1. Introduction
This Privacy Policy explains how Bomchai (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit our website, create an account, or place an order. We are based in Portugal and process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Portuguese data protection law.
By using this website, you agree to the collection and use of information in accordance with this policy.
2. Data controller
The data controller responsible for your personal data is:
- Company name: Bomchai
- Address: Campus Campolide, 1070-124
If we appoint a Data Protection Officer (DPO), the DPO’s contact details will be added here.
3. Personal data we collect
We may collect and process the following categories of personal data:
- Identification data: name, billing and shipping address, VAT number (if applicable).
- Contact details: email address, phone number.
- Account data: username, password, order history, preferences.
- Order and payment data: products purchased, order amounts, chosen payment method (card details are processed by our payment provider and are not stored by us).
- Technical data: IP address, browser type, device information, pages visited, and other usage data collected through cookies and similar technologies.
- Communication data: messages sent through contact forms, support requests, newsletter subscriptions.
4. Purposes and legal bases
We process personal data for the following purposes and legal bases:
- To process and deliver your orders, manage payments, and provide customer support (performance of a contract).
- To create and manage your account, subscriptions, and recurring orders (performance of a contract).
- To send service emails about your orders, shipping status, and subscription renewals (performance of a contract / legitimate interests).
- To send marketing communications and newsletters if you explicitly opt in (consent, which you can withdraw at any time).
- To improve our website, products, and customer experience through analytics (legitimate interests, where allowed; otherwise based on consent via cookies).
- To comply with legal obligations (e.g., tax and accounting obligations, consumer law).
5. Cookies and similar technologies
Our website uses cookies and similar technologies to enable core functions (such as cart and checkout), to remember your preferences, and to measure website traffic.
- Strictly necessary cookies are required for the website to function and are used, for example, to keep products in your cart and maintain your session.
- Analytics and marketing cookies (for example, Google Analytics, Meta Pixel, or similar) are only activated with your prior consent, which you can manage via our cookie banner or settings.
You can change your cookie preferences at any time and can also manage cookies in your browser settings.
6. Data sharing and recipients
We do not sell your personal data. We may share data with trusted third parties only when necessary to provide our services or comply with the law, including:stripe+1
- Payment providers (e.g., Stripe, PayPal) to process payments securely.
- Shipping and logistics providers to deliver your orders.
- IT and hosting providers (e.g., our web host, email service, analytics providers).
- Professional advisors (e.g., accountants, legal advisors) where required.
- Public authorities when required by law or to protect our rights.
These third parties process data according to our instructions and in compliance with data protection laws.
7. International transfers
If any of our service providers are located outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, as required by GDPR.
8. Data retention
We keep your personal data only for as long as necessary for the purposes described above:
- Order data is retained for the period required by tax and accounting law.
- Account data is kept while your account is active; you may request deletion.
- Subscription data is kept while your subscription is active and for a limited period thereafter for legal or administrative purposes.
- Marketing consent and communication data are kept until you withdraw consent or unsubscribe.
After these periods, data is deleted or anonymised.
9. Your rights
Under GDPR, you have the following rights:
- Right of access: to know what personal data we hold about you.
- Right to rectification: to correct inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”) in certain circumstances.
- Right to restriction of processing in certain circumstances.
- Right to data portability, to receive your data in a structured, commonly used format.
- Right to object to processing based on legitimate interests or direct marketing.
- Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal.
To exercise these rights, contact us. We will respond as soon as possible and within the deadlines set by law.
You also have the right to lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados – CNPD) or with your local supervisory authority.
10. Security
We take appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, or alteration, including encryption in transit, access controls, and regular monitoring of our systems.
However, no method of transmission over the internet or method of electronic storage is 100% secure, so we cannot guarantee absolute security.
11. Minors
Our website is not intended for children under 18. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example when we add new features or to comply with legal changes. The updated version will be published on this page with a new “Last updated” date.
Last updated: 26.5.2026.