Privacy Policy
Last updated: August 13, 2026
Effective date: August 13, 2026
Version: 4.0 (Release Candidate)
1. Identification of the Data Controller
This Privacy Policy applies to the website zultem.com and the subdomain account.zultem.com (together, "the Store"), operated by:
| Field | Value |
|---|---|
| Name/Business name | Zultem |
| Tax ID (NIF) | 244007225 |
| Registered office | Rua João de Ruão, n.º 12, R/C, Torre Arnado – Espaço CoWork, 3000-229 Coimbra, Portugal |
| Commercial registration | Not applicable |
| Contact email | support@zultem.com |
For the purposes of Regulation (EU) 2016/679, of 27 April 2016 ("GDPR"), and Law No. 58/2019, of 8 August, which ensures the implementation of the GDPR under Portuguese law, the entity identified above is the data controller for the personal data collected through the Store (hereinafter "the Operator" or "Zultem").
Whenever this document refers to "Zultem", "Store" or "Operator", such reference is to be understood as referring to the entity identified above, regardless of its legal form at any given time.
2. Scope of Application
This Privacy Policy describes how Zultem collects, uses, retains, shares and protects the personal data of the Store's users and customers, including visitors, registered purchasers and holders of a customer account on account.zultem.com.
This document should be read together with the Cookie Policy, which specifically governs the cookies and similar technologies used in the Store, and with the Terms and Conditions, which govern the contractual relationship between Zultem and the Customer.
3. What Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Identification and contact data | Name, email, phone number, billing and shipping address | Provided by the Customer upon registration or when placing an order |
| Account data | Order history, preferences, password (encrypted) | Generated through the use of account.zultem.com |
| Transaction data | Products purchased, amount, payment method (no card data, processed by a third party) | Generated during the checkout process |
| Browsing data | IP address, device and browser type, pages visited, traffic source | Automatically collected via cookies and similar technologies (see Cookie Policy) |
| Communication data | Content of messages sent to customer support, responses to surveys | Voluntarily provided by the Customer |
| Marketing data | Newsletter subscription, interactions with email campaigns | Explicit consent of the data subject |
Zultem does not collect special categories of personal data (within the meaning of Article 9 of the GDPR) and does not request data from minors without due authorization — see section 11.
4. Purposes and Legal Bases of Processing
| Purpose | Legal basis (Art. 6 GDPR) | Data involved |
|---|---|---|
| Processing and fulfilment of orders | Performance of a contract [(b)] | Identification, contact, transaction |
| Management of the customer account (account.zultem.com) | Performance of a contract [(b)] | Identification, account |
| Compliance with tax and accounting obligations | Legal obligation [(c)] | Transaction, billing |
| Customer support and complaint management | Performance of a contract / legitimate interest [(b) / (f)] | Identification, communication |
| Fraud prevention and Store security | Legitimate interest [(f)] | Browsing, transaction |
| Sending newsletters and direct marketing communications | Consent [(a)] | Contact, marketing |
| Personalized advertising, when active (see Cookie Policy) | Consent, via cookie banner [(a)] | Browsing |
| Analysis of Store performance, when active (see Cookie Policy) | Consent, via cookie banner [(a)] | Browsing |
The collection of data necessary for the performance of the purchase and sale contract (identification, address, payment method) is mandatory: without this data it is not possible to process the order. The remaining processing activities, namely direct marketing and non-essential analytics, depend on freely given, specific and informed consent, which may be withdrawn at any time under section 8.
Specifically, each legal basis used means the following:
- Performance of a contract [Art. 6(1)(b)] — processing is necessary to process the order, manage the customer account or fulfil any other obligation undertaken towards the Customer under the Terms and Conditions. Without this data, Zultem cannot provide the requested service.
- Legal obligation [(c)] — processing results from compliance with duties imposed on Zultem by law, namely tax, accounting or product safety duties, regardless of the wishes of the data subject or of Zultem.
