Privacy Policy
Smorfitt Group ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect information from visitors to www.smorfitt.com and Store customers, in compliance with GDPR (Regulation EU 2016/679).
1. Data Controller
Organisation: Smorfitt Group
Data Protection Contact: Dr R Smorfitt
Email: rob@smorfitt.com
Address: Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
2. Data We Collect
2.1 Data You Provide
When you purchase or contact us we may collect: full name, email address, phone number (if provided), billing address, business details, and payment method details (processed by Stripe — we do not store card data).
2.2 Data Collected Automatically
When you visit the Website we may collect: IP address, approximate location, browser and device type, pages visited, time on page, and referring URLs, via Squarespace analytics and cookies.
2.3 Data from Third Parties
We receive order and payment confirmation data from Stripe and Squarespace to process and fulfil purchases.
3. How We Use Your Data
- To process orders and deliver digital products.
- To send order confirmations, receipts, and delivery communications.
- To respond to enquiries and provide customer support.
- To send marketing communications where permitted (you may opt out at any time).
- To improve the Website and Store.
- To comply with legal and regulatory obligations.
- To detect and prevent fraud.
4. Legal Basis for Processing
We process personal data under GDPR on the following bases: contract (Art. 6(1)(b)), consent (Art. 6(1)(a)), legal obligation (Art. 6(1)(c)), and legitimate interests (Art. 6(1)(f)).
5. Sharing Your Data
We do not sell your personal data. We may share it with:
- Squarespace: website and store hosting — squarespace.com/privacy
- Stripe: payment processing — stripe.com/privacy
- Email service providers: for transactional and marketing communications
- Legal and regulatory authorities: where required by law or court order
6. International Data Transfers
Where data is transferred outside the EU/EEA, we use Standard Contractual Clauses (SCCs) or equivalent safeguards per GDPR Chapter V.
7. Cookies
- Essential: required for the Website and Store to function.
- Analytics: Squarespace analytics for visitor behaviour.
- Payment: Stripe cookies during checkout.
You may manage cookies via your browser settings. Disabling cookies may affect Store functionality.
8. Data Retention
Order records: 10 years (EU commercial and tax law). Marketing data: until consent is withdrawn.
9. Security
We implement appropriate technical and organisational measures to protect your personal data. Payment data is handled exclusively by Stripe (PCI DSS certified).
10. Your Rights
You have rights of: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21). Contact us at rob@smorfitt.com to exercise your rights.
11. Supervisory Authority
CNPD — Comissão Nacional de Proteção de Dados (Portugal): www.cnpd.pt / geral@cnpd.pt, or the supervisory authority in your EU member state.
12. Children
The Website and Store are not directed at persons under 16. We do not knowingly collect data from children.
13. Changes to This Policy
This policy may be updated at any time. The current version is always at www.smorfitt.com/privacy-policy.
14. Contact Us
Smorfitt Group rob@smorfitt.com
Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
Smorfitt Group is committed to protecting your personal data in compliance with UK GDPR and the Data Protection Act 2018.
1. Data Controller
Organisation: Smorfitt Group
Data Protection Contact: Dr R Smorfitt
Email: rob@smorfitt.com
Address: Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
2. Data We Collect
Name, email, billing address, business details, and payment details (via Stripe — we do not store card data). IP address, browser/device type, and pages visited via Squarespace analytics.
3. How We Use Your Data
- To process orders and deliver digital products.
- To send order confirmations and support communications.
- To send marketing communications where permitted.
- To comply with legal obligations and detect fraud.
4. Legal Basis for Processing
We process personal data under UK GDPR and the Data Protection Act 2018 on the following bases: contract, consent, legal obligation, and legitimate interests.
5. Sharing Your Data
We do not sell your data. We share with Squarespace (hosting), Stripe (payments), and legal authorities where required by law.
6. International Data Transfers
Where data is transferred outside the UK, we use International Data Transfer Agreements (IDTAs) or equivalent safeguards as required by UK GDPR.
