Privacy policy

Last updated: August 24, 2026

This Privacy Policy explains how BABALU Fishing Tackle collects, uses, shares, stores and protects personal data when someone visits babalu.pt, uses the online store, creates an account, makes a purchase, subscribes to communications, contacts customer support, submit an Ambassador Program application, or interact with us through other means.

This policy applies to BABALU's currently active markets: Portugal, other European Union countries, the United Kingdom, the United States and Canada, including Quebec. When local law grants additional rights or imposes more protective requirements, those requirements prevail.

1. RESPONSIBLE FOR THE TREATMENT

The person responsible for processing personal data is:

BABALU Fishing Tackle
Operator: Luís Miguel da Costa Ferreira, sole proprietorship
NIF/VAT: PT219263752
Avenida do Atlântico, No. 16, Office 2.01
1990-019 Lisbon, Portugal
Email: hello@babalu.pt
Website: https://babalu.pt

For the purposes of Canadian and Quebec legislation, the person responsible for the protection of personal data can be contacted using the same email address and the same address.

2. PERSONAL DATA WE MAY COLLECT

Depending on how you interact with us, we may collect:

  • identification and contact details, such as name, email address, telephone number, billing address and delivery address;
  • account data such as credentials, preferences, order history and store credit balance;
  • order and transaction data, such as products, variants, quantities, currency, price, discounts, taxes, shipping, order status, returns and refunds;
  • payment data, mainly processed by payment providers; BABALU may receive identifiers, status and limited transaction information, but may not receive the full card number;
  • delivery and logistics data, such as delivery instructions, carrier, tracking identifier, transport events and proof of delivery;
  • communications, support requests, complaints, reviews, responses to surveys and other content sent to BABALU;
  • application and collaboration data, such as responses to the Ambassador Program form, country, languages, social media profiles and metrics, experience, content, collaboration preferences, acceptance of terms, and approval or participation history;
  • technical and usage data, such as IP address, device and browser type, identifiers, pages visited, origin of visit, interactions, security records and data from cookies or similar technologies;
  • privacy and marketing preferences, including consents, opt-outs and subscription records;
  • data necessary for fraud prevention and security, such as risk signals associated with the session, payment, account or order; and
  • data required by law, such as tax, accounting or verification elements when applicable.

We ask that you do not send unnecessary personal data, sensitive data or third party information without a legitimate basis.

3. HOW WE COLLECT DATA

We may collect data:

  • directly from the owner, for example when creating an account, placing an order, filling out a form or contacting us;
  • automatically, through the website, cookies, technical records and similar technologies;
  • through Shopify and Shop services, Shopify Collabs, Shopify Messaging and Translate & Adapt;
  • through the Amazon MCF and Buy with Prime, Google & YouTube and Judge.me Reviews integrations;
  • through payment providers, fraud prevention, logistics operators, transport companies, customer support, marketing and analysis;
  • through social or advertising platforms, when you interact with our pages, advertisements or content; and
  • from authorities or other legitimate sources when necessary to comply with the law, prevent fraud, or protect rights.

4. PURPOSES AND LEGAL BASIS

We only process personal data when there is a legitimate purpose and an applicable legal basis. In particular:

  • pre-contractual due diligence and contract execution: process orders, payments, invoicing, store credit, shipping, delivery, returns, refunds, purchase-related support and, where applicable, manage approved applications and participation in the Ambassador Program;
  • compliance with legal obligations: maintain tax and accounting records, respond to authorities, ensure consumer rights, product safety, recalls and complaints;
  • legitimate interests: protect the store and customers, prevent fraud, improve products and services, manage the business, evaluate applications, protect brand reputation, measure the performance of integrations, defend rights and present marketing about similar products when legally permitted and subject to the right to object;
  • consent: install non-essential cookies, send certain marketing communications, personalize advertising or carry out other processing for which the law requires consent; and
  • protection of vital interests or public interest: only in exceptional situations provided for by law.

Consent can be withdrawn at any time, without affecting the lawfulness of previous processing. Withdrawal may limit optional features, but does not prevent processing necessary to fulfill an order or comply with the law.