- Legitimate interest [(f)] — processing serves a legitimate interest of Zultem or of third parties (for example, preventing fraud or responding to a customer support request), provided that such interest is not overridden by the interests or fundamental rights of the data subject. In these cases, the data subject may always object, under section 8.
- Consent [(a)] — processing depends on the data subject's prior, freely given and informed authorization, which may be withdrawn at any time without affecting the lawfulness of processing already carried out. This is the case for direct marketing and non-essential cookies (see Cookie Policy).
5. Data Recipients
Zultem does not sell personal data to third parties. Personal data may be shared, strictly to the extent necessary for the operation of the Store, with the categories of recipients identified below. This list is illustrative and not exhaustive: in the normal course of its business, Zultem may replace, add or discontinue the use of specific providers, without this implying any change to the nature of the categories of recipients or to the level of protection described herein.
| Category | Function | Example of purpose |
|---|---|---|
| E-commerce platform | Zultem operates the Store on the technology infrastructure of Shopify (Shopify Inc. and/or applicable Shopify group entities depending on the region, including Shopify International Limited for customers in the European Union), which provides website hosting, the checkout engine, catalogue, order and customer account management, and the payment processing infrastructure integrated into the Store. For these purposes, Shopify acts as a processor for Zultem under Article 28 of the GDPR, pursuant to the respective Data Processing Addendum | Hosting of the Store and management of orders, catalogue and customer account |
| Payment processors | Payment service providers integrated into the Store (namely through Shopify's payment infrastructure or additional third-party providers that may be activated) | Secure payment processing |
| Logistics partners and suppliers | Carriers and suppliers that ship products directly (see Shipping Policy) | Shipment and delivery of orders |
| Analytics and marketing tools | Analytics and advertising service providers that Zultem may activate subject to user consent, which may include, among others, traffic measurement tools, digital advertising platforms and email marketing platforms (see Cookie Policy for the specific list at any given time) | Performance measurement and advertising |
| Public authorities | Tax Authority and other competent entities, when required by law | Compliance with legal obligations |
| Professional service providers | Accounting, auditing, legal advice | Always subject to a confidentiality obligation |
All processors that process personal data on behalf of Zultem are bound by a data processing agreement under Article 28 of the GDPR.
6. International Data Transfers
Some of the service providers identified in section 5 may process data outside the European Economic Area (EEA), namely in the United States of America. In such cases, Zultem ensures that the transfer is always covered by at least one of the following legal grounds:
- Adequacy decision of the European Commission (Article 45 of the GDPR), including, with respect to recipients established in the United States of America, Implementing Decision (EU) 2023/1795, on the adequate level of protection provided by the EU-U.S. Data Privacy Framework, applicable to entities certified thereunder; or
- In the absence or inapplicability of an adequacy decision, appropriate safeguards under Article 46 of the GDPR, namely Standard Contractual Clauses approved by the European Commission, supplemented, when necessary, by additional protective measures.
Zultem monitors developments in the legal framework applicable to international data transfers and will adapt, without the need to reformulate the general principles of this Policy, the legal basis used for each transfer should the applicable adequacy decision be amended, suspended or invalidated.
The Customer may request additional information on the applicable safeguards through the contacts indicated in section 12.
7. Data Retention Period
| Data category | Retention period |
|---|---|
| Customer account data | For as long as the account remains active; after 3 years without any login or order associated with the account, the data is deleted or anonymized, unless a longer legal retention obligation applies (namely with respect to order and billing data, under the following row) |
| Order and billing data | 10 years, under the applicable tax and accounting obligations (Article 123 of the Corporate Income Tax Code and related legislation) |
| Direct marketing data | Until the data subject withdraws consent or, in the absence of any interaction by the data subject with marketing communications, for 3 years from the last interaction, after which the data subject is removed from the active contact list, without prejudice to a future new subscription |
| Browsing data (cookies) | According to the periods indicated in the Cookie Policy |
| Customer support communications | For the period necessary to resolve the request and, additionally, for 3 years after its closure, for evidentiary purposes, corresponding to the general limitation period for non-contractual civil liability (Article 498 of the Civil Code); where the communication relates to an order still covered by the statutory conformity guarantee, retention continues until the end of that period (section 10 of the Terms and Conditions) |
Once the applicable periods have elapsed, personal data is securely deleted or irreversibly anonymized.
