Privacy

Status: content draft prepared on 3 August 2026. It is not approved for publication. Before launch, replace every completion field written in CAPITALS inside square brackets, confirm providers and retention periods, align the text with the Cookie Policy/CMP, and obtain merchant approval and legal review.

Last updated: [EFFECTIVE DATE]

Your privacy is important to Alvelus. This Privacy Policy explains how we process personal data when you visit our website, contact us, create an account, use the online shop or buy our products. It also explains how we intend to use Google Tag Manager, Google Analytics 4, Google Ads and related technologies, subject to the conditions and consent choices described below.

1. Who is the controller?

The controller is [FULL LEGAL NAME OF THE ENTITY OPERATING ALVELUS], with its registered address at [FULL POSTAL ADDRESS], [TAX/COMPANY NUMBER, IF APPLICABLE].

For privacy questions or to exercise your rights, contact us at [PRIVACY EMAIL] or write to the address above.

If applicable, Data Protection Officer contact: [DPO CONTACT].

2. Who and what does this policy cover?

This policy applies to the Alvelus website and online shop, including editorial pages, catalogue, basket, checkout, customer account and contact forms that may be activated.

At the date of this draft:

• the shop is built on WordPress and WooCommerce;
• the contact form shown on the website is a non-submitting preview and does not send or store messages; this section must be reconfirmed when message delivery is activated;
• the website may prepare ecommerce events in a first-party browser queue (dataLayer), but that queue does not itself send information to Google or another platform;
• external marketing tags are not loaded until the marketing configuration and consent solution have been approved and enabled.

3. What personal data may we process?

Depending on how you use the website, we may process the following categories.

3.1. Orders, checkout and customer accounts

• name;
• billing and delivery address;
• email address and telephone number;
• tax number or other invoice data, where requested or provided;
• login credentials and customer-account data;
• products, quantities, prices, discounts, currency and order history;
• payment method and payment status, without prejudice to payment details processed directly by the payment provider;
• delivery method, status and information necessary to fulfil the order;
• communications relating to an order, return, refund or customer support request;
• technical and order identifiers necessary to prevent fraud, maintain security and provide the service.

Alvelus should not receive or retain full card details where these are collected directly by the payment provider. This statement must be confirmed with [PAYMENT PROVIDER] before launch.

3.2. Enquiries

When a contact form or another contact channel is activated, we may process the subject of the enquiry, your name, email address, message and any data you choose to include. Please do not send sensitive or unnecessary information.

3.3. Technical, security and usage data

We may process IP address, request date and time, visited URL, referring URL, session identifiers, browser and device type, language, operating system, error records and information needed to deliver and protect the website. Before launch, we will confirm which of these data are logged, by whom and for how long.

3.4. WooCommerce basket and session data

WooCommerce uses strictly necessary cookies and session identifiers to maintain the basket, support checkout, authenticate accounts, remember choices and protect transactions. These mechanisms are necessary to provide requested functions and must not be used for advertising without the required consent.

3.5. Measurement and advertising data, if you consent

If we activate the tools described in section 6 and you provide the required consent, the following may be processed:

• pages and products viewed;
• searches, lists and categories viewed;
• products added to the basket;
• checkout starts and completed purchases;
• product identifiers, product names and categories, price, quantity, currency, purchase value, tax and shipping;
• order number as a transaction identifier for measurement and deduplication;
• online identifiers, cookies, device/browser information, approximate IP-based information and referral or campaign data, depending on the tool, selected settings and consent given.

The project’s ecommerce queue is designed not to include names, email addresses, telephone numbers, postal addresses, customer IDs, free-text checkout fields or other contact data. Nevertheless, technical data received by providers and combinations of online identifiers may constitute personal data.

4. Why do we process data, and on what legal basis?

Where processing relies on legitimate interests, you may ask for information about the balancing assessment and object where the law permits.

5. Cookies and consent management

We use cookies or equivalent technologies that are strictly necessary to deliver the website, session, basket, checkout, account and security. These do not depend on consent where they are genuinely necessary for a function you requested.

Analytics, advertising measurement, audience-building and personalisation cookies or technologies will be blocked or kept in a denied state until there is a valid choice, except for any limited processing that is legally permitted and clearly explained in the final Cookie Policy.

Our consent management platform, [CMP NAME], will allow you to accept, reject or manage non-essential categories and withdraw consent at any time through [“MANAGE COOKIES” LOCATION/LINK]. Withdrawal does not affect the lawfulness of earlier processing.

See our [COOKIE POLICY LINK] for the current list of cookies, providers, purposes and durations.

6. Google Tag Manager, Google Analytics 4 and Google Ads

6.1. Google Tag Manager

Google Tag Manager (GTM) is a tag-management system. Its presence does not mean that every configurable tool is active. In the Alvelus project, GTM may load only after the technical marketing and consent-readiness conditions have been enabled.

