01
Who is responsible
Store Steward is the trading name used by Bruno Ponce de Leão, established in Portugal. He is the controller of personal data used to run this website, respond to enquiries, manage client relationships and meet business obligations.
For privacy questions or requests, write to hello@storesteward.com.
02
When this policy applies
This policy covers visits to storesteward.com, enquiries by email, proposals, payments, delivery of digital services and individual business introductions. Digital services may involve websites and online stores, documents and data, or content and visuals.
If a client gives us personal data about its own customers, staff or other people so we can complete a project, the client's instructions and any applicable data processing agreement also govern that work. The client remains responsible for the privacy information it gives those people.
03
Information we receive
From you or your organisation
We may receive your name, role, business contact details, organisation, website or store URL, project brief, correspondence, approvals, billing details and payment status. A project may also require files, spreadsheets, documents, images, recordings, screenshots or access details needed for the agreed work.
Please do not send passwords, authentication codes, payment card details, sensitive personal data or unrelated customer records in an initial enquiry. We will agree a suitable way to handle any information that is necessary later.
From the website
The hosting provider may process technical data needed to serve and protect the site, such as IP address, browser information, request time and server or security logs.
From public business sources
For relevant individual business contact, we may use limited professional information from public business websites and profiles: a name, role, work contact address, company and public website. We do not use purchased mass mailing lists or email open tracking. You may object to this contact at any time.
04
Why we use it
- Enquiries and proposals: to understand a request, answer it and prepare a scope or quote. The basis is steps requested before a contract, or our legitimate interest in handling a business enquiry.
- Project delivery: to carry out agreed work, communicate, record instructions and approvals, test results and deliver files or reports. The basis is performance of a contract with you, or our legitimate interest in fulfilling a business contract where our contact is not the contracting person.
- Payments and records: to confirm payment, issue invoices and comply with accounting and tax duties. The basis is the contract and legal obligations.
- Security and claims: to protect the site, prevent misuse, maintain a necessary work history and establish or defend legal claims. The basis is our legitimate interest and, where applicable, a legal obligation.
- Individual business introductions: to contact a relevant professional using limited public business information, only where permitted by the law that applies to the contact. The basis is legitimate interest where permitted. You can object at any time without charge.
- Publicity: to publish identifiable client work or a testimonial only with express written permission. Permission can be withdrawn for future use.
05
Client files and project work
We use client materials only to assess or complete the agreed project. Access is limited to what the work requires. We do not make client files, results or communications public without written permission.
When a client decides why and how personal data in its materials is processed, Store Steward acts on that client's instructions. If the project needs us to process such data, we agree the scope, access, security measures, retention and any required data processing terms before work begins.
Some work can be assisted by software tools, including AI tools. If a project would require submitting confidential client content or personal data to such a tool, we identify the tool and agree its use and safeguards with the client before submitting that content.
06
Website and store projects
The contact section invites you to enquire by email. It does not submit a website form or take payment. An enquiry may include your contact details, a public site URL, the problem or goal, an expected result and any evidence you choose to send.
If the agreed work needs access to a website or store account, we request only the permissions needed for that scope. We do not ask for a password or authentication code in the initial enquiry. Work requiring customer, order or other personal data must be separately assessed and agreed.
If a later project uses Stripe or another payment provider, that provider handles the checkout. Store Steward receives the payment status and details needed to confirm the purchase and keep business records, not the full card number or security code.
07
Providers and transfers
We share information only as needed with website and email hosting, payment processing, document storage and work tools, accounting or legal advisers, and public authorities where required by law. A project may also involve a payment provider or website platform, such as Stripe or Shopify, where relevant and agreed. A freelancer receives client information or access only after the client has approved that involvement in writing.
The current website and business email use Hostinger. A Stripe checkout, if enabled, is operated by Stripe. Their own privacy information is available from Hostinger, Stripe and Shopify.
Some providers may process information outside the European Economic Area. Where the GDPR applies, we use a lawful transfer mechanism, such as an adequacy decision or standard contractual clauses, as relevant to the provider and transfer. Ask us for information about the safeguards that apply to your data.
We do not sell or rent personal data.
08
How long we keep it
- Enquiries that do not lead to paid work: up to 12 months after the last substantive contact.
- Individual business contact records: reviewed or deleted within 12 months after the last contact. A minimal record may be kept to respect an objection to future contact.
- Project correspondence, approvals, deliverables and evidence: normally up to 24 months after the project closes, unless a different period is agreed or needed for a legal claim.
- Invoices and supporting financial records: for the period required by applicable accounting and tax law.
- Credentials or unrelated sensitive files sent by mistake: deleted as soon as identified, subject to any immediate security action needed.
- Website and security logs: according to the hosting provider's settings and applicable security needs.
We may anonymise information instead of deleting it when it can no longer identify a person.
09
Website and cookies
This website does not currently use analytics or advertising cookies, tracking pixels or behavioural profiling. The site may still generate hosting and security logs needed to deliver and protect it. If non-essential tracking is added, we will update this notice and seek any consent required before using it.
10
Public examples
The sample online-store report uses a controlled test store. The sample spreadsheet and Portuguese-language edit use fictional material. They show the format of possible work and are not claims of client results.
Real client work, names, testimonials, files or before-and-after evidence are published only with express written permission.
11
Security
We limit access to project information, use individual accounts and request only the permissions needed for approved work. Where supported, we use two-factor authentication. No online system can guarantee absolute security.
If you believe personal data has been exposed or misused, contact hello@storesteward.com.
12
Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal data. You may object to processing based on legitimate interests and to direct marketing at any time. Where processing relies on consent, you may withdraw it for future processing.
Send a request to hello@storesteward.com. We may ask for enough information to confirm your identity. We respond without undue delay, normally within one month; the period may be extended when the GDPR permits it.
You may complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados. If we process your data only on a client's instructions, we may direct your request to that client as the controller and assist it in responding.
13
Automated decisions and children
Store Steward does not use personal data for decisions based solely on automated processing that have legal or similarly significant effects. The services are intended for businesses and are not directed at children.
14
Changes to this policy
We update this page when our services, providers or data practices change. The current version and its last updated date remain available here.