Updated on 15 October 2026. This policy explains how personal data is processed on the RedeShop website, the retention periods and the choices available to visitors.
1. Who is responsible for your data
The data controller is RedeShop Solutions, Unipessoal Lda, Portuguese tax identification number (NIF) 516392972, at Rua dos Curros, 9, Sobreposta, 4715-553 Braga, Portugal. For privacy matters or to exercise your rights, contact info@redeshop.pt, specifying your request and the information needed to identify you.
2. What information we collect
When you request a consultation, quotation or assistance, we collect your name, email address, the needs you describe, your platform, the urgency and the type of support. Your website address is optional. The enquiry may include the service you were viewing, the form page and limited browsing context, such as the landing page and the previous page, without personal parameters in the URLs.
The required fields allow us to assess and respond to your enquiry; the form cannot be submitted without this information. Avoid including passwords, payment details, health data or information about your customers in the message field. If providing the service requires technical access, we will agree a suitable way for you to share it.
The application records when the enquiry was received, your acknowledgement that you have read the privacy information, the email notification status and the commercial follow-up of the enquiry. To prevent abuse and duplicate submissions, it also processes technical request identifiers and an identifier derived from the IP address using a keyed cryptographic function. This identifier is pseudonymised, not anonymous. The hosting server and email service may keep their own technical logs.
3. Purposes and legal bases
We assess and respond to enquiries from people seeking to purchase a service in order to take steps at their request before entering into a contract. When the contact is a company representative or the enquiry concerns a general question, processing is based on our legitimate interest in responding and maintaining the professional relationship, balanced against the individual's rights. Preventing fraud, abusive submissions and duplicates is based on our legitimate interest in protecting the website and communications.
If a contract is agreed, the data needed to provide the service are processed to perform that contract; invoicing and other legal obligations are based on compliance with the law. Establishing, exercising or defending legal claims may justify retaining relevant information. Optional browsing measurement requires prior consent, as explained below.
The acknowledgement required on the form records that you have read this information; it is not a marketing subscription and does not replace the legal bases described above. Submitting the form does not subscribe you to a newsletter. We do not use these enquiries for decisions based solely on automated processing that produce legal or similarly significant effects.
4. Where enquiries are stored and who can access them
Your enquiry is stored in RedeShop’s restricted administration area. A notification is sent to info@redeshop.pt with a reference and a link to the protected dashboard, without copying your name, email or message. The team opens the enquiry and uses the email provided to reply. Access is limited to people who need the information for enquiry handling, service delivery and systems administration.
WebTuga, a brand of Dream Fusion - IT Services, Lda, is the confirmed hosting and email provider. According to the provider's public information, web hosting is supplied from data centres in Portugal. These services may process data on RedeShop's behalf to the extent necessary to provide them. Authorities and professional advisers may receive information where there is a legal obligation or a duly assessed legitimate need. We do not sell data from contact enquiries.
Hosting and email are subject to the service and data protection terms applicable to the contracted service. The provider’s technical logs support operation and security, according to the relevant purposes and obligations. If you accept optional measurement, Google Ireland Limited receives the data needed for Google Analytics; Google LLC and other Google providers may process it outside the European Economic Area, including in the United States. Google publishes the safeguards applicable to transfers, including the EU–US Data Privacy Framework for certified entities and standard contractual clauses in the relevant circumstances. You can consult the links below and request clarification from RedeShop.
5. How long we retain data
For requests for a consultation, quotation or assistance that do not lead to a contract, RedeShop sets a maximum retention period of 12 months after the last commercial interaction with the person concerned. This is the last communication relating to the enquiry, through a form, email or another agreed channel; internal status changes or technical resending of notifications do not restart the period. If a contract is agreed, the information needed for the contractual relationship is subject to service requirements and applicable statutory retention periods. A legal obligation or the establishment, exercise or defence of legal claims may justify retaining only the relevant information for longer, with limited purposes and access.
Enquiries that do not lead to a contract are deleted from the active database when they reach 12 months, through an automated daily review. The team records the last genuine business communication; status changes, future tasks and notification retries do not restart the period. Contracts and documented legal exceptions are excluded from this deletion and reviewed monthly. You may request earlier deletion where the legal conditions are met. Replies and any older messages in the mailbox controlled by RedeShop follow the same necessity criterion and are subject to targeted review.
6. Cookies, language and browser storage
A language preference selected manually may be stored in the redeshop_language cookie for 180 days. It remembers your choice and is not used for advertising. You can change it using the language selector or delete the cookie in your browser settings. Initial language detection uses the language preferences sent by your browser, without determining your location or sending page text to an external translation service.
Your choice in the appearance selector (Automatic, Light or Dark) is saved in this browser’s local storage, under the key redeshop.appearance.v1, to keep your preference. In Automatic mode, the site follows your system’s appearance setting. You can change your choice using the appearance selector or remove it by clearing this site’s data in your browser. This preference contains no identifier and is not sent to the server or Google Analytics.
Administration requires authentication and is reserved for the team; this website has no public customer accounts or checkout. Minimal navigation context used to understand an enquiry may remain in memory during the visit and accompany the form, even without optional measurement.
The public website uses Google Analytics 4 only after you accept statistics. It measures page views and interactions with calls to action, contact links and the form; an enquiry is counted as a lead only after its registration is confirmed. Page paths are limited to public content, without personal query parameters or fragments. External referrers are reduced to their public origin; campaigns use recognised values from closed lists. We do not send names, email addresses, telephone numbers, messages, website addresses entered in the form or enquiry identifiers to Google. Google receives pseudonymous identifiers and technical browser/device data; communication with its servers involves the IP address. This measurement is not fully anonymous.
