Privacy Policy

Last updated: September 15, 2026

1. Who we are

This website (margaridaatelier.com) is operated by Margarida Atelier (Margarida Nobre), based in Barreiro, Portugal ("we", "us", "our"). This policy explains what personal data we collect when you visit or purchase from our site, how we use it, and what your rights are.

For any questions about this policy or your personal data, contact us at hello@margaridaatelier.com.

2. What data we collect and why

2.1 When you make a purchase

When you buy something on this site, we collect your personal information to process your order, including:

  • Billing and shipping address

  • Details relating to your purchase (for example, the size or frame you chose)

  • Email address

  • Name

  • Phone number

We pass this information to Squarespace, our online store provider, so they can provide us with site-related services. We also pass shipping details to CTT, our courier, so we can deliver your order — you can read CTT's privacy policy.

At checkout, this site may automatically populate the shipping and billing address by passing what you type to the Google Places API, to suggest and speed up the process.

2.2 Physical products and shipping

When you buy a painting, a canvas, or a scarf, we collect the data needed to ship it to you (address, order details such as weight or dimensions, email, name and phone number). This data is shared with Squarespace and CTT, as described above.

2.3 Payment

Payment processing is handled through Stripe. When you complete a purchase, Stripe receives and processes your payment data directly, in accordance with Stripe's privacy policy. Payment data is encrypted in line with the PCI-DSS standard and is not stored by us — only for as long as strictly necessary to complete the transaction, after which it is deleted.

2.4 Customer account

If you create a customer account on this site, we collect your personal data to improve the checkout process and customer support, including billing and shipping address, order details, email, name and phone number. We pass this data to Squarespace, so they can provide site services and help us manage our relationship with you.

2.5 Blog comments

If you post a comment on a blog post, we collect your name (which appears alongside the comment) and, optionally, your email (so we can notify you of replies) and a website URL.

2.6 Emails about your order or account

We may email you to let you know that: you created a customer account; your account password was changed; you made a purchase; or your order has shipped. It is not possible to unsubscribe from these messages, as they are necessary to the contractual relationship. We pass your contact details to Squarespace so they can send these emails on our behalf.

2.7 Cookies and similar technologies

This site uses cookies and related technologies — small files or pieces of text stored on your device. To learn how to view the cookies left on your device, see the cookies Squarespace uses.

  • Functional and required cookies are always used, so that Squarespace, our hosting platform, can securely serve this site to you.

  • Analytics and performance cookies are only used once you acknowledge our cookie banner, to see site traffic, activity and other data.

We do not alter our data collection and use practices when we detect a "Do Not Track" signal from your browser.

2.8 Fonts

This site uses Google Fonts and/or Adobe Fonts to display fonts correctly. To do so, these services may receive information about your browser, network and device, the page you're visiting, and your IP address.

2.9 Site hosting

This site is hosted by Squarespace, which collects personal data when you visit it, such as information about your browser, network and device, pages visited before and during your visit, and your IP address. Squarespace needs this data to make the site work and to protect and improve its platform. You can learn more in Squarespace's privacy policy.

2.10 Targeted advertising

If and when we use targeted advertising (for example, on Facebook/Instagram or Google), you can opt out via:

3. How long we keep your data

Personal data collected during a transaction (name, address, phone, email) is stored securely for 36 months. Browsing data (collected automatically when you visit the site) is kept for 90 days from your last visit. Payment data is deleted as soon as the transaction is complete.

4. International data transfers

Some of the service providers we use — Squarespace and Stripe — are based outside the European Economic Area (in the United States). When your data is transferred to these companies, it is done under safeguards recognized by the GDPR, namely the European Commission's Standard Contractual Clauses. You can consult each provider's privacy policy for further detail.

5. Your rights

If you are a resident of the European Economic Area, you have the right to:

  • Access the personal data we hold about you;

  • Request correction or updating of that data;

  • Request deletion of your data;

  • Request restriction of, or object to, the processing of your data;

  • Request portability of your data;

  • Withdraw consent at any time, where processing is based on consent;

  • Lodge a complaint with the supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD), via www.cnpd.pt.

To exercise any of these rights, contact us at the email address given at the start of this policy.

We process your data on the basis of performing a contract with you (for example, when you place an order) or our legitimate interest in managing and improving our business.

6. Security

We take reasonable precautions and follow industry best practices to make sure your personal data is not inappropriately lost, misused, accessed, disclosed, altered or destroyed. Payment card data is encrypted via SSL and stored with AES-256 encryption by our payment providers.

7. Minors

This site is not intended for individuals under the age of 18.

8. Changes to this policy

We may update this policy from time to time, to reflect changes to our practices or for operational, legal, or regulatory reasons. The date at the top of this page indicates the last update.

9. Contact

For questions about this policy or your personal data: hello@margaridaatelier.com.