Privacy — Delicious Diamonds

Who we are

Delicious Diamonds is a chocolate house based in Leiria, Portugal, founded in 2018. For the purposes of the General Data Protection Regulation (GDPR), we act as the data controller of your personal data when you interact with our site, place an order, or reach the concierge.

We take our clients' privacy seriously. We collect only what is needed to fulfil an order, maintain an account, and refine the house experience. Nothing more.

What data we collect

Depending on how you engage with us, we may collect:

Account dataName, email, password (stored as bcrypt hash, never in plain text), phone, address, preferred language, allergens to avoid, communication preferences.
Order dataItems, amounts, delivery address, dates, invoice number issued by the Portuguese tax authority, internal notes.
Subscription dataFor The Monthly Letter · tier, status, next renewal, recipient (if a gift).
Gift BookRecipient names, dates, notes. Added by you voluntarily.
ConciergeThe content of the messages you send us, with email and phone.
Technical dataIP, browser, pages visited, strictly for security (login throttling, concierge spam prevention).

We do not collect sensitive data (health, religion, etc.) unless you voluntarily share it via allergens or concierge notes.

How we use it

Fulfil the orderPrepare, invoice, deliver, and respond under warranty.
Maintain your accountAuthenticate, show history, manage Gift Book and Vault.
Communicate with youOrder notes, subscription changes, concierge replies. Newsletter only if you opt in.
Comply with legal obligationsInvoice issuance via the Portuguese tax portal, accounting record keeping.
Improve the houseOnly on the basis of aggregated or anonymised data.

Legal basis

Performance of a contractart. 6(1)(b) GDPR · for everything related to your order or subscription.
Legal obligationart. 6(1)(c) GDPR · for invoicing and accounting.
Legitimate interestart. 6(1)(f) GDPR · for site security and fraud prevention.
Consentart. 6(1)(a) GDPR · for newsletter and non-essential communications. Withdrawable at any time.

Who has access

Only people and partners who need your data to deliver the service access it. We never sell data.

CarrierName, address, contact for delivery (CTT, DPD, Chronopost, depending on the case).
Payment providerWhen online checkout is active, payment data is handled directly by our PCI-DSS certified partner. It never passes through our servers.
Tax authorityInvoicing data, as legally required.
Transactional email providerEmail + name to send confirmations and concierge replies.

How long we keep it

Account dataFor as long as the account is active. If you request deletion, we remove it within 30 days, except where law obliges us to retain.
Orders and invoices10 years · Portuguese tax obligation (art. 123 CIRC).
Concierge messages2 years for relationship history, then anonymisation.
Technical data / logsMaximum 6 months.

Your rights

Under the GDPR, you have the right to:

AccessRequest a copy of your data.
RectifyCorrect inaccurate data · you can do it in your account.
EraseRequest to be forgotten, except for what we are required to keep.
RestrictAsk us to stop certain processing.
PortabilityReceive your data in a structured format.
ObjectTo processing based on legitimate interest.
Withdraw consentFor newsletter and optional communications, at any time.
Complain to the supervisory authorityPortuguese CNPD · cnpd.pt

To exercise any of these rights, write to hello@deliciousdiamonds.pt. We reply within 30 days.

International transfers

Your data is processed on servers within the European Union. If a partner has infrastructure outside the EU, we ensure standard contractual clauses approved by the European Commission or other appropriate GDPR safeguards are in place.

Cookies and technologies

Delicious Diamonds uses only strictly necessary cookies for the site to function (authentication, basket, preferences). We do not use analytics or advertising pixels. For that reason we do not present a consent banner. It is not required by the GDPR for essential cookies.

Full policy at Cookies.