1. Who is responsible
Elena Bekker, trading as Helena Voile, is the controller for the personal information described in this notice. Contact contact@helenavoile.com for privacy requests.
- Seller & website operator
- Elena Bekker
- Business status
- sole trader (empresária em nome individual), established in Portugal
- Portuguese tax number (NIF)
- 312121512
- Business address
- Rua Major Reis Gomes 7 – Office B, 9000-038 Funchal, Portugal
- Customer support & privacy
- contact@helenavoile.com
2. Information we use
- Orders: order and payment references, the selected product and purchased PDF version, amount, currency, purchase email, payment status and relevant timestamps.
- File delivery: order access references, PDF download counts and the time of the last download, used to provide purchased files and investigate delivery problems.
- Support: your email, messages, order details and any evidence you choose to provide for an enquiry, cancellation or complaint.
- Technical and security records: IP address, request and device information processed by our hosting and security providers to serve the website, protect access and investigate misuse. The application maintains an audit log of administrator actions.
- Owner sign-in: the authorised owner’s email and authentication records for the private administration area. Shoppers do not need an account in our administration system.
Full card details are handled by Stripe when checkout is enabled. Do not send card details, authentication codes or private download links in routine support messages. Editing your design in Canva does not send your personalised design or guest list back to our shop. If you share a design with support, we receive the information you choose to share.
3. Why we use it
- Contract and pre-contract steps: process an order, verify payment, provide the PDF, recover purchase access and answer product or order enquiries.
- Legal obligations: required tax and accounting records, valid consumer requests and legally required disclosures.
- Legitimate interests: proportionate website security, fraud prevention, troubleshooting, record keeping for legal claims and support not otherwise necessary for a contract. You may object where this is the applicable basis.
- Consent: optional activities that require consent, if introduced. We do not treat buying a template as permission for marketing.
Information necessary to process payment and identify an order is required to provide the purchase. Without it we may be unable to complete the order or recover its files. We do not sell customer information or use it for our own automated decisions producing legal or similarly significant effects.
4. Providers & independent services
Cloudflare provides hosting, database, private file storage and security, including owner sign-in. See Cloudflare’s privacy policy. Stripe processes payments when checkout is enabled and may act as a separate controller for payment, fraud-prevention and regulatory purposes; see Stripe’s privacy policy.
Our business email provider handles messages sent to our support address. Google Fonts currently serves the website’s fonts, so your browser connects to Google when loading them; see Google Fonts’ privacy information. We do not embed Canva’s editor in our store. Following a Canva link takes you to an independent service governed by Canva’s privacy policy.
Information may also be disclosed where required by law or reasonably necessary to establish, exercise or defend legal claims. Access is limited to the people and providers who need it for the relevant purpose.
5. International processing
The business is established in Portugal. Our providers may process information outside the European Economic Area. Where GDPR transfer restrictions apply, we rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses and any required supplementary measures. Contact us to ask about the safeguards relevant to your information.
6. How long information is kept
We keep order and payment records for fulfilment, applicable Portuguese tax and accounting obligations and any relevant legal-claim period. Download records are associated with the order and retained only as needed to deliver or recover files, investigate misuse and address disputes. Support correspondence is kept to resolve the enquiry and for any related complaint or claim period. Provider security logs and owner access records follow the configured security retention needed for those purposes.
Retention depends on the record’s purpose and applicable legal duties, rather than on the lifetime of a single download link. An erasure request does not require deletion of records we must lawfully retain. We can explain the period or criteria applicable to your request.
7. Your choices & rights
Depending on the processing, you may request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Some rights are subject to legal conditions.
Write to contact@helenavoile.com. We may ask for proportionate information to verify your identity. We normally respond within one month; if a lawful extension is needed, we explain it. You may complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD) or another competent supervisory authority, including in your EU country of residence or work.