Privacy Policy
Last updated: 28-09-2026
LUSILECTRA – VEÍCULOS E EQUIPAMENTOS, S.A. (“Lusilectra”), with registered office at Rua Eng.º Ferreira Dias, n.º 993, 4100-247 Porto, Portugal, Tax ID (NIF) 501381430, is the controller of your personal data in connection with the Lusitools online store, available at www.lusitools.com (the “Platform”). Protecting your privacy is very important to us. This Policy explains what data we collect, for what purposes, with whom we share it and what your rights are.
1. What personal data do we collect?
We collect the following data, depending on how you interact with the Platform:
- Identification data: name, e-mail, telephone, address;
- Billing data: tax ID number, billing address;
- Transaction data: purchase history, payment methods (without access to the full card number);
- Technical/browsing data: IP address, approximate location, browser type, device, date and time of access, time spent on pages, unique device identifiers, diagnostic data;
- Cookie data: see the Cookie Policy;
- Marketing data: subscription preferences, interactions with newsletters (opens, clicks).
2. For what purposes do we use your data?
| Purpose (among others) | Legal basis |
|---|---|
| Responding to your requests or contact enquiries (e.g. when you fill in a form on the Platform) | Pre-contractual steps / legitimate interest |
| Managing your registration and identification as a Platform user, if you choose to create an account, and giving you access to its features | Performance of a contract |
| Developing, fulfilling and performing the purchase or service contract entered into on the Platform | Performance of a contract |
| Marketing (e.g. sending newsletters) | Consent |
| Compliance with legal obligations (e.g. issuing invoices) | Legal obligation |
| Improving the Platform and user experience; fraud prevention and security | Legitimate interest |
3. Who do we share your data with?
We share your data only with trusted partners and when necessary:
- Carriers: to deliver orders (e.g. CTT, Correos);
- Payment services: Shopify Payments, Ifthenpay, among others;
- Web hosting and online store: Shopify;
- E-mail marketing platforms: Closum and Shopify;
- Analytics and cookie services: Google, Meta, among others;
- Other service providers: Winsig (PHC software provider), among others;
- Public authorities, where required by law;
- Financial institutions.
4. Relationship with Shopify
The Platform is hosted by Shopify, which processes personal data about access to and use of the store in order to provide and improve its services. When we use certain advanced Shopify features (e.g. Shop Pay or the Shop app), Shopify may process data about your interactions with our store, with other merchants and with Shopify itself, and in those cases Shopify is the controller of that processing. To learn more about how Shopify uses your personal data and to exercise your rights with Shopify, please visit the Shopify Privacy Portal.
5. Is your data transferred outside the EU?
Yes. Some of our service providers are based outside the European Economic Area. We ensure that such transfers are based on:
- adequacy decisions of the European Commission, including the EU-US Data Privacy Framework for certified companies; or
- standard contractual clauses approved by the European Commission.
6. How long do we keep your data?
We process your data only for as long as strictly necessary to fulfil the corresponding purpose. After that period, we may keep it, duly stored and protected, for as long as liabilities arising from the processing may arise, in accordance with applicable law. When those periods end, the personal data will be deleted.
Examples:
| Type of data | Retention period |
|---|---|
| Billing data | 10 years (legal requirement) |
| Newsletter subscription | Until consent is withdrawn or up to 2 years without any interaction, whichever occurs first |
| Customer account | While the account is active or until you request its deletion |
| Cookies | Depending on the type (see the Cookie Policy) |
7. What are your rights?
You have the right to:
- Access your data;
- Correct inaccurate data;
- Erase your data (“right to be forgotten”);
- Restrict or object to processing;
- Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- Receive your data in a digital format (portability);
- Lodge a complaint with the Portuguese Data Protection Authority – CNPD (www.cnpd.pt) or with the supervisory authority of your country of residence (e.g. AEPD in Spain or CNIL in France).
8. How can you exercise your rights?
You can exercise your rights by e-mail at qualidade@lusilectra.pt.
You can also contact our Data Protection Officer (DPO) at epd@lusilectra.pt.
We will respond within one month at the latest, which may be extended in the cases provided for in the GDPR. We may need to verify your identity before processing your request.
9. How do we protect your data?
We protect your personal data through a set of organisational and technical security measures designed to prevent unauthorised or unlawful access, use and data leaks, and to preserve its integrity. These measures were defined taking into account our IT infrastructure, their potential impact on your privacy and the costs involved, in line with current industry standards and practices.
Our information security procedures include:
- Access profiles, to ensure that each employee only accesses the data necessary for their duties;
- Strong password policy and multi-factor authentication on critical systems;
- Security incident management, including a 24/7 SOC (Security Operations Center) to monitor, detect, analyse and respond to potential threats;
- Backup system;
- IT security audits (penetration tests) and automated vulnerability detection systems;
- Information security policies, reviewed and communicated periodically;
- Among other measures.
Your personal data will only be processed by processors that comply with the security measures described above.
10. Minors
The Platform is not intended for persons under 18 and we do not knowingly collect personal data from minors. If you are the parent or legal guardian of a minor who has provided us with personal data, please contact us at qualidade@lusilectra.pt to request its deletion.
11. How do we update this Policy?
Lusilectra reserves the right to modify or update this Privacy Policy at any time. Changes will be published on this Platform, indicating the date of the last update.
- In the event of any discrepancy between language versions, the Portuguese version shall prevail.