Privacy policy

Last updated: 3 November 2026

Black Peach is a Portuguese women's fashion store, with an online store at blackpeach.pt, the Black Peach app for iPhone and Android and a Show Room in Leça da Palmeira. This policy explains what personal data we process when you visit the website, use the app, make a purchase, take part in Peach Lovers or talk to us: what we use it for, who we share it with, how long we keep it and how you can exercise your rights.

1. WHO IS RESPONSIBLE FOR YOUR DATA

Fuchsiatraente, Lda., which operates the Black Peach brand
Tax number (NIPC): 514982977
Registered office: Rua Hintze Ribeiro, 554, 4.º Esq., 4450-691 Matosinhos, Portugal
Show Room: Rua Óscar da Silva, 1163, 4450-759 Leça da Palmeira, Matosinhos
Email: apoiocliente@blackpeach.pt
Telephone: +351 915 298 571 (call to a Portuguese mobile network)

We are the controller of your data, under the General Data Protection Regulation (GDPR) and Portuguese Law no. 58/2019. For any privacy matter, please use these contact details.

2. WHAT DATA WE PROCESS

It depends on what you do with us:

• Contact and account: name, email, telephone, delivery and billing addresses, tax number (if you ask for it on the invoice) and date of birth (if you provide it in Peach Lovers).
• Orders and payments: items bought, amounts, payment method and status, shipping, returns, refunds and invoices. We do not see or keep your full card details: they are handled by the payment providers.
• Activity in the store and the app: items you view, add to the bag and save, previous purchases, sizes you wear and when you open the app.
• Identifiers: your Shopify customer number, your Klaviyo profile identifier and, in the app, the phone's notification token (a code that Apple, on iPhone, or Google, on Android, assigns to each installation so that we can send it notifications).
• App usage (only when signed in): when you open and close the app and how long you use it, the items you view, add to the bag and save, the current bag, the phone model, the app and system versions and whether you have allowed notifications, campaigns and tracking (point 5.11).
• Technical data from the website: IP address, browser and device type, cookies and similar technologies (point 6).
• Peach Lovers: Peachies, tier, vouchers, invitations to friends and the actions that earn Peachies (for example, reviews or following us on social media).
• Communications: what you write to us by email, WhatsApp, contact form or social media, and your preferences (newsletter, campaign notifications).

We do not process sensitive data (such as health, origin or religion). The app does not access your location, camera, microphone or contacts.

3. WHAT WE USE THE DATA FOR AND ON WHAT LEGAL BASIS

• Selling and delivering: processing the order and payment, shipping or preparing collection at the Show Room, handling returns, exchanges and refunds and telling you the status of the order (by email and, in the app, by notification). Legal basis: performance of the purchase contract.
• Managing your account and your participation in Peach Lovers. Legal basis: performance of the contract.
• Invoicing and complying with legal obligations (tax, accounting, consumer protection and requests from the authorities). Legal basis: legal obligation.
• Personalising the store and the app: showing first what you have not yet seen and what is available in your size, recommending a size based on your purchases and returns and remembering what you saved. Legal basis: legitimate interest in making shopping easier. You can object (point 10). These recommendations only sort and suggest items: they decide nothing about you and have no legal effects.
• Sending news and promotions by email (newsletter) and campaigns by notification in the app (new arrivals, LIVE and Flash promotions). Legal basis: your consent. We may send customers who have already bought from us news of similar items by email, based on our legitimate interest (Portuguese Law no. 41/2004, art. 13-A). In any case, you can opt out whenever you like.
• Measuring our ads and showing them in other apps and websites (Meta, Google, Pinterest and TikTok). Legal basis: your consent, given in the website's cookie notice and in the iPhone tracking request, in the app (point 5.7).
• Creating ad audiences on Meta from the newsletter and customer email lists (point 5.7). Legal basis: legitimate interest. You can object at any time.
• Understanding how the app is used and helping you: time in the app, most viewed items and items added to the bag, purchases made in the app and notices received, in an internal panel (point 5.11). Legal basis: legitimate interest in improving the app and supporting you. You can object (point 10).
• Store statistics (what sells, which pages and items are viewed), to improve the website and the app. Legal basis: legitimate interest. On the website, in line with your cookie choices.
• Security and fraud prevention, including the automatic checks on orders carried out by Shopify. Legal basis: legitimate interest and legal obligation.
• Replying to your messages, requests and complaints. Legal basis: legitimate interest and, where applicable, legal obligation.

