How MadameFlihan Processes Website Users’ Personal Data

Under the GDPR (General Data Protection Regulation), we inform users of our website that:

a) The Data Controller is MadameFlihan, with tax identification number 518 156 729, based at Rua da Torre Alta, Torre B, nº 802, 8500-008 Alvor – Portimão;

b) The lawfulness of data processing is based on the consent of the data subject, who voluntarily enters their data in the forms available on the website;

c) The data collected on the website are:

• for contact purposes: full name, phone number, and email
• for product delivery: full address
• for invoicing: Tax Identification Number (NIF)
• when the payment method is bank transfer: only the IBAN

d) Regarding payment processing: Payments are processed through Stripe, our certified payment platform, which also manages transactions via Google Pay and Apple Pay. All payment-related data are collected and processed directly by Stripe and are subject to Stripe’s privacy policy, available at www.stripe.com/privacy;

e) In the case of author data for artwork exhibition, the following data are required: full name, IBAN, Tax Identification Number, and certificate of authenticity of the artwork;

f) Internally, access to existing data may be granted, at different levels, to: the management of MadameFlihan, administrative and management support services, and the gallery team;
g) Due to legal requirements, data may also be accessed during audits and transmitted to State authorities;

h) Invoicing data are kept for 10 years to comply with tax law. Contact data (name, email, and phone number) for future communications and event announcements – if authorized by the data subject – will be kept permanently until the data subject withdraws consent or exercises any Right to Object, Restrict Processing, or Erasure;

i) Data are destroyed using a dedicated shredder. Digital data are securely deleted electronically;

j) At any time, the person responsible for the data subject, or the data subject themselves, may request from the Data Controller the following rights: Right of Access, Right to Rectification, Right to Information, Right to Object, Right to Restriction of Processing, Right to Data Portability, and Right to Erasure/Right to be Forgotten;

k) MadameFlihan carries out profiling actions with website user data. The user may, at any time, manage automated decisions on the website and manage cookies;

l) Cookies and Technologies Used: To improve your browsing experience and provide essential features, we use the following cookies and plugins:

• Cookie Yes – For cookie consent management
• WPML – For website multilingual support
• Google Analytics – For traffic and user behavior analysis
• Sourcebuster – For tracking traffic sources
• WooCommerce – For e-commerce features

m) Without prejudice to any other administrative appeal or legal remedy , the client’s representative, or the client themselves, has the right to lodge a complaint with a supervisory authority (in Portugal, the Portuguese Data Protection Authority – CNPD) under the applicable law or the GDPR, if they believe that the processing of their data by MadameFlihan violates legal provisions in force;

n) MadameFlihan is committed to the confidentiality of its clients personal data and will always take the necessary technical and organizational measures to comply with the Regulation, ensuring that data processing is lawful, fair, transparent, and limited to the lawful purpose of the contract. MadameFlihan adopts technical and organizational measures to ensure the integrity and privacy of the data collected from data subjects;

p) Externally, access to the collected data may be granted to the following processors entities, which have provided GDPR compliance declarations:

Regarding regular data, we have the following processors:

• João Mestre – Consultoria, Contabilidade e Gestão, Lda. – Subcontracted company for consultancy and accounting services, under the trade name “Mestre Conta”, with access to all data necessary to manage MadameFlihan’s accounting;

• STRIPE Inc. – Online payment management software, headquartered in Ireland for the European market. The privacy policy is available at: https://stripe.com/en-pt/privacy

• SiteGround Spain, S.L – Company managing the Siteground.com software. Through this software, MADAMEFLIHAN hosts its website and email. The company is based in Spain. The privacy policy is available at: https://eu.siteground.com/privacy.htm

• Moloni, Lda., a brand of GRUPO VISMA – company based in Norway, managing the invoicing software MOLONI. In this platform, the data necessary for invoicing and accounting are entered. The privacy policy is available here: https://www.visma.com/privacy-statement;

• Avelar Bandeira e Mesquita Dinis – Sociedade de Advogados, SP, RL – Law firm contracted to provide legal and business advisory services, with access to all necessary data for such services;

Regarding special categories of data, we have the following processors:

• Securitas – Serviços e tecnologia de segurança S.A. – Subcontracted company for technical surveillance and alarm services at MadameFlihan’s facilities. Securitas Portugal is the technical manager of the video surveillance system at MadameFlihan, although the latter is the Data Controller. There are 2 surveillance cameras and appropriate signage at the premises. Data are recorded for 30 days, after which the recording is overwritten. In compliance with the law, audio is turned off;

• MadameFlihan uses the following communication platforms with clients, which may include images of data subjects:
o Whatsapp – This social network may be used by the Data Controller to create restricted workgroups and broadcast information groups, with the data subject’s authorization. By joining, the user’s profile (potentially name and photo) and phone number will be available.