Privacy Policy

Last updated: 3 November 2026

This policy explains what personal data is collected on the site alexandrecoxo.com, why, who it is shared with, how long it is kept and what rights you have over it. Processing is carried out in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the applicable Portuguese legislation.

1. Who is responsible for your data

The data controller is Alexandre Coxo, visual artist, with a studio in Porto, Portugal. For any question about your personal data, or to exercise your rights, write to info@alexandrecoxo.com.

2. What data we collect and why

Shop purchases

When you place an order we ask for your name, email address, billing and shipping address, country and, optionally, phone number and tax number. We use this data to process and ship the order, issue the invoice, communicate with you about the purchase (confirmation, dispatch, tracking) and meet tax obligations.
Legal basis: performance of the sales contract and compliance with legal obligations. Without this data the order cannot be completed; the phone number and tax number are optional.

Payment details (card, MB WAY, Multibanco reference) are entered and processed directly by the payment providers. The site never sees or stores your card numbers.

Customer account

If you create an account, we keep your name, email, addresses and order history, so that you can follow your purchases and do not have to re-enter your details.
Legal basis: performance of the contract and your request to create an account.

Messages and commission requests

When you write to us through the site's forms or by email (requests for information, custom paintings, workshops, classes), we use your name, email and the content of the message to reply. With a custom painting request you may also send us preferences and images, which are used only to carry out that work.
Legal basis: pre-contractual steps at your request and our legitimate interest in replying to those who contact us.

If you subscribe to the newsletter, we use your email to send you news about works, exhibitions and workshops, usually once a month. The subscription only becomes active after you confirm it through the link we email you; we keep your email, the date of the request and of the confirmation, and the IP address of the request, as proof of your consent. The list is stored on the site itself. You can unsubscribe at any time through the link at the end of each email or by writing to us. Links in newsletter emails go through the site, which records which link was opened, when and by which recipient, so that we know which content is of interest and so that files sent can only be downloaded by those who received them; these records are deleted after 24 months.
Legal basis: your consent.

Visit statistics

Only if you accept in the cookie notice do we use Google Analytics to learn, in aggregate, how the site is visited (pages viewed, where visits come from, type of device) and to improve it. Without that permission, statistics cookies are not created.
Legal basis: your consent, which you can withdraw at any time in “Cookie settings”, in the footer.

Site operation and security

The server automatically records technical data for each request (IP address, date and time, page requested, browser), used to ensure security and solve technical problems.
Legal basis: legitimate interest in the security and proper functioning of the site.

3. Who we share data with

We do not sell or pass on your data for third-party commercial purposes. We only share it with the service providers needed to run the site and process orders, who handle it on our behalf:

Hetzner Online (Germany): hosting of the site and database.
Stripe: card payments.
ifthenpay (Portugal): Multibanco and MB WAY payments.
CTT – Correios de Portugal: shipping of orders (recipient's name, address and contact details).
Brevo (France): sending of the site's emails (order confirmations, replies to forms, newsletter subscription confirmation) and, when applicable, the newsletter.
Google: statistics (Google Analytics, only with consent), automatic translation of pages when you choose another language (Google Translate) and the site's typefaces (Google Fonts).
Font Awesome and Cloudflare (cdnjs): icons and technical libraries loaded by the browser.

We may also disclose data when required by law (for example, at the request of the Tax Authority or a court) or to protect rights and prevent fraud.

4. Transfers outside the European Union

Some of these providers (Google, Stripe) belong to companies based in the United States. In these cases, transfers are made under the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

5. How long we keep data

Orders and invoices: 10 years, as required by tax law.
Customer account: for as long as the account exists; you can request its deletion at any time (invoices are kept for the legal period).
Messages and requests: up to 3 years after the last contact.
Newsletter: until you unsubscribe; unconfirmed requests are deleted after 30 days.
Log of emails sent by the site: 24 months.
Server technical logs: 14 days.
Google Analytics statistics: according to the retention period set in Google Analytics; cookies last up to 2 years.

6. Cookies

Cookies are small files stored by the browser. When you first visit the site, a notice lets you accept or decline the cookies that are not necessary. You can change your choice at any time in “Cookie settings”, in the footer.

Necessary (they do not need consent, because the site cannot work without them):

woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*: shopping cart (up to 2 days, or the session).
wordpress_logged_in_*, wordpress_sec_*: session, if you log in to your account.
__stripe_mid, __stripe_sid: fraud prevention for card payments (up to 1 year / 30 minutes).
googtrans: language chosen in the language selector (only if you change language).
ac_cookies (browser local storage): stores your cookie choice.

Statistics (only with your consent):

_ga, _ga_* (Google Analytics): distinguishing visitors and sessions (up to 2 years).

You can also delete or block cookies in your browser settings; if you block the necessary ones, the cart and payment may stop working.

7. Your rights

You may, at any time and free of charge, request:

access to the data we hold about you;
rectification of incorrect or incomplete data;
erasure of the data, where there is no legal obligation to keep it;
restriction of processing;
portability, that is, a copy of the data you provided to us in a commonly used format;
objection to processing based on legitimate interest;
and withdrawal of consent (newsletter, statistics), without affecting what was done before.

Just write to info@alexandrecoxo.com. We reply within one month. If you believe your data is not being processed correctly, you can lodge a complaint with the Portuguese Data Protection Authority, CNPD (www.cnpd.pt).

8. Security

The site uses an encrypted connection (HTTPS) on every page, with an automatically renewed Let’s Encrypt certificate. Access to the administration and the database is restricted, the software is kept up to date and daily backups are made.

9. Minors

The site is not intended for children under 16, and we do not knowingly collect data from minors without the authorisation of whoever holds parental responsibility.

10. Changes to this policy

This policy may be updated, for example when the site starts using a new service. The date of the last update is always shown at the top of this page.