5. ORDERS, PAYMENTS AND FRAUD PREVENTION

Order data is used to confirm and execute the purchase, calculate prices, taxes and shipping, process payment, prepare and deliver items and provide support. We may use automated signals to identify payments, accounts or orders at risk of fraud, abuse or security.

These signals may lead to manual review, request for additional information, temporary suspension, or denial of a transaction. We do not intend to make exclusively automated decisions that produce significant legal effects on the holder without the safeguards required by applicable legislation. You can request human intervention or challenge a decision via hello@babalu.pt.

6. WHO WE CAN SHARE DATA WITH

We may share only necessary data with:

  • Shopify, as a provider of the e-commerce platform, hosting, Shop, Shopify Collabs, Shopify Messaging, Translate & Adapt, analytics, fraud prevention and other active features;
  • payment providers, banks and fraud prevention services;
  • Amazon MCF and Buy with Prime, logistics operators, warehouses and carriers, for preparation, dispatch, delivery, tracking and, when authorized, measurement;
  • Google & YouTube, for channel synchronization, analytics, conversion measurement, and advertising in accordance with applicable privacy choices;
  • Judge.me Reviews, for collection, management, presentation and analysis of evaluations;
  • customer support, email, marketing and consent providers, depending on the functionalities actually used;
  • professional consultants, such as accountants, lawyers, auditors and insurers;
  • public authorities, regulators, courts and security forces, when there is a legal obligation or valid request; and
  • acquirers or successors, in the context of a sale, reorganization or transfer of business, with appropriate safeguards.

We do not sell personal data for monetary consideration. Some disclosures for behavioral advertising may be qualified under certain United States laws as “sale,” “sharing” or targeted advertising. Where applicable, we will provide a mechanism to opt out of such uses.

7. SHOPIFY AND OTHER PROVIDERS

The store is hosted by Shopify. Shopify processes data when a visitor uses the store or makes a purchase, both to provide the services contracted by BABALU and, in certain circumstances, for its own purposes as described in the Consumer Privacy Policy of Shopify.

Shopify Network Intelligence is active because it is required for features used by BABALU, including the Shop channel, Shopify Collabs and Shopify Messaging. In this context, Shopify may securely use data from the interaction with BABALU together with data from the holder's interactions with Shopify or with other Shopify merchants, to provide Advanced Services, such as fraud protection, personalization, performance improvement, measurement and advertising. Other merchants do not receive direct access to BABALU customer data.

To provide these services, information may be communicated to Shopify and third parties who may be established in other countries. Choices made in the cookie banner, on the “Your Privacy Choices” page and through supported signals such as Global Privacy Control are transmitted to Shopify in the applicable contexts. Refusing non-essential cookies prevents Network Intelligence from using your device data for non-essential purposes; refusal to sell or share prevents its use for advertising.

Registrants in the European Economic Area, the United Kingdom or Switzerland may consult the Shopify Privacy Portal to withdraw consent, object or directly exercise the rights available to Shopify.

Available payment methods, carriers, applications and integrations may vary by market. We review this section when the store configuration changes.

8. INTERNATIONAL TRANSFERS

Some recipients or systems may be located outside of the holder's country, including in the United States, Canada and other countries. Where the European Economic Area General Data Protection Regulation or UK law applies, we use a recognized transfer mechanism, such as an adequacy decision, standard contractual clauses or other legal instrument, and put additional safeguards in place where necessary.

Under Canadian and Quebec law, data processed outside of Canada may be subject to the laws and legitimate access of authorities in the destination country. Before transfers that require it, relevant factors and safeguards are assessed.

9. DATA STORAGE

We keep data for the period necessary for the purposes described, to comply with tax, accounting, contractual, security and consumer protection obligations and to establish, exercise or defend rights. Deadlines vary depending on the type of data, the relationship with the customer, the existence of an account, legal deadlines and possible disputes.

When the data is no longer necessary, it will be deleted, anonymized or isolated in a secure way, except when conservation is required or permitted by law.

10. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies to ensure the functioning of the store, remember preferences, measure usage and, with consent when required, personalize content or advertising. You can consult additional information and manage your choices in the Cookie Policy and in the preferences panel displayed on the website.

Rejecting non-essential cookies does not prevent purchases, although some optional features may be limited. Strictly necessary cookies do not require consent when they are essential to provide the requested service.

