Privacy policy

Privacy Policy — MÖHYA Signature®

This Privacy Policy describes how MÖHYA Signature® collects, uses, stores and protects your personal data when you visit www.mohyasignature.com, place an order, subscribe to our newsletter or contact us. It has been drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Portuguese Law no. 58/2019 of 8 August.

Last updated: 31 July 2026

1. Data controller

The controller of your personal data is:

  • Owner: Ana Teresa Marvão de Oliveira, trading under the registered trademark MÖHYA Signature®
  • Tax number (NIF): 233890009
  • E-mail: info@mohyasignature.com
  • Telephone: +351 913 334 008 (Portuguese mobile network)

No Data Protection Officer has been appointed, as the conditions set out in Article 37 GDPR are not met. For any question concerning your personal data, please use the contact details above.

2. Personal data we process

Depending on your relationship with us, we may process the following categories of data:

  • Identification and contact data: first name, surname, e-mail address, telephone number.
  • Order and delivery data: billing and shipping address, country, postcode, order history, tax number where you request an invoice with a VAT/tax ID.
  • Payment data: payment method, confirmation and transaction status. We neither access nor store your full card details — these are handled directly by the payment service providers in a secure environment.
  • Personalisation data: measurements, engravings, references and any other details you provide in connection with the MÖHYA LAB / Bespoke Pieces service.
  • Account and subscription data: customer account credentials, membership details for MÖHYA Club and the MÖHYA Atelier subscription.
  • Communication data: the content of messages you send us by e-mail, contact form or WhatsApp.
  • Browsing data: IP address, device and browser type, pages visited, traffic source and cookie identifiers — as set out in our Cookie Policy.

Providing the data marked as mandatory at checkout is necessary in order to enter into and perform the contract of sale. Without it we cannot process or deliver your order.

3. Purposes and legal bases

We process your data only for the purposes set out below, each with its corresponding legal basis:

  • Processing orders, deliveries, returns and refunds — performance of a contract (Article 6(1)(b) GDPR).
  • Managing your customer account, the MÖHYA Atelier subscription and the MÖHYA Club programme — performance of a contract (Article 6(1)(b)).
  • Issuing invoices and meeting tax and accounting obligations — compliance with a legal obligation (Article 6(1)(c)).
  • Responding to enquiries, complaints and quotation requests — pre-contractual steps or our legitimate interest in replying to those who contact us (Article 6(1)(b) and (f)).
  • Sending marketing communications, newsletters and information about new collections — consent, freely and unambiguously given on subscribing (Article 6(1)(a)). You may withdraw your consent at any time, without affecting the lawfulness of prior processing.
  • Sending commercial communications to customers about pieces similar to those purchased — legitimate interest, under Article 13(2) of Portuguese Law no. 41/2004, with the option to object in every communication.
  • Analysing use of the website and measuring campaign performance — consent, obtained through the cookie banner (Article 6(1)(a)).
  • Preventing fraud and securing the website and transactions — legitimate interest in protecting the business and its customers (Article 6(1)(f)).
  • Establishing or defending legal claims and dispute resolution proceedings — legitimate interest (Article 6(1)(f)).

4. Recipients and processors

We do not sell or transfer your personal data to third parties for their own commercial purposes. We share data, only to the extent necessary, with the following categories of recipients:

  • E-commerce platform: Shopify Inc. and Shopify International Ltd., which host the store and process orders.
  • Payment service providers: the institutions and payment gateways offered at checkout, which process transaction data as independent controllers.
  • Carriers and logistics operators: for delivery of orders, receiving name, address, telephone number and e-mail.
  • E-mail marketing and customer communication providers, including for newsletters and transactional messages.
  • Analytics and advertising tools: Google (Google Tag Manager and associated services) and Meta Platforms (Facebook and Instagram), where you have consented to the relevant cookies.
  • Apps installed on the store for customer reviews, the loyalty programme, WhatsApp customer support and product personalisation features.
  • Accounting and tax obligations: our certified accountant and the Portuguese Tax and Customs Authority.
  • Public authorities and dispute resolution bodies, where required by law or necessary to defend legal claims.

All processors are bound by a data processing agreement under Article 28 GDPR, including confidentiality and security obligations.

5. International data transfers

Some of our providers are established outside the European Economic Area, in particular in the United States — this is the case for Shopify Inc., Google and Meta Platforms. In those cases, transfers rely on:

  • the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, where the recipient is certified; or
  • Standard Contractual Clauses approved by the European Commission, together with supplementary security measures.

You may request further information about the safeguards applied by writing to info@mohyasignature.com.

6. Retention periods

  • Order, invoicing and accounting data: 10 years, as required by tax and accounting law.
  • Customer account data: for as long as the account remains active and up to 3 years after the last interaction, after which it is deleted or anonymised.
  • Warranty and conformity data: 3 years from delivery, matching the period under Portuguese Decree-Law no. 84/2021, plus the applicable limitation period.
  • Marketing data: until you withdraw consent or object to the processing, and at most 2 years after your last interaction with our communications.
  • Communications and support requests: 2 years from the last message.
  • Browsing data and cookies: for the periods set out in the Cookie Policy.

7. Your rights

As a data subject you have the following rights under Articles 15 to 22 GDPR:

  • Access — to know what data we hold about you and obtain a copy.
  • Rectification — to correct inaccurate data or complete incomplete data.
  • Erasure — to request deletion of your data where no legal ground requires us to keep it.
  • Restriction of processing — to limit the use of your data in certain circumstances.
  • Portability — to receive the data you provided in a structured, commonly used format, or to have it transmitted to another controller.
  • Objection — to object to processing based on legitimate interest and, at any time and without justification, to processing for direct marketing purposes.
  • Withdrawal of consent — at any time, where processing is based on consent, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, simply write to info@mohyasignature.com. We will reply within one month, extendable by two further months in particularly complex cases, with prior notice to you. We may ask you to confirm your identity, solely to prevent the improper disclosure of data to third parties.

To unsubscribe from the newsletter, you may also use the unsubscribe link at the foot of any communication we send you.

8. Automated decision-making and profiling

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The analytics and advertising tools we use, subject to your consent, may group visitors into audience segments for measurement and communication purposes — processing you may object to at any time through your cookie settings.

9. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure, including encrypted connections (HTTPS/TLS) across the whole website, access controls, strong authentication on the platforms we use, and limiting access to data to what is strictly necessary.

10. Children

Our products and services are intended for persons aged 18 or over. We do not knowingly collect data relating to children. If you become aware that a minor has provided us with personal data, please contact us so that we can delete it.

11. Complaints

If you consider that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with the supervisory authority:

CNPD — Portuguese Data Protection Authority
www.cnpd.pt · geral@cnpd.pt · Telephone: +351 213 928 400

We would nevertheless be grateful if you contacted us first at info@mohyasignature.com, so that we can try to resolve the matter directly with you.

12. Changes to this policy

This Privacy Policy may be updated whenever there are legislative or technological changes, or changes to the services we provide. The version in force is the one published on this page, showing its update date. Substantial changes will be notified by e-mail to customers and subscribers.

13. Related documents