Legal
Privacy Policy
Last updated September 9, 2026
This policy explains how personal data is handled when you visit apotheus.net, contact Apotheus, subscribe to the newsletter, shop for merchandise, or complete a purchase through our checkout at cms.apotheus.net.
Who is responsible for your data
Albano Valério Gomes Rosário, trading as Apotheus, is the data controller for the website and store activities described in this policy.
You can contact us about privacy at info@apotheus.net. Our postal contact details are available in the Terms and Conditions.
Personal data we collect
When you browse the website
Our hosting and security services may process technical information such as your IP address, browser and device information, the pages and resources requested, timestamps, referring pages, security signals, and an approximate location inferred from your IP address. We use this information to deliver the site, protect it from abuse, diagnose faults, and maintain security.
Cart, checkout, and orders
When you use the store, we process the products, variations, and quantities in your cart. The public site stores an opaque guest-cart token in your browser’s local storage so your cart can persist across page reloads. The token does not itself contain your cart contents or contact details.
At checkout, we collect the information needed to accept and fulfil your order. This can include your name, email address, telephone number, billing and delivery addresses, order contents, delivery method, coupon and tax information, customer notes, payment status, and transaction references.
Payment details are submitted directly to the payment method you select, such as Stripe or PayPal. We receive the payment method, status, and transaction reference needed to manage the order, but we do not receive or store your complete card number or card security code.
Contact form
If you contact us, we collect your name, email address, subject, message, and any other information you choose to include. We also process the technical security data needed to prevent automated abuse. Contact Form 7 handles the submission and Flamingo stores the message in our WordPress administration area so we can respond and keep appropriate correspondence records.
Newsletter
If you choose to subscribe, we collect your name, email address, consent record, subscription status, and delivery or engagement information recorded by the newsletter service. We use double opt-in, so you must confirm your subscription by email. Newsletter consent is optional and is separate from buying a product.
You can unsubscribe at any time using the link in any newsletter or by emailing info@apotheus.net. We do not sell or rent newsletter data.
Video and external services
Video pages request preview images from YouTube. The privacy-enhanced YouTube player is loaded only after you choose to play a video. YouTube and Google may then receive technical information about your browser and your interaction with the player under their own privacy terms.
If you follow a link to Spotify, Apple Music, Bandcamp, a social network, or another external website, that service handles your visit under its own privacy policy.
Why we use personal data
| Purpose | Legal basis |
|---|---|
| Provide the website, secure it, prevent abuse and fraud, and diagnose technical problems | Our legitimate interests in operating a safe and reliable website and store |
| Maintain your guest cart and take steps you request before placing an order | Steps taken at your request before entering into a contract |
| Process payment, fulfil and deliver your order, handle returns, and provide order support | Performance of our contract with you |
| Keep invoices, order records, and other records required by tax, accounting, consumer, or other law | Compliance with legal obligations |
| Read and respond to contact requests | Steps taken at your request and our legitimate interest in handling correspondence |
| Send the newsletter and record your marketing choice | Your consent |
| Establish, exercise, or defend legal claims | Our legitimate interests and compliance with legal obligations |
Where we rely on legitimate interests, we consider the effect on your rights and use only the data reasonably necessary for that purpose. You may object to this processing in the circumstances described below.
Cookies and browser storage
The public Apotheus site uses browser storage for the opaque guest-cart token. If storage is unavailable, the cart may last only for the current browser tab or session.
The checkout uses cookies and similar identifiers that are necessary to keep a guest session, secure checkout, prevent fraud, remember cart and checkout state, and process payment. Cloudflare Turnstile and payment providers may also use technical identifiers required for their security services.
We do not currently add analytics, advertising pixels, or behavioural advertising cookies to the public Apotheus site. If this changes, we will update this policy and request consent where the law requires it.
Who receives personal data
We disclose personal data only when needed for the purposes described above. Recipients can include:
- authorised Apotheus store and website administrators;
- website hosting, content delivery, security, email delivery, and technical support providers, including Cloudflare;
- payment providers selected at checkout, including Stripe and PayPal;
- postal and delivery providers needed to fulfil an order;
- Google and YouTube when their images or player are loaded;
- professional advisers, insurers, courts, regulators, tax authorities, police, or other public bodies where disclosure is necessary or legally required.
Our WordPress and WooCommerce installation stores contact, newsletter, cart, checkout, and order records on our hosting infrastructure. We do not sell personal data.
International transfers
Some service providers operate internationally and may process personal data outside Portugal or the European Economic Area. Where this happens, we rely on a lawful transfer mechanism such as an adequacy decision, approved standard contractual clauses, or another safeguard permitted by data-protection law. You may contact us for more information about safeguards relevant to your data.
You can read the privacy information published by Cloudflare, Stripe, PayPal, and Google.
How long we keep personal data
We keep personal data only for as long as needed for the purpose for which it was collected, including applicable legal, accounting, tax, consumer-protection, security, and dispute-resolution requirements.
- Cart data: the browser token remains until checkout completes, the cart expires, you clear site data, or it is otherwise removed. The corresponding server-side cart expires according to the store’s session settings.
- Orders and invoices: retained for the periods required by Portuguese tax, accounting, consumer, and other applicable law. When continued identification is no longer necessary, records may be deleted or anonymised.
- Pending, failed, and cancelled orders: retained according to the store’s configured retention periods and for any period needed to resolve payment, security, or legal issues.
- Contact messages: retained for as long as reasonably necessary to answer the request, maintain relevant correspondence, and handle possible claims or legal duties.
- Newsletter records: retained while you are subscribed. After you unsubscribe, we may keep a minimal record of the withdrawal and consent history where necessary to honour your choice and demonstrate compliance.
- Technical and security logs: retained only for the period reasonably needed for operations, security, abuse prevention, and incident investigation.
Your data-protection rights
Depending on the circumstances, you may have the right to:
- ask for access to your personal data;
- correct inaccurate or incomplete data;
- ask us to erase data;
- restrict how data is used;
- object to processing based on legitimate interests or to direct marketing;
- receive data you supplied in a portable format where the legal conditions apply;
- withdraw consent at any time, without affecting processing that was lawful before withdrawal.
These rights are not absolute. For example, we may need to retain order or invoice data to comply with law or to establish, exercise, or defend legal claims.
To exercise a right, email info@apotheus.net. We may ask for information needed to verify your identity and protect your data. We will respond within the period required by applicable law.
You may also submit a complaint to Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD). We would appreciate the opportunity to address your concern first, but contacting us is not a condition of complaining to the CNPD.
Automated checks
We do not use your data to make solely automated decisions that produce legal or similarly significant effects on behalf of Apotheus. Payment, fraud-prevention, and security providers may use automated systems to assess transactions or abuse under their own terms and privacy policies.
Children
The store and newsletter are not directed to children. If you are under the age at which you can enter a purchase contract or give valid data-protection consent in your country, please use the site only with the involvement of a parent or guardian.
Security
We use reasonable technical and organisational measures designed to protect personal data. These include access controls, encrypted connections, restricted administration, security monitoring, and Cloudflare Turnstile on the contact form. No internet service can guarantee absolute security.
Changes to this policy
We may update this policy when the site, store, service providers, or legal requirements change. The “Last updated” date on this page shows when the current version was published.
Contact
Questions or requests about this policy can be sent to info@apotheus.net.