Privacy Policy

1. Data controller

Tidemove Lda. (in incorporation), operating at tidemove.com, is the data controller for personal data collected through this website.

2. Data we collect

We collect what you send us, plus what an order needs. Card details never reach this site or our servers — checkout runs on Shopify and payment is handled by their payment providers.

• —Contact form — first and last name, email address, optional phone number, enquiry topic and your message. We also record which page the enquiry came from, so we know what you were looking at.
• —Newsletter — email address.
• —WhatsApp — if you use the WhatsApp button, your message and phone number are processed by WhatsApp Ireland Ltd. under their own privacy policy, not ours.
• —Anti-spam — Cloudflare Turnstile receives your IP address and a challenge token to confirm you are not a bot. Your IP address is also held briefly in memory to rate-limit repeated submissions.
• —Usage, device and cookie data — the pages you view and how you interact with them, the site that referred you, approximate location derived from your IP address, device and browser details, and identifiers stored in cookies or similar technologies. Collected only with your consent, for the purposes described in section 5.
• —Orders — if you buy from the catalogue, Shopify processes your name, delivery and billing address, email, phone number and order contents on our behalf, and shares them back with us so we can fulfil and support the order. Card data is handled by Shopify's payment providers; we never see or store it. If you have accepted advertising cookies, limited purchase details — such as the order value, the products and your contact details in pseudonymised (hashed) form — may be shared with our advertising partners to measure our advertising.

3. Legal basis (GDPR)

• —Contract — processing and delivering an order you place, and answering questions about it.
• —Legal obligation — keeping invoicing, tax and accounting records, and responding to lawful requests from authorities.
• —Legitimate interest — answering an enquiry you sent us, preventing spam, fraud and abuse, keeping the website secure, and establishing, exercising or defending legal claims.
• —Consent — analytics (including session recordings), advertising and personalisation cookies and similar technologies, the sharing with our analytics and advertising partners that they involve, and marketing emails. You can withdraw consent at any time, without affecting processing carried out before.

4. Who we share data with

We share personal data only as far as each purpose requires. Recipients fall into the categories below; the providers named are examples of those we currently use, and an up-to-date list is available on request through the contact form.

Providers acting as our processors work under a data processing agreement and only on our instructions. Advertising partners and some analytics partners may also use the data for their own purposes as independent controllers; for the collection and transmission of data through their technologies on our website, we may be jointly responsible with them. Their own privacy policies govern their further processing.

Some recipients are located, or process data, outside the European Economic Area, including in the United States. Such transfers rely on an adequacy decision of the European Commission — for example the EU–US Data Privacy Framework, for certified companies — or on the standard contractual clauses approved by the Commission.

• —Service providers — hosting and content delivery, the online store and checkout, payment processing, email delivery, bot protection and databases (for example Shopify, Vercel, Cloudflare, Resend and Neon). Vercel's own analytics is cookieless and does not identify you.
• —Analytics and session-recording providers — only with your consent, to understand and improve how the website is used (for example Google, Microsoft Clarity and Contentsquare).
• —Advertising partners — only with your consent, to measure the results of our advertising and to show relevant ads on their platforms (for example Meta, Google and Microsoft).
• —Embedded media providers — only when their content loads, as described in section 5 (for example YouTube, Vimeo and SoundCloud).
• —Payment, delivery and messaging services — to take payment, deliver your order, or when you choose to contact us through them (for example WhatsApp).
• —Authorities, courts and professional advisers — where the law requires it, or to establish, exercise or defend legal claims.
• —A successor business — if all or part of our business is reorganised, merged or sold, with the same protections described here.

5. Cookies and consent

We and our partners use cookies and similar technologies — such as pixels, scripts and local storage — for four purposes: strictly necessary (for example keeping your cart, securing the site and remembering your consent choice), analytics (including session recordings of how pages are used, with what you type in forms masked), advertising (measuring conversions, building audiences and personalising ads on other platforms) and personalisation.

Only strictly necessary technologies are used until you make a choice in the banner, and the others run only for the categories you accept. You can change or withdraw your choice at any time through “Cookie preferences” at the bottom of every page. Your choice is stored in a first-party cookie (tm_consent) for six months. Where our partners support it, your choice is passed on to them through consent signals such as Google Consent Mode.

Third-party media and links. Some pages embed media from other providers or link to other websites. Embedded media loads only if you have accepted advertising cookies or choose to load it; the provider then receives data such as your IP address and uses it under its own privacy policy. By loading it you consent to this, and you can withdraw that consent at any time through “Cookie preferences”. Websites you visit from ours are governed by their own privacy policies.

Checkout is provided by Shopify, which may set its own strictly necessary cookies there. Vercel Analytics is cookieless and does not identify you.

6. Data retention

Contact enquiries and the emails they generate are kept for 24 months so we can follow up on a quote, then deleted. Newsletter subscriptions are kept until you unsubscribe. Order, invoicing and accounting records are kept for as long as tax and commercial law requires. Analytics and session-recording data are kept only as long as those purposes need — up to 14 months in Google Analytics. Data that advertising partners receive as independent controllers is kept under their own policies. Rate-limiting records are held in memory for 10 minutes and never written to disk.

7. Your rights

Under the GDPR you have the right to access, rectify and erase your data, to restrict or object to its processing — at any time where it is for direct marketing — and to data portability. Where processing is based on your consent, you can withdraw it at any time without affecting processing carried out before. Use the contact form to exercise these rights. You may also complain to a data protection authority: in Portugal, the Comissão Nacional de Proteção de Dados (CNPD); in Spain, the Agencia Española de Protección de Datos (AEPD); or the authority where you live or work.

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

8. Contact

Questions or requests: contact form