privacy policy

Last updated: 23 October 2026

1. Who we are

ALL TOGETHER GREENS, LDA
Registered office: Avenida dos Bombeiros Voluntários, 731, 2765-202 Estoril, Portugal
Store and collection point: Avenida António Augusto de Aguiar, 88C, 1050-018 Lisbon, Portugal
Commercial registration / tax number (NIPC/NIF): 518155951
Email: geral@alltogethergreens.com
Website: https://alltogethergreens.com

We are the data controller for the personal data described in this policy. We are not required to appoint a Data Protection Officer; for any privacy matter, please use the email address above.

This policy is issued under Regulation (EU) 2016/679 (GDPR), Portuguese Law No. 58/2019 and Law No. 41/2004 on privacy in electronic communications.

2. What personal data we collect

• Identification and contact: name, email address, mobile number.
• Order data: items ordered, customisations, order number, collection store, collection time, order value, order history.
• Payment data: payment method, card brand and last four digits, transaction reference. We never see or store full card numbers.
• Billing data: billing name and address, tax number (NIF) where you request it on the invoice.
• Account data: username, hashed password, saved favourites, preferred store.
• Dietary and allergen information: allergies, intolerances or dietary requirements that you voluntarily tell us — see section 4.
• Communications: emails, contact forms, chat and social media messages, customer service records, reviews.
• Marketing: subscription status, consent records, opens and clicks.
• Loyalty: points balance, rewards earned and redeemed.
• Technical: IP address, device and browser, operating system, language, pages viewed, cookie identifiers.

We do not operate video surveillance on our premises and we therefore do not collect any CCTV images of you.

3. Why we process it, and on what legal basis

• Taking, preparing and handing over your order — performance of a contract, Art. 6(1)(b).
• Notifying you that your order is ready for collection — performance of a contract, Art. 6(1)(b).
• Payment processing — performance of a contract, Art. 6(1)(b).
• Fraud prevention and payment security — legitimate interests, Art. 6(1)(f).
• Invoicing, accounting and tax records — legal obligation, Art. 6(1)(c).
• Food safety and traceability, including responding to an allergen incident or a public health enquiry — legal obligation, Art. 6(1)(c), under Regulation (EC) No 178/2002 and Regulation (EU) No 1169/2011.
• Handling merchandise returns, withdrawals and conformity claims — contract and legal obligation, Art. 6(1)(b) and (c).
• Customer support, complaints and refunds — contract and legal obligation.
• Newsletter and commercial offers — consent, Art. 6(1)(a); or the customer soft opt-in under Art. 13-A of Law No. 41/2004.
• Loyalty programme — performance of a contract, Art. 6(1)(b).
• Analytics — consent, Art. 6(1)(a), through the cookie banner.
• Establishing, exercising or defending legal claims — legitimate interests, Art. 6(1)(f).

4. Allergen and dietary information — special category data

If you tell us about an allergy, an intolerance or a medical dietary requirement, that information concerns your health and is a special category of personal data under Article 9 GDPR. We therefore apply additional safeguards:

• We process it only on the basis of your explicit consent under Art. 9(2)(a), given when you enter it in the order notes or the dietary preferences field.
• We use it exclusively to prepare your order safely and to respond to a food safety incident. We never use it for marketing, profiling or customer segmentation.
• It is visible only to the kitchen and service staff who need it to fulfil your order, all of whom are bound by confidentiality obligations.
• It is deleted 30 days after the order, except where retention is necessary because an incident or claim is open.

You may withdraw your consent at any time by contacting us. If you do, we will no longer be able to accommodate that requirement in future orders.

Please do not include medical details beyond what is strictly necessary. The allergen itself is enough — we do not need your diagnosis, your medication or your medical history.