7. Data Retention
Order records: 6 years (UK Companies Act / HMRC requirements). Marketing data: until consent withdrawn.
8. Your Rights
You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent. Contact rob@smorfitt.com to exercise your rights.
9. Supervisory Authority
Information Commissioner's Office (ICO): ico.org.uk / 0303 123 1113 / casework@ico.org.uk.
10. Contact Us
Smorfitt Group rob@smorfitt.com
Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
Smorfitt Group is committed to protecting your personal information in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
1. Data Controller
Organisation: Smorfitt Group
Data Protection Contact: Dr R Smorfitt
Email: rob@smorfitt.com
Address: Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
2. Data We Collect
Name, email, billing address, business details, and payment details (via Stripe). IP address and browsing behaviour via Squarespace analytics.
3. How We Use Your Data
- To process orders and deliver digital products.
- To send order confirmations and support communications.
- To send marketing communications (opt out at any time).
- To comply with legal obligations.
4. Legal Basis for Processing
We process personal information in accordance with the 13 Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
5. Sharing Your Data
We do not sell your data. We share with Squarespace (hosting), Stripe (payments), and legal authorities where required.
6. International Data Transfers
We only transfer personal information overseas where the recipient is subject to equivalent privacy protections or you have consented, as required by APP 8.
7. Data Retention
Order records: 7 years (Australian tax law). Marketing data: until opt-out requested.
8. Your Rights
You have the right to access personal information we hold about you and to request correction of inaccurate information. Contact rob@smorfitt.com.
9. Supervisory Authority
Office of the Australian Information Commissioner (OAIC): oaic.gov.au / enquiries@oaic.gov.au / 1300 363 992.
10. Contact Us
Smorfitt Group rob@smorfitt.com
Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
Smorfitt Group is committed to protecting your personal information in compliance with the Privacy Act 2020 (NZ).
1. Data Controller
Organisation: Smorfitt Group
Data Protection Contact: Dr R Smorfitt
Email: rob@smorfitt.com
Address: Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
2. Data We Collect
Name, email, billing address, business details, and payment details (via Stripe). IP address and browsing behaviour via Squarespace analytics.
3. How We Use Your Data
- To process orders and deliver digital products.
- To send order confirmations and support communications.
- To send marketing communications (opt out at any time).
- To comply with legal obligations.
4. Legal Basis for Processing
We process personal information in accordance with the Information Privacy Principles (IPPs) under the New Zealand Privacy Act 2020.
5. Sharing Your Data
We do not sell your data. We share with Squarespace (hosting), Stripe (payments), and legal authorities where required.
6. International Data Transfers
We only transfer personal information to countries or recipients that provide comparable privacy protections, as required by the Privacy Act 2020.
7. Data Retention
Order records: 7 years (NZ tax law). Marketing data: until opt-out requested.
8. Your Rights
You have the right to access personal information we hold about you and to request correction of inaccurate or misleading information under the Privacy Act 2020. Contact rob@smorfitt.com.
9. Supervisory Authority
Office of the Privacy Commissioner: privacy.org.nz / enquiries@privacy.org.nz / 0800 803 909.
10. Contact Us
Smorfitt Group rob@smorfitt.com
Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
Smorfitt Group is committed to protecting your personal information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA).
1. Data Controller / Information Officer
Organisation: Smorfitt Group
Information Officer: Dr R Smorfitt
Email: rob@smorfitt.com
Address: Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
2. Data We Collect
Name, email, billing address, business details, and payment details (via Stripe). IP address and browsing behaviour via Squarespace analytics.
3. How We Use Your Data
- To process orders and deliver digital products.
- To send order confirmations and support communications.
- To send marketing communications where consented.
- To comply with legal obligations.
4. Legal Basis for Processing
We process personal information in accordance with the eight conditions for lawful processing under POPIA (Act 4 of 2013).
5. Sharing Your Data
We do not sell your data. We share with Squarespace (hosting), Stripe (payments), and legal authorities where required.
6. International Data Transfers
We only transfer personal information to countries or recipients that provide an adequate level of protection, as required by POPIA Section 72.
