The protection, security and privacy of your personal data is very important to XVIII. That is why we have developed a set of security measures aimed at protecting your data.

The user is not required to provide XVIII the personal data it may request, but if you choose not to do so, we may not be able to provide you with our products or services.

Who collects your personal data and who is the data controller?

XVIII - Azulejo & Faiança, Unipessoal, Lda., a sole shareholder private limited liability company, with tax number 515654361 and registered office located at Av. da Liberdade, 249 - 1, 1250-143 Lisbon, Portugal.

By registering or purchasing online, the user expressly authorizes XVIII to collect and retain personal data provided, as well as data relating to their purchases. The data will be stored and processed by computer in accordance with the law in force and are for purposes strictly related to the services available on the website.

The user expressly authorize that the personal data provided will also be processed and used by third parties in the context and for the purposes strictly related to the services provided on the website. Access to information by third parties is restricted and is solely for the purpose of satisfying your order, payment, delivery processing and customer support.

The user expressly authorizes the data provided to be used by XVIII for direct marketing purposes.

The user who, without consent, provides XVIII with personal data from third parties, assumes before them and XVIII exclusive responsibility for any misuse of such data.

Failure to provide some requested personal data may impede the processing of your order or other services provided by the website.

How do we collect your personal data and what kind of data do we collect?

XVIII may collect your personal data in a variety of ways, including when you subscribe to our newsletter, fill out any of our website forms, make a purchase, request a return, communicate with our customer support team and make a reservation.

The data collected is always as few as possible to ensure the response to the request made and the overall good management of the website.

In order to provide the user with a faster and more personalized service, XVIII uses “cookies” that allows him to personalize its products, services and website according to his interests and needs, enabling to streamline his future activities and experience on the XVIII website. Thus some data regarding IP address, device ID, location data, can be collected, as well as computer and connection related information such as "browser type and version, time zone settings, plug-in types and versions used by the browser, operating system and purchase history. During your XVIII website browsing we may also use software tools to measure and collect session information, including page response times, download errors, duration of visit to certain pages, information about your interaction with them, and the methods used to exit them. We may also collect technical information to help us identify your device for fraud prevention and diagnostic purposes.

Any user can, nonetheless, configure their browser to prevent “cookies” from being installed on their computer. This option may, however, slow down browsing.

In addition, XVIII also processes your personal data through automated means. An automated decision is a resolution made exclusively by automatic means, where no human being is involved in the decision process that involves their personal data. For example, XVIII processes your personal data using automated means when it is sent to the company that processes your Credit Card payment.

For what purposes and on what basis is your personal data processed?

Your personal data is collected and processed exclusively within the services provided by XVIII. In particular, we collect and process your personal data to:

Manage your registration;
Process your payments;
Deal with your questions, requests and complaints;
Communicate with you (by email, SMS or other forms of electronic communication);
Authenticate the identity of individuals who contact us by telephone, electronic means or other;
Information purposes, market statistics and improvement of our services;
Provide you with personalized products and communications, as well as targeted advertising and product recommendations.

In order to provide as complete a service as possible to its customers, XVIII partners with external service providers who perform functions on behalf of XVIII, such as companies hosting or operating the www.xviii.pt website, processing payments, analyse data, provide postal or delivery services. So, your personal data may be used and/or processed by those third parties for purposes strictly linked to the services provided on the website. Access to your personal data by third parties is limited and is solely for the purpose of fulfilling an order, making a payment, processing a delivery, or customer support.

In addition, such third parties must process your personal data in accordance with this Privacy Policy and in accordance with applicable law.

XVIII may itself be subject to legal obligations regarding the processing and making available of personal data concerning users of the website. Such as guarding the invoice for control in accordance with the VAT Code and exercising or defending a right in court proceedings.

All the above purposes of processing are based on your consent. You may withdraw such consent at any time (see “How can customers change their consent or delete their data?”) but this will not affect the processing previously made based on your consent until such date.

How do we keep your personal data secure?

All collected data is encrypted using a security certificate – SSL.

The data is stored in a database and used exclusively by XVIII. We continuously monitor access to the information technology systems to prevent, detect and impede misuse of your personal data.

Access to your personal data is only allowed under the terms described above, always depending on the actual need for its knowledge, and subject to strict contractual obligations of confidentiality when processed by third parties.

While data transmission over the Internet or a website cannot guarantee complete security, including intrusion, XVIII and its service providers are making best efforts to implement and maintain physical, electronic and procedural security measures to protect your personal data in accordance with legal requirements.

It is advisable that your computer be equipped with software devices that protect you in transmitting and receiving data (such as up-to-date antivirus systems), and that your browser takes appropriate measures to ensure data transmission security (such as firewall and anti-spam filters).

How long do we keep your personal data?

XVIII will only keep your data for as long as necessary and for the purpose for which it was collected. In the case of contact forms, the data shall be deleted within 12 months.

We store identifiable data that we collect directly for specific purposes for the shortest possible time, after which we will take steps to permanently delete it (see Cookie Policy).

With whom is your data shared?

Your personal data may only be shared with third party external service providers related to the www.xviii.pt website operation, such as hosting companies, processing companies, analysing data, providing postal or delivery services, and sponsors or other third parties who participate in or administer XVIII promotions. In this context, your personal data may be shared with the following companies: Paypal, Stripe (Credit and Payment Cards), Thisislove (website development and maintenance), as well as other service providers we may turn to in the future.

What are your rights?

If wished, customers may at any time exercise the right of access, modification, updating, rectification, deletion, limitation and portability of their data, a right foreseen in the General Data Protection Regulation, approved by the European Parliament and Council Regulation (EU) 2016/679 of 27 April 2016.

How can customers change their consent or delete their data?

All our customers will be able to delete their account and their personal data through their reserved area.

To unsubscribe from the newsletter, users will be able to remove their email by clicking on “Unsubscribe” available in all emails.

You can also email info@xviii.pt with your request at any time and we will respond immediately.

And regarding the right to data portability?

All our customers will be able to download, in JSON format, the data that XVIII has collected. The download is available in your “My Account” area.

The personal data holder also has the right to complain to the supervisory authority (Comissão Nacional de Proteção de Dados | Av. D. Carlos I, n.º 134 – 1.º, 1200-651 Lisboa | Tel.: +351 213928400 | Fax: +351 213976832 | email: geral@cnpd.pt) about how we treat your personal data.

For any questions about this Privacy Policy and the treatment and use we make of your personal data, or if you would like to make a complaint about a possible violation of privacy laws, please contact the data controller via info@xviii.pt.

XVIII will update its Privacy Policy as necessary, taking into account user feedback, changes to our products and services, and changes to legally necessary requirements.

If such changes imply a significant modification of this Privacy Policy, the data holders will be duly notified and their consent will be requested whenever necessary.