You can accept or refuse statistics in the initial notice and change your choice through “Cookie preferences” in the footer, without preventing access to the form or content. Before acceptance, the Google tag is not loaded and no measurement events are sent to Google. The choice is stored in local storage redeshop:analytics-consent:v2 for 180 days, without automatic renewal through browsing. Refusal has the same duration. Withdrawal stops measurement, removes statistics cookies accessible to the site and reloads the page; it does not retrospectively erase data already received by Google. You can exercise the applicable rights using the contacts in this policy.
After acceptance, _ga and _ga_5V69SFLNJ0 cookies distinguish the browser and maintain session state, with a configured lifetime of 180 days and no automatic renewal on each visit. Recognised campaign context and identifiers used to avoid duplicate counts are limited to the session in redeshop:contact-context:v1 and redeshop:confirmed-leads:v1; refusal removes that persisted context. The functional language preference retains its own duration stated above.
The existing Google Analytics property retains detailed event and user data for 14 months. Reset on new activity is enabled for user data and may renew that period when new activity occurs. These controls do not limit standard aggregated reports in the same way. The property’s 14 months are separate from the cookies’ 180 days and the 12-month rule for contact enquiries.
The existing Analytics account settings allow sharing with Google for product and service improvement, modelling and business insights, technical support and business recommendations, in accordance with Google’s terms and information. In this implementation, Google signals, ad personalisation and user-provided data features are blocked; Google Ads and Google Tag Manager tags are not loaded. Accepting statistics does not subscribe you to marketing or authorise personalised advertising.
How Google uses data from sites using its services
Google’s safeguards for international data transfers
7. Reviews, external links and recruitment
The reviews shown on the website are excerpts selected and added by RedeShop, with the rating and attribution displayed. No Google widget is loaded to show them. Following a link to Google or another external website means using a service with its own privacy rules.
The roles shown on the recruitment page are proposals under review, not open vacancies. There is no active form collecting CVs. Any future collection of applications will include its own information about purposes, access and retention.
8. Your rights and how to exercise them
Under the terms and conditions of the GDPR, you may request access to, rectification or erasure of your data, or restriction of processing; object to processing based on legitimate interests; and request data portability where applicable. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Not all rights apply in the same way to every processing activity, and certain legal obligations may prevent immediate erasure.
Send your request to info@redeshop.pt. We may ask only for information that is proportionately necessary to confirm your identity. We will respond within the statutory deadlines, generally within one month; any legally permitted extension will be communicated to you. You may also lodge a complaint with Portugal's data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).
View rights information and CNPD contact details
9. Security, changes and language versions
The website uses HTTPS, authenticated administration and validation and abuse-prevention measures. Application recovery backups have restricted access and a maximum rotation period of 30 days. They are not used for business outreach. Following restoration, deletion rules are reapplied before use resumes. Migration archives and hosting logs are handled separately, with limited access and review according to necessity and applicable obligations. No system offers absolute security; do not send credentials through the form.
This policy will be reviewed when processing activities or website services change. Translations are intended to make the same processing activities easier to understand; they do not represent the purchase of real-time translation services or remove legal rights from residents of other countries. Any material change will be reflected in the language versions before publication.
10. AI virtual assistant
The RedeShop virtual assistant is an artificial intelligence system, not a member of the team. Using it is optional. Messages are only sent to OpenAI after you explicitly start the conversation, following the information shown in the panel. It answers using public information about RedeShop services. Answers may contain errors and do not constitute a quotation, confirmation of availability or guarantee of prices or results; the team confirms the terms of the service.
To generate an answer, the text you enter and the recent conversation context are sent to OpenAI through its API. We use filters to reduce common patterns of email addresses, phone numbers and credentials, but they do not guarantee removal of all personal or confidential information. Do not enter passwords, access keys, payment details, sensitive data or client information. Details entered in the contact form are not sent to the AI model.
The RedeShop application does not save conversation content in its database, application logs or browser local storage. Conversation history remains only in the tab’s memory during use and is removed when you clear the conversation, reload the page or close the tab. To limit abuse, we keep technical counters with a pseudonymised identifier derived from the IP address using a keyed cryptographic function, expiring within 48 hours, and monthly aggregate usage counters without conversation content. Hosting technical logs follow the separate rules already described in this policy.
API requests use store:false so that the response is not saved as application state. This does not mean zero retention: according to OpenAI documentation, API data is not used to train models by default, but abuse monitoring logs may include messages and answers and may be retained for up to 30 days, or longer if required by law or reasonably necessary to prevent harm. Processing may take place outside the European Economic Area, including in the United States; we do not claim that processing is exclusively within the European Union. See the OpenAI data documentation and data processing addendum linked below.
You can request contact or a quote inside the assistant window, including without AI answers. The application flow collects only name, phone, email and project context. Company, budget, platform and website are not required. The context uses needs already explained; you can correct or add information in the summary before confirming. Contact fields and messages in this flow are handled by the application without being sent to the AI model. The enquiry is sent only after explicit confirmation and acknowledgement of this policy, saved in the private Payload enquiries collection, and the team receives the usual reference-only notification with a link to the protected panel. The 12-month limit for enquiries without a contract applies. The full chat is not attached: only the context you review and confirm accompanies the enquiry. Before submission, data stays in tab memory; cancelling or clearing the conversation removes it from this flow. On failure, data and the enquiry identifier remain in memory for a retry without duplication. Closing the assistant keeps the draft while the tab is open; reloading or closing the tab clears unsent data. Starting the assistant or sending an enquiry does not subscribe you to marketing.
OpenAI: API data use and retention