8. Data Subject Rights
Under Articles 15 to 22 of the GDPR, the data subject may, at any time and free of charge, exercise the following rights:
- Access — obtain confirmation as to whether their data is being processed and access such data.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request the deletion of data, where applicable.
- Restriction of processing — restrict processing under certain circumstances.
- Portability — receive the data in a structured format and transmit it to another controller.
- Objection — object to processing based on legitimate interest or for direct marketing purposes, at any time.
- Withdrawal of consent — whenever processing is based on consent, without affecting the lawfulness of processing carried out prior to withdrawal.
Zultem does not subject data subjects to decisions based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them, under Article 22 of the GDPR. Should such a practice be introduced in the future, Zultem will inform the affected data subjects and ensure the safeguards required by law, namely the right to obtain human intervention and to contest the decision.
These rights may be exercised through the contacts indicated in section 12. Zultem responds within a maximum period of one month, extendable as legally permitted in cases of particular complexity.
The data subject also has the right to lodge a complaint with the competent supervisory authority — in Portugal, the National Data Protection Commission (CNPD), through www.cnpd.pt, without prejudice to the right to lodge a complaint with the data protection authority of their habitual country of residence, namely, in the case of residents in Spain, the Spanish Data Protection Agency (AEPD).
9. Data Protection Officer
Under Article 37 of the GDPR, the obligation to designate a Data Protection Officer (DPO) applies to entities whose core activity consists of large-scale processing of special categories of data, or which involves the regular and systematic monitoring of data subjects on a large scale, or where the processing is carried out by a public authority or body.
Given the nature, scope and purpose of the personal data processing it carries out — essentially the processing of orders and customer support for a B2C e-commerce store, with no processing of special categories of data nor large-scale systematic monitoring — Zultem is not, as of the date of this document, required to designate a Data Protection Officer. Zultem will reassess this position whenever developments in its activity so warrant, in light of the criteria set out above.
Notwithstanding the foregoing, any question relating to the processing of personal data, including the exercise of the rights set out in section 8, may be directed to the general contacts indicated in section 12, which also serve as a point of contact for these matters.
10. Data Security
Zultem implements technical and organizational measures appropriate to the risk, including access control, encryption of sensitive data in transit, encrypted passwords and security monitoring of the infrastructure provided by the e-commerce platform. In the event of a personal data breach likely to result in a high risk to the rights and freedoms of data subjects, Zultem will notify the CNPD and, where required, the affected data subjects, within the time limits set out in Articles 33 and 34 of the GDPR.
11. Minors
The Store is intended for persons over 18 years of age or minors with the authorization of their legal representative. Zultem does not intentionally collect data from minors without such authorization. Should it be found that data of a minor was collected without proper consent, Zultem will delete it as soon as such situation is identified or reported.
12. Contact
For any question regarding this Privacy Policy or the exercise of rights, the data subject may contact Zultem through:
- Email: support@zultem.com
- Address: Rua João de Ruão, n.º 12, R/C, Torre Arnado – Espaço CoWork, 3000-229 Coimbra, Portugal
Additional information on contacts and response times is provided in the Contact Information document.
13. Changes to This Policy
Zultem may update this Privacy Policy to reflect legal, technical or organizational changes. The version in force is always the one published on zultem.com, indicating the date of the last update. Substantial changes materially affecting the rights of the data subject will be communicated through appropriate means, namely by email or a prominent notice on the Store.
This document is an integral part of Zultem's legal document set, which also includes the Terms and Conditions, the Shipping Policy, the Returns and Refunds Policy, the Cookie Policy, the Legal Notice and the Contact Information.