misuse of access), under the GDPR.

4. How long we keep data

[[Retention periods per data category.]]

5. Service providers and transfers

• Hosting: [[Hostsilo — confirm server location and data processing agreement]]
• Payments: Stripe
• E-mails and newsletter: Brevo (EU servers)
• The selling organisation in Brazil (transfer to a third country under standard contractual clauses)

6. Sign-in log for the members area

To prevent shared access, each sign-in records the date, a truncated or hashed IP, the approximate country and the device type. These records are deleted after [[90]] days.

7. Cookies

We only use technically necessary cookies. See the cookies page.

8. Your rights

You can request access, correction, erasure, restriction or portability of your data, object to processing and withdraw consent at any time. You can also lodge a complaint with a data protection authority.

9. Contact

[[e-mail]]