Before GTM loads, the website sets consent signals for advertising and analytics storage, advertising user data, advertising personalisation, functionality storage and personalisation storage to denied by default. Security storage remains granted where necessary to protect the service. The CMP must update these states only in line with the user’s choice.

Even where consent states are denied, some Google tag configurations may transmit limited or cookieless technical signals. The final configuration must be tested and described in the Cookie Policy before activation.

6.2. Google Analytics 4

If you consent to analytics, Google Analytics 4 may help us understand how the website is used through events such as page and product views, catalogue interactions, basket actions, checkout and purchases. We will use this information to produce statistics, evaluate performance and improve the experience.

The Google Analytics retention period will be [GA4 RETENTION PERIOD]. Before launch, we will confirm retention settings, Google signals, user-provided data, links between Google products and other optional features. Features that expand advertising or identification must not be enabled without assessment, consent and an update to this policy.

6.3. Google Ads

If you consent to advertising, we may use Google Ads to:

• measure whether a visit or campaign resulted in a purchase or other action;
• deduplicate conversions using the transaction identifier;
• evaluate campaign performance;
• create remarketing audiences;
• serve or personalise advertising where that option has been approved and consented to.

Measurement or personalisation may use cookies, online identifiers, campaign information and ecommerce events. ad_storage, ad_user_data and ad_personalization will remain denied until valid consent exists for the relevant purposes.

6.4. Other related services

A future configuration may map consented events to other platforms, such as Meta, but no additional platform should be activated without identifying it in the CMP and updating this policy and the Cookie Policy. Google Merchant Center may receive catalogue data for product adverts or listings; it is a product-data destination and should not receive customer data from the project’s event queue.

For more information about Google’s processing on partner websites and apps, see:

• Google Privacy Policy;
• How Google uses information from sites or apps that use its services;
• My Ad Center;
• Google Analytics Opt-out Browser Add-on.

7. Who may receive the data?

We share data only as necessary with recipient categories such as:

• hosting, infrastructure, maintenance, security and backup providers: [IDENTIFY RELEVANT PROVIDERS];
• WooCommerce and store technology providers, where applicable;
• payment provider: [NAME];
• carriers and logistics partners: [NAMES/CATEGORIES];
• email or customer-support providers: [NAMES];
• CMP provider: [NAME];
• Google Ireland Limited and other relevant Google entities for GTM, Analytics and Ads, only in line with the applicable configuration and consent;
• accountants, auditors, advisers, insurers, public authorities and courts where necessary or legally required.

We do not sell personal data. If we use data for personalised advertising or sharing that an applicable jurisdiction treats as a “sale” or “sharing”, we will provide the legally required controls.

8. International transfers

Some providers may process data outside the European Economic Area. Where this occurs, we will use a transfer mechanism recognised by applicable law, such as an adequacy decision or Standard Contractual Clauses, together with supplementary safeguards where required. The final version must identify the providers actually engaged, relevant processing locations and applicable safeguards.

9. How long do we retain data?

We retain data only for as long as needed for its purpose and applicable obligations. Complete and approve this table before launch:

We may retain information for longer where necessary to comply with law, resolve disputes, or establish and defend legal claims.

10. What are your rights?

Subject to applicable law, you may request:

• access to your personal data;
• correction of inaccurate or incomplete data;
• erasure;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests or for direct marketing;
• withdrawal of consent at any time;
• information about automated decisions, where applicable.

Send requests to [PRIVACY EMAIL]. We may ask for reasonable information to verify your identity and protect your data.

You may also lodge a complaint with Portugal’s Comissão Nacional de Proteção de Dados (CNPD) or the competent supervisory authority where you live or work.

11. Automated decisions and profiling

We do not intend to use website data for solely automated decisions that produce legal or similarly significant effects. If consented to, personalised advertising and audience-building may involve profiling to select or measure adverts, but they should not determine whether you may buy products or exercise your rights. We will update this section if the practice changes.

12. Children and alcoholic beverages

The website and shop are intended for adults who are legally permitted to buy alcoholic beverages in their country. We do not intend knowingly to collect children’s data or direct alcohol advertising to minors. Campaigns must apply age and location restrictions appropriate to each market.

13. Security

We use technical and organisational measures appropriate to the risk to protect data against loss, misuse, unauthorised access, alteration or disclosure. No system is completely secure; we will maintain prevention, detection and response processes and require appropriate safeguards from relevant providers.

14. External links

The website may link to external services, including Google Maps. When you follow a link, the external service processes information under its own policies. The contact page uses a link to Google Maps rather than an embedded map; Google receives the request when you choose to open that link.

15. Changes to this policy

We may update this policy to reflect legal, operational or technical changes. We will publish the updated version on this page and show its revision date. Where a change is material, we will provide an additional notice or renew consent where required.

16. Contact details

• Controller: [LEGAL NAME OF CONTROLLER]
• Address: [POSTAL ADDRESS]
• Email: [PRIVACY EMAIL]
• Telephone: [TELEPHONE, IF APPLICABLE]