7. Data Retention
Order records: 5 years (SARS and commercial law requirements). Marketing data: until consent withdrawn.
8. Your Rights
You have the right to access, correct, and request deletion of your personal information, and to object to its processing, under POPIA. Contact rob@smorfitt.com.
9. Supervisory Authority
Information Regulator of South Africa: inforegulator.org.za / inforeg@justice.gov.za / 010 023 5207. Information Officer: Dr R Smorfitt — rob@smorfitt.com.
10. Contact Us
Smorfitt Group rob@smorfitt.com
Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
Smorfitt Group is committed to protecting your personal information in compliance with PIPEDA, Quebec Law 25, and Canada's Anti-Spam Legislation (CASL).
1. Data Controller
Organisation: Smorfitt Group
Data Protection Contact: Dr R Smorfitt
Email: rob@smorfitt.com
Address: Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
2. Data We Collect
Name, email, billing address, business details, and payment details (via Stripe). IP address and browsing behaviour via Squarespace analytics.
3. How We Use Your Data
- To process orders and deliver digital products.
- To send order confirmations and support communications.
- To send marketing communications in compliance with CASL (opt out at any time).
- To comply with legal obligations.
4. Legal Basis for Processing
We process personal information in accordance with PIPEDA and applicable provincial privacy legislation. Quebec residents: additional requirements apply under Law 25.
5. Sharing Your Data
We do not sell your data. We share with Squarespace (hosting), Stripe (payments), and legal authorities where required.
6. International Data Transfers
We transfer personal information outside Canada only to countries or recipients offering comparable protection, as required by PIPEDA Principle 7.
7. Data Retention
Order records: 7 years (CRA requirements). Marketing data: until consent withdrawn under CASL.
8. Your Rights
You have the right to access personal information we hold about you and to challenge its accuracy. Quebec residents also have rights to data portability and the right to be forgotten under Law 25. Contact rob@smorfitt.com.
9. Supervisory Authority
Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca / info@priv.gc.ca. Quebec: Commission d'accès à l'information (CAI): cai.gouv.qc.ca.
10. Contact Us
Smorfitt Group rob@smorfitt.com
Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
Smorfitt Group is committed to protecting your personal information in compliance with applicable US federal and state privacy law, including CCPA/CPRA and CAN-SPAM.
1. Data Controller
Organisation: Smorfitt Group
Data Protection Contact: Dr R Smorfitt
Email: rob@smorfitt.com
Address: Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU
2. Data We Collect
Name, email, billing address, business details, and payment details (via Stripe — we do not store card data). IP address and browsing behaviour via Squarespace analytics.
3. How We Use Your Data
- To process orders and deliver digital products.
- To send order confirmations and support communications.
- To send marketing communications in compliance with CAN-SPAM.
- To comply with legal obligations.
4. Legal Basis for Processing
We collect and use personal information as necessary to fulfil your order, to communicate with you, and as otherwise disclosed in this Privacy Policy, in compliance with applicable US federal and state privacy law.
5. Sharing Your Data
We do not sell your personal information. We share with Squarespace (hosting), Stripe (payments), and legal authorities where required.
6. International Data Transfers
Where personal information is transferred outside the US, we ensure appropriate contractual safeguards are in place.
7. Data Retention
Order records: 7 years (US tax law). Marketing data: until you opt out. We honour opt-out requests within 10 business days as required by CAN-SPAM.
8. Your Rights
California residents (CCPA/CPRA): you have the right to know what personal information we collect, to delete it, to opt out of its sale (we do not sell data), to correct inaccurate information, and to non-discrimination for exercising your rights. Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws have similar rights. Contact us at rob@smorfitt.com to exercise your rights.
9. Supervisory Authority
Federal Trade Commission (FTC): ftc.gov. State Attorneys General may also have jurisdiction. We do not sell personal information.
10. Contact Us
Smorfitt Group rob@smorfitt.com
Figueiro dos Vinhos, Leiria, Portugal, 3260-512, EU