Privacy Policy

This policy explains which personal data are processed when you visit saojoaonosso.pt or use it to order products from the participating stores, under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese Law no. 58/2019.

1. Who is responsible

São João Nosso is a project of the Associação Comercial de São João da Madeira (ACSJM), the São João da Madeira Trade Association, in partnership with the Comércio Nosso platform and with the support of São João da Madeira City Council. ACSJM is the data controller for this website.

• Address: Avenida Doutor Renato Araújo, 433, 3700-244 São João da Madeira, Portugal
• Email:
• Phone: +351 918 857 686

2. Which data we process

• Browsing: the server hosting the website logs, for security and operational reasons, technical data about each request (such as IP address, browser and page requested), for a short period.
• Map: when you open the store map, your browser requests the map images from OpenStreetMap, which therefore receives your IP address.
• Orders: when you order a product, the name, phone and email you enter in the form are emailed to the store selling it (or to São João Nosso if the store has no email), so that it can contact you and arrange the order. It is sent through the platform of OURS, the agency that develops and maintains the website, which keeps a copy of the request.
• Direct contacts: if you write to us or call us, we process the data you give us in that contact.

The website does not use cookies, traffic analytics or advertising (see the Cookie Policy).

3. Purposes and legal basis

• Running and securing the website — ACSJM's legitimate interest (Art. 6(1)(f) GDPR).
• Getting your order to the store — steps taken at your request prior to a contract (Art. 6(1)(b)); the consent you give in the form also allows the store to contact you to confirm it.
• Answering your messages and store membership requests — steps taken at your request (Art. 6(1)(b)) or legitimate interest in replying (Art. 6(1)(f)).

4. Orders from stores

Each participating store is an independent business. Once the website has delivered your request, the store is the controller of that data and handles the order (price, payment, delivery, invoicing). To exercise your rights over that data, contact the store — its details are on its page.

5. Who we share data with

We do not sell or transfer personal data. We use providers that process data on our behalf, with GDPR safeguards: OURS (development and maintenance of the website and the platform that sends the orders), website hosting (Vercel Inc.), email delivery (Resend), the database holding the copy of the requests (Supabase) and the map service (OpenStreetMap Foundation). Some of these providers may process data outside the European Economic Area, based on the European Commission's standard contractual clauses or adequacy decisions.

6. How long

Server technical logs are deleted automatically after a short period. The copy of order requests is kept for 2 years, so that a request that did not reach the store can be looked into. Messages you send us are kept only as long as needed to reply and, at most, 2 years after the last contact, unless the law requires otherwise.

7. Your rights

You may request access, rectification, erasure or restriction of processing of your data, object to processing and request portability by writing to . We reply within one month. You also have the right to lodge a complaint with the Portuguese data protection authority, CNPD (www.cnpd.pt).

8. Changes

This policy may be updated; the date of the latest version is at the bottom of the page.

Last updated: 8 October 2026