4. WHERE THE DATA COMES FROM

From you (account, checkout, forms and messages), automatically when you use the website or the app, and from our service providers (for example, payment confirmation from SIBS, shipping status from the carrier or the Peachies recorded by Growave).

5. THE BLACK PEACH APP (IPHONE AND ANDROID)

5.1 With and without an account

You can use the app without an account: view items, search, save, add to the bag and buy. If you want to sign in, you do so on the Shopify account page with a code we send you by email (there is no password). With an account, the app shows your orders, addresses, sizes and Peach Lovers. The session is stored securely on the phone: in the iPhone Keychain or in Android's secure storage (Keystore).

5.2 Notifications

The first time you open the app, we explain what notifications are for. The system request only appears if you tap «Turn on notifications». There are two types:

• Notices about your orders and returns: order received, paid, prepared, with the carrier, out for delivery, with an incident, delivered or ready for collection at the Show Room, and the status of each return. To send them, our server (app-api.blackpeach.pt) keeps your phone's notification token linked to your email. On iPhone, notifications are delivered by Apple (Apple Push Notification service); on Android, by Google (Firebase Cloud Messaging). The token is only linked when you sign in or place an order in the app. It stops being used when you sign out, delete your account or delete the app, and after 400 days without the app registering it again.
• Campaigns: new arrivals, LIVE and Flash promotions, sent through Klaviyo (point 5.3).

To turn off campaigns only: Menu › Settings › «Campaigns». Order notices continue. To turn off all notifications: on iPhone, Settings › Black Peach › Notifications; on Android, Settings › Apps › Black Peach › Notifications. The notifications you receive also stay in Menu › «Received notifications», stored only on your phone.

On iPhone, when you pay with MB WAY or Multibanco Reference, the app shows the payment deadline on the lock screen and in the Dynamic Island (Live Activity). So that we can close it when the payment is confirmed, our server keeps the identifier of that Live Activity with the order number, for a maximum of 3 hours.

5.3 Klaviyo (campaigns and marketing)

The app uses Klaviyo (Klaviyo, Inc., USA), the platform on which we manage the newsletter and campaigns. The app sends Klaviyo:

• the phone's notification token and your choice on the «Campaigns» switch;
• your email, when you sign in or place an order in the app. Until then, the profile is anonymous, with a Klaviyo identifier specific to this installation;
• your activity in the app: when you open it, the items you view, add to the bag and save or unsave, and the list of your saved items.

We use this data to send campaigns and automatic messages (for example, about items you left in the bag or saved) and to personalise the app (point 5.4). Klaviyo also receives your orders from Shopify and, if you subscribe to the newsletter, your email for that purpose. When you sign out of the app, the phone moves to a new anonymous profile.

5.4 Explore! and My Sizes

To show you first the items you have not yet seen and to recommend your size, our server reads from Klaviyo the items you have viewed (in the app and on the website) and your purchases and returns. It stores the result in one file per customer, identified by a code calculated from the email, with no email in the file. The file is deleted when you delete your account or after 6 months without opening the app while signed in. The sizes you choose by hand in «My Sizes» and the items already seen in Explore! stay only on the phone.

5.5 Peach Lovers (Growave)

The Peach Lovers programme runs on Growave, an external service connected to our Shopify store. Growave records your purchases, Peachies, tier, vouchers, invitations and the actions that earn Peachies, and sends your tier to Klaviyo. In the app, the Peach Lovers panel is loaded from the store page blackpeach.pt/en/pages/peach-lovers, with your session. That page respects your choice in the tracking request (point 5.7). The programme terms are at blackpeach.pt/en/pages/peach-lovers-programa-de-fidelidade.

5.6 Checkout and payments

In the app, purchases are made in the Shopify checkout, opened inside the app. What you enter there (name, email, telephone, address and payment) goes directly to Shopify and to the payment provider. The app does not store this data or send it to anyone else.

• MB WAY and Multibanco Reference: these are processed by SIBS. With MB WAY, the payment request reaches the MB WAY app on your phone. With Multibanco, you receive an entity and a reference to pay at an ATM or through online banking. SIBS notifies our payment server when the payment is made, so that we can mark the order as paid.
• Debit and credit card, Apple Pay, Google Pay, PayPal, Klarna and Scalapay: these are handled by the respective provider. We never see the full card number. Klarna and Scalapay (payment in instalments) may carry out their own checks, under their respective privacy policies.