The pixels currently declared in the “Customer Events” area belong to Amazon MCF and Buy with Prime, Shopify Collabs, Google & YouTube and Judge.me Reviews. In regions configured for consent, Amazon MCF and Shopify Collabs are awaiting consent for Marketing and Data Analytics; Judge.me is awaiting consent for Data Analysis. The Google & YouTube integration uses consent mode to adapt the storage and use of data to the visitor's choices.

11. MARKETING

We only send marketing communications via email or other channels when there is a legal basis. Each electronic marketing message includes a simple way to unsubscribe. You can also withdraw consent or object to direct marketing via hello@babalu.pt.

Even after you opt out of marketing, you may continue to receive necessary operational communications, such as order confirmation, payment, shipping, security, account changes, or response to a request.

12. SECURITY

We apply technical and organizational measures proportionate to the risk, including access controls, communications protection, supplier management and incident response procedures. No system is completely invulnerable; If we detect a personal data breach, we will assess the risk and notify data subjects and authorities when required by law.

13. RIGHTS IN THE EUROPEAN ECONOMIC AREA AND THE UNITED KINGDOM

When applicable, you can request access, rectification, erasure, limitation, portability and opposition, withdraw consent and not be subject to certain exclusively automated decisions. These rights are subject to the conditions and exceptions provided for by law.

You can lodge a complaint with the competent supervisory authority. In Portugal, you can contact the National Data Protection Commission. In the UK, you can contact the Information Commissioner's Office.

14. RIGHTS IN CANADA AND QUEBEC

In accordance with applicable legislation, you can request access to and correction of your data and submit a question or complaint about the way it is treated. When applicable in Quebec, you can also request the cessation of disclosure, de-indexing or re-indexing of a hyperlink, portability in a structured and understandable technological format and information on decisions based exclusively on automated processing, subject to legal conditions.

Consent will be requested in a manner appropriate to sensitivity, purpose and context. You can contact the person responsible for protecting personal data at hello@babalu.pt. If you are not satisfied, you can lodge a complaint with the Office of the Privacy Commissioner of Canada or, in Quebec, with the Commission d'accès à l'information du Québec.

15. RIGHTS IN THE UNITED STATES

Depending on your state of residence and the applicability of its law, you may have rights to confirm, access, correct, delete, portability, object to targeted advertising, refuse certain sales or sharing, and appeal a decision on the request. BABALU will not discriminate against the holder for exercising a legal right.

We may ask for information reasonably necessary to confirm identity and relationship to the data. An authorized agent may submit a request when the law permits and authorization can be verified. If a state law does not apply to BABALU due to its scope or thresholds, we will still attempt to respond reasonably to requests.

In states where applicable, you can opt out of the sale or sharing of data and targeted advertising through Your Privacy Choices or a supported Global Privacy Control signal.

16. HOW TO EXERCISE YOUR RIGHTS

To exercise a right, send an email to hello@babalu.pt with the subject “Privacy”. Indicate the request, the country or state of residence and the data necessary to locate the account or order. Do not send copies of identification documents without being requested through an appropriate channel.

We will respond within the period provided for by applicable legislation. In certain cases, we may request additional information, reasonably refuse a request, or retain data that is necessary to comply with the law, complete a transaction, protect security, or defend rights.

17. MINORS

The store is not intended for children and we do not seek to knowingly collect data from minors without the required authorization. If you understand that a minor has improperly provided personal data, contact us so we can evaluate and delete the information when applicable.

18. THIRD PARTY CONNECTIONS AND SERVICES

The website may contain links to external services. This policy does not regulate the practices of these third parties. We recommend that you consult their policies before providing personal data.

19. CHANGES TO THIS POLICY

We may update this policy to reflect legal, technological or operational changes. The updated version will be published on this page with a new date. When the change is material and the law requires it, additional information will be provided or new consent will be requested.

20. CONTACT

For privacy questions, complaints or requests:

BABALU Fishing Tackle
For the attention of the person responsible for the protection of personal data
Avenida do Atlântico, No. 16, Office 2.01
1990-019 Lisbon, Portugal
Email: hello@babalu.pt