Last updated: 23 July 2026
This Policy describes how Diogo Valente Unipessoal Lda (“we”, “Hidden Porto”), a company established in Portugal, collects, uses, stores and protects the personal data of visitors and customers of the Hidden Porto website, in compliance with Regulation (EU) 2016/679 (“GDPR”) and Portuguese Law 58/2019 of 8 August (implementing the GDPR). Portuguese law applies to this Policy.
1. Data Controller
Diogo Valente Unipessoal Lda
VAT no. 519035402
Rua Ferreira de Castro, 41, 4445-435 Ermesinde, Portugal
Email: geral@hiddenporto.pt
For any question relating to the processing of your personal data, including the exercise of your GDPR rights, you can contact us at the email address above.
2. What data we collect
We collect only the data strictly necessary for the purpose of the service:
- Contact and billing data — name, email and, where applicable, VAT number, supplied by the customer at the time of purchasing the ebook.
- Payment data — payment is processed by Stripe Payments Europe, Limited (an electronic money institution authorised by the Central Bank of Ireland). Card details are entered directly into a secure Stripe form and never reach our servers. We receive only the transaction status and the minimum data identifying the payment.
- Technical data — IP address, browser type, operating system, pages visited and visit duration, collected automatically by our servers and via cookies, for security and aggregate analytics purposes.
3. Purposes and lawful bases
| Purpose | Lawful basis (GDPR) |
|---|---|
| Completing the ebook purchase and digital delivery | Art. 6(1)(b) — performance of a contract |
| Issuing invoice/receipt | Art. 6(1)(c) — legal obligation (Portuguese VAT Code) |
| Responding to contacts/support | Art. 6(1)(b) or (f) — performance of a contract or legitimate interest |
| Functional cookies | Strictly necessary for the website to operate — no consent required |
| Analytics/marketing cookies | Art. 6(1)(a) — prior, explicit consent |
4. Data retention
- Transaction and billing data: retained for 10 years, as required by Article 123(1) of the Portuguese Corporate Income Tax Code and Article 52 of the Portuguese VAT Code.
- Contact data without purchase: deleted after 12 months, unless you expressly ask us to keep it.
- Technical logs: retained for 6 months for security purposes.
5. Recipients of the data
Your data may be shared with:
- Stripe Payments Europe, Limited (Ireland) — payment processing;
- Nexperience Lda (Vendus, invoicing software certified by the Portuguese Tax Authority) — issuing the invoice or receipt;
- Hetzner Online GmbH (Germany) — hosting of the Website, on servers located in the European Union;
- Zoho Corporation B.V. (Netherlands) — email service used for correspondence with us, with data hosted in the European Union;
- Portuguese Tax and Customs Authority — where required by law.
Automated store messages, including the purchase confirmation and the ebook download link, are sent from our own server, without using any external email delivery platform.
We do not sell, rent or otherwise share your data with third parties for commercial purposes.
6. International transfers
The providers listed in the previous section are established in the European Union and process data on servers located in the European Economic Area (EEA). There are, however, two situations in which data may be transferred outside the EEA:
- Stripe — Stripe Payments Europe, Limited relies on group companies established in the United States, in particular Stripe, Inc. These transfers are covered by the standard contractual clauses approved by the European Commission and by Stripe, Inc.’s certification under the EU-U.S. Data Privacy Framework.
- Website typefaces — the fonts used on these pages are loaded from Google’s servers (fonts.googleapis.com), which means your IP address is disclosed to Google LLC (United States), an entity certified under the EU-U.S. Data Privacy Framework.
Apart from these situations, we do not transfer personal data outside the EEA.
7. Your rights
Under the GDPR, you have the right to:
- Access — obtain confirmation of which data we hold about you;
- Rectification — correct inaccurate or incomplete data;
- Erasure (right to be forgotten) — request deletion, subject to any legal retention obligations;
- Restriction — request temporary suspension of processing;
- Portability — receive your data in a structured, machine-readable format;
- Object — object to processing based on legitimate interest;
- Withdraw consent — at any time, without retroactive effect.
To exercise any of these rights, send a request to geral@hiddenporto.pt together with a copy of your identification document. We will respond within 30 days.
You also have the right to lodge a complaint with the competent supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD) (Portuguese Data Protection Authority)
Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa, Portugal
geral@cnpd.pt · www.cnpd.pt
8. Cookies Policy
We use cookies to ensure the website works correctly and to improve your experience. You can control the use of non-essential cookies via the banner shown on your first visit.
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
pll_language | Functional | Remember the language you selected (Polylang) | 1 year |
cookie_notice_accepted | Functional | Remember your consent to the banner | 1 year |
woocommerce_* | Functional | Keep your shopping cart | Session |
wp_* | Functional | User session, where applicable | Session |
We do not currently use analytics cookies (such as Google Analytics) or advertising cookies. If we add them in future, we will update this Policy and request your prior consent.
You can also disable or delete cookies through your browser settings.
9. Security
We implement appropriate technical and organisational measures, including: HTTPS/TLS encryption on every page, encrypted passwords, regular software updates, and segregation of payment credentials (handled exclusively by Stripe).
10. Changes to this Policy
We reserve the right to update this Policy at any time. The version currently in force is the one published on this page, with the date of the last update shown at the top.