5.7 Tracking request and ads

The app has no advertising or ad SDK and does not read the phone's advertising identifier (the iPhone's IDFA or Android's advertising ID). However, our Shopify store is connected to the ad channels of Meta (Facebook and Instagram), Google (including YouTube), Pinterest and TikTok. The Shopify checkout sends them purchase data so that they can measure and show our ads, for example: email, telephone, name, city and postal code, customer number and the checkout steps. These companies may also use this data in their own ad networks, under their privacy policies. For this reason, on iPhone, the app shows Apple's tracking request:

• If you allow it, purchases made in the app go to those channels, as on the website.
• If you do not allow it (or turn it off later in iPhone Settings › Privacy & Security › Tracking), the app tells Shopify that you do not authorise marketing or data sharing. The checkout and the Peach Lovers page stop sending data to those channels. The store's own statistics continue, without advertising purposes.

You can change your mind whenever you like, in iPhone Settings.

On Android there is no such system request. The app does not send any choice to Shopify, and the store's consent rules for your country apply: in Portugal and the rest of the European Union, without your consent, purchase data does not go to the ad channels.

Regardless of the tracking request, we use the newsletter and customer email lists, stored in Klaviyo, to create ad audiences on Meta (custom audiences). Meta compares the emails, in encrypted form, with Facebook and Instagram accounts, to show our ads to customers and to people with similar interests. You can object at any time by writing to us (point 10): we will remove your email from those audiences.

5.8 What stays only on your phone

The profile photo: you choose it from your gallery (on Android, in the system photo picker), the app only accesses photos for this purpose and does not send it anywhere. Also staying only on the phone are the sizes chosen by hand, the items already seen in Explore!, the notifications received and the app preferences (for example, light or dark mode). All of this is deleted when you delete the app. The photo is also deleted when you delete your account.

5.9 Search, messages, LIVE and reviews

• Search: what you type goes to Shopify only to show the results. We do not keep it or send it to Klaviyo.
• «Talk to us» opens WhatsApp, outside the app. WhatsApp's (Meta) privacy policy also applies there.
• LIVE sessions open in the app of the social network where we are live.
• Rating the app: we use Apple's or Google Play's own rating request and do not receive any data about you from it.

5.10 Delete your account

In the app: Menu › account › Edit profile › Delete account (in the Portuguese version of the app: Editar perfil › Eliminar conta). The app explains what is deleted and asks for confirmation. The request goes to Shopify, which deletes your personal data (name, email, telephone and addresses) and access to your order history. Shopify notifies the apps connected to the store (such as Klaviyo and Growave), which delete the data they hold about you, including Peachies, unused vouchers and your Peach Lovers tier. Our server immediately deletes the notification token, the Explore! and sizes history and the app usage record (point 5.11). The app ends the session and deletes the profile photo. Deletion at Shopify is completed over the following days. Invoices and order records are kept for 10 years (point 9), and are not used for anything else. If you have an order on its way, it will still be delivered. Without the app: send an email to apoiocliente@blackpeach.pt, from your account's email address, with the subject «Eliminar a conta» (Delete account). We will reply to confirm. To have only some data deleted, without deleting your account, send an email to the same address with the subject «Apagar dados» (Delete data) and tell us which data.

5.11 App usage and internal panel

When you use the app while signed in, the app sends our server (app-api.blackpeach.pt), in batches, the usage record linked to your email: when you open and close the app (and the time of use), the items you view, add to the bag and save, the current bag, the phone model, the app and system versions, and whether you have allowed notifications, campaigns and tracking. The server adds to this the purchases made in the app and the notices it has sent you.
Without a session, the app only sends a signal when you open it, with a random code for this installation (which does not identify you or the phone), the model, the versions and the permissions, so that we can count how many phones use the app. Your activity is not recorded.
We use this to understand how the app is used (for example, the most viewed items or how much is sold in the app), to improve it and to help you when you contact us. Our team sees this data in a panel inside the Shopify admin, with access only for those authorised by Black Peach. We do not share it with the ad channels or sell it.

6. THE WEBSITE AND COOKIES

The website uses cookies and similar technologies. The necessary ones (bag, session, checkout, security) are always active. Those for preferences, statistics and marketing (Meta, Google, Pinterest, TikTok, Klaviyo) are only used with your consent, which you give or withdraw in the cookie notice or in «Cookie preferences», in the footer. If your browser sends the Global Privacy Control signal (globalprivacycontrol.org), we treat it as a refusal of sharing for advertising in that browser. The details are in the Cookie Policy: blackpeach.pt/en/pages/politica-de-cookies.