5. Who we share it with

We do not sell your personal data. We share it only with the following recipients:

• Website, online ordering and store platform — Shopify International Limited (Ireland), which hosts this site, processes orders and provides our transactional emails and our point of sale.
• Payment service providers — Shopify Payments, operated by Shopify International Limited, together with Klarna Bank AB for Klarna payments, SIBS for Multibanco, and Apple and Google for their respective wallets. These act as independent controllers for anti-fraud and regulatory purposes.
• Order preparation and printing — PrinterCo, which prints kitchen tickets for orders placed on this site.
• Store applications — Easify (product customisation options), BON Loyalty, operated by Botpro Solutions (points programme), Seal Subscriptions and Supr (subscriptions), and Instafeed (Instagram feed). Each of these accesses only the data it needs for its function.
• Email marketing and CRM — Shopify Email, provided by Shopify International Limited.
• Analytics — Google Analytics 4, provided by Google Ireland Limited, only where you have given consent.
• Merchandise suppliers and carriers, where a merchandise item needs to be sourced or returned.
• Accountants, auditors and legal advisers, bound by professional secrecy.
• Public authorities where legally required — including the tax authority, the courts, and food safety authorities such as ASAE, DGAV or the local health authority in the event of a food safety investigation.

All processors act under a written data processing agreement compliant with Article 28 GDPR.

6. International transfers

Some of our providers may process personal data outside the European Economic Area. Where that happens, we rely on:

• a European Commission adequacy decision, including the EU–US Data Privacy Framework for certified US providers; or
• the European Commission's Standard Contractual Clauses, together with supplementary technical and organisational measures where necessary.

You may request a copy of the safeguards in place by writing to geral@alltogethergreens.com.

7. How long we keep it

• Invoices, accounting and tax records — 10 years.
• Food order records, for traceability — 24 months.
• Allergen and dietary information — 30 days after the order, unless an incident is open.
• Merchandise order records — 3 years from handover, matching the statutory conformity guarantee.
• Account data — while the account is active; deleted 24 months after inactivity or on request.
• Customer service correspondence — 24 months from closure of the enquiry.
• Loyalty programme data — while the account is active; points expire with the account.
• Marketing data — until consent is withdrawn; consent and objection records kept 5 years as proof of compliance.
• Cookies and analytics data — as stated in section 10.
• Data relevant to a legal claim — until the applicable limitation period expires.

When a retention period ends, we securely delete or irreversibly anonymise the data.

8. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate or incomplete data;
• request erasure of your data, where the conditions are met;
• restrict processing in certain circumstances;
• receive your data in a portable, machine-readable format (data portability);
• object to processing based on legitimate interests, and object at any time to direct marketing;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise any right, write to geral@alltogethergreens.com or to our registered address. We reply within one month, extendable by two further months for complex requests. We may ask for reasonable proof of identity. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

9. Right to lodge a complaint

If you believe we have not handled your personal data lawfully, you may complain to the Portuguese supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1.º — 1200-651 Lisboa, Portugal
Telephone: +351 213 928 400 — Email: geral@cnpd.pt — www.cnpd.pt

You may also complain to the supervisory authority of your EU country of residence.

10. Cookies and similar technologies

Strictly necessary cookies. Used for session management, the shopping basket, checkout, security and to remember your cookie choices. Consent required: no. Typical duration: from the session up to 12 months.

Functional cookies. Remember your preferred language, your chosen currency and your saved preferences. Consent required: yes. Typical duration: up to 12 months.

Analytics cookies. Collect information about site traffic and performance so that we can improve the site. We use Google Analytics 4 and Shopify's own store analytics. Consent required: yes. Typical duration: Shopify analytics cookies up to 12 months; Google Analytics cookies up to 24 months, with data retained in our Google Analytics property for 14 months.

Marketing cookies. We do not currently use advertising or retargeting cookies on this site. If we introduce them, this policy will be updated and your consent requested beforehand.

You can change or withdraw your choices at any time through the cookie settings in our footer, or by clearing cookies in your browser. Blocking strictly necessary cookies may prevent the site from working.

11. Security

We apply appropriate technical and organisational measures, including TLS/SSL encryption in transit, role-based access control, password hashing, regular backups, software updates, staff confidentiality obligations and written processor agreements.

No system is completely secure. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you and the CNPD as required by Articles 33 and 34 GDPR.

12. Minors

Our online ordering service is intended for people aged 18 or over. We do not knowingly collect data from children. Under Article 16 of Portuguese Law No. 58/2019, the minimum age for consent to information society services is 13. If you believe a minor has provided us with personal data, contact us and we will delete it.

13. Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you. Our payment provider may run automated fraud checks that can result in a transaction being declined; you may contact us to request human review.

14. Changes to this policy

We may update this policy from time to time. The version in force and its date are always shown at the top of this page. Material changes will be communicated by email or through a prominent notice on the site before they take effect.