Privacy Policy

Inkfest ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This policy explains what information we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable Portuguese law.

By using our website at inkfest.pt, you acknowledge this policy.

1. Who We Are

The data controller is Inkfest, operating in Portugal. For any privacy-related queries, contact us at info@inkfest.pt.

2. Data We Collect

• Contact & enquiry data — name, email address, phone number, and message when you submit a contact or quote request form.
• Order data — billing details, shipping address, and order history when you make a purchase through our store. Payment processing is handled by Stripe; we do not store card details.
• Usage data — anonymised analytics such as pages visited, browser type, and device information collected via privacy-respecting tools. We do not use Google Analytics or place tracking cookies without consent.

3. How We Use Your Data

• To respond to enquiries and process quote requests.
• To fulfil and manage orders you place in our store.
• To send transactional communications (order confirmations, shipping updates).
• To improve our website and services based on aggregated, anonymous usage data.
• To comply with legal obligations.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

• Contract — processing necessary to fulfil an order or service agreement.
• Legitimate interests — responding to enquiries and operating our business.
• Legal obligation — retaining records required by tax or commercial law.
• Consent — where you have explicitly opted in (e.g. marketing emails).

5. Third-Party Services

We work with the following sub-processors, each bound by GDPR-compliant data processing terms:

• Stripe — payment processing (stripe.com/privacy).
• Sanity — content management and form submission storage (sanity.io/privacy).
• Vercel — website hosting (vercel.com/legal/privacy-policy).

6. Data Retention

Enquiry and quote data is retained for up to 2 years after last contact. Order data is retained for 7 years in accordance with Portuguese tax law. You may request earlier deletion where no legal retention obligation applies.

7. Your Rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time where processing is consent-based.
• Lodge a complaint with the Portuguese data protection authority (CNPD).

To exercise any of these rights, email us at info@inkfest.pt. We will respond within 30 days.

8. Cookies

Our website uses only technically necessary cookies required for the shopping cart and session management. We do not use advertising or tracking cookies. No cookie banner is displayed because no consent is required for strictly necessary cookies under the ePrivacy Directive.

9. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. All data is transmitted over HTTPS.

10. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the website after changes constitutes acceptance of the updated policy.