7. WHO WE SHARE THE DATA WITH

Providers that process data on our behalf, under contract and only for the purposes of this policy:

• Shopify (store platform, accounts, checkout and orders): Shopify International Limited (Ireland) and Shopify group companies;
• Klaviyo (newsletter, notification campaigns and customer profiles): Klaviyo, Inc. (USA);
• Growave (Peach Lovers programme);
• SIBS (MB WAY and Multibanco Reference) and the other checkout payment providers;
• Moloni (certified invoicing);
• OVH (hosting of our app server and payment service, in the European Union);
• Apple (delivery of notifications on iPhone, through Apple Push Notification service) and Google (delivery of notifications on Android, through Firebase Cloud Messaging);
• carriers GLS and CTT (name, address, telephone and email, for delivery);
• accountants and consultants, bound by confidentiality.

Entities that process the data as controllers in their own right:

• Meta, Google, Pinterest and TikTok, with your consent (cookies on the website; tracking request in the app). Meta also receives, in encrypted form, the emails from the lists used to create ad audiences (point 5.7);
• Shopify, for its own features that use data from several stores (for example, fraud prevention and Shop). Shopify explains how it handles this data in the Shopify Consumer Privacy Policy (privacy.shopify.com), where you can also exercise your rights;
• WhatsApp (Meta), when you talk to us there;
• authorities and courts, when required by law.

8. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Some providers are in the USA or other countries outside the EEA (for example, Klaviyo, Meta, Google, Pinterest, TikTok and Shopify group companies). In these cases, the transfer is protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, for participating companies) or by standard contractual clauses approved by the Commission.

9. HOW LONG WE KEEP THE DATA

• Account: for as long as you have it. If you delete it, Shopify deletes the personal data over the following days.
• Orders, invoices and payments: 10 years, for tax and accounting obligations.
• Return requests and complaints: with the order they relate to.
• Newsletter and campaigns: until you opt out. Inactive Klaviyo profiles are deleted after 2 years.
• Peach Lovers: for as long as you take part in the programme.
• Notification token on our server: until you sign out, delete your account or delete the app, and a maximum of 400 days without the app registering it again.
• Payment Live Activity: a maximum of 3 hours.
• App usage (activity and notices sent): 13 months; the current bag, until it changes or you delete your account; the record of each phone (model, versions and permissions), up to 13 months after the last time you open the app.
• Explore! and sizes history on our server: until you delete your account or 6 months without opening the app while signed in.
• Record of account deletion requests (customer number and date, as proof that the request was handled): 3 years.
• Data stored only on the phone: until you delete the app.
• Backups of our server: encrypted, for 60 days.
• Cookies: see the Cookie Policy.

10. YOUR RIGHTS

You have the right to access your data, rectify it, erase it, restrict or object to its processing (including personalisation and marketing, at any time), receive a copy in a portable format and withdraw your consent, without affecting what was done before.

How to exercise your rights:

• in the app: delete your account (point 5.10), turn off campaigns (Menu › Settings › «Campaigns») and, on iPhone, allow or refuse tracking (iPhone Settings);
• in emails: with the «unsubscribe» link at the end of each email;
• on the website: with the cookie preferences and, so as not to share your data for advertising, on the page blackpeach.pt/en/pages/data-sharing-opt-out;
• for everything else: write to us at apoiocliente@blackpeach.pt.

We reply within one month. We may need to confirm your identity first. We will not treat you differently for exercising these rights.

If you think we have not handled your data properly, you can lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD), at www.cnpd.pt, or with the data protection authority of the country where you live.

11. MINORS

The website and the app are not intended for children under 16, and we do not knowingly collect data from children of that age. Peach Lovers is only for people aged 18 and over. If you are a parent or guardian and become aware that a minor has given us data, write to us and we will delete it.

12. SECURITY

All connections to the website and the app are encrypted (HTTPS). In the app, the session is kept in the phone's secure storage (Keychain on iPhone, Keystore on Android). Access to our servers is restricted, and backups are encrypted. No system is infallible: if there is a data breach that may affect you, we will notify you and the CNPD, as required by law.

13. CHANGES TO THIS POLICY

When we change this policy, we publish the new version here and update the date at the top. If the change is significant, we will also let you know by email or in the app.