Privacy policy

Last updated: 27 September 2026

Your information, clearly explained.

We use personal information to make and deliver your order, support you and run Wood Nest. Optional marketing and tracking come with choices. This policy explains those choices and how to contact us.

Data sharing and advertising choices

Contact us about privacy

1. Who is responsible for your data?

Wood Nest is operated by Oui C'est Moi, Lda, the controller of the personal data described in this policy.

Registered office: Caminho Senhora do Olival, Nº 15, 3260-427 Figueiró dos Vinhos, Leiria, Portugal
VAT number: PT507421221
Email: support@woodnest.co
Telephone: +351 932 600 637 (Calls to a Portuguese mobile network.)

This policy covers our online store, orders, customer support, marketing and creator relationships. It explains our processing under the EU General Data Protection Regulation (GDPR), Portuguese Law No. 58/2019 and the electronic communications rules in Law No. 41/2004, as amended. Additional local protections apply where relevant.

Payment providers, marketplaces and social networks may also process information for their own purposes under their own privacy notices.

2. The information we use

  • Contact and account information: name, email, telephone number, billing and delivery addresses, account identifiers, language, country and preferences.
  • Orders and payments: products, personalisation choices, amounts, currency, tax details where required, payment status, transaction references, delivery, return and warranty information. Payment providers handle payment credentials; we do not store full payment card numbers.
  • Personalised products and gifts: names, inscriptions, images or other content you provide for production, and a recipient's name and delivery details when you send a gift.
  • Support and reviews: messages, order references, photographs you send to explain an issue, and reviews or images you choose to submit for publication.
  • Device and browsing information: IP address, browser, device identifiers, approximate location derived from IP, pages and products viewed, cart and checkout events, referral sources and technical logs. Optional tracking depends on the choices described below.
  • Marketing preferences and interactions: subscriptions, consent records, opt-outs and, where permitted, interactions with messages, such as opens, clicks and purchases associated with a campaign.
  • Creators and affiliates: contact and business information, referral identifiers, agreed content, commissions and payment or tax information needed to manage our relationship.

We receive information from you, your device, people ordering a gift for you, and the platforms, payment services, carriers and other providers involved in your interaction with us.

Current or planned marketplace channels may include Amazon, Etsy, OTTO, Leroy Merlin, Makro, Faire and other third-party sales platforms. Some of these channels are planned and may not yet be active. The following applies only when you interact with us through an available channel; listing a planned marketplace does not mean we already exchange data with it.

Where you buy from us through a marketplace, we receive the information needed to fulfil the order and manage customer service, returns, invoicing and disputes. We may also return shipping, tracking, cancellation or refund updates to that marketplace. Its own privacy notice applies to its platform activities. Marketplace order data is not automatically added to our marketing lists; any separate marketing use needs an applicable lawful basis and must respect platform rules.

Where we receive your information from a purchaser, a marketplace or another third party, we provide the applicable privacy information within the legally required timeframe: normally within one month, or earlier at our first communication or disclosure, unless a lawful exception applies.

Required checkout fields are necessary to process and deliver your order or meet legal obligations. Without them, we may be unable to complete the purchase. Marketing subscriptions and optional tracking are not required to buy from us.

3. Why we use your information

For processing governed by the GDPR, we use the following bases. We do not treat every purpose as covered by every legal basis.

  • Orders, payments, production, delivery and returns: performance of our contract with you, including steps you request before purchasing (Article 6(1)(b)).
  • Invoices, tax records and legally required consumer assistance: compliance with legal obligations (Article 6(1)(c)).
  • Customer enquiries and account support: contract performance where linked to your order; otherwise our legitimate interest in responding to enquiries and providing support (Article 6(1)(f)).
  • Security, fraud prevention and legal claims: our legitimate interests in protecting customers, payments, systems and our legal position; legal obligations where applicable. We assess necessity and the impact on your rights.
  • Gifts and third-party personalisation details: our legitimate interest in fulfilling the purchaser's request while limiting use of the recipient's information to the relevant order.
  • Optional analytics, advertising identifiers and behavioural personalisation: consent (Article 6(1)(a)) where required, including for access to or storage of non-essential information on your device.
  • Promotional messages: consent (Article 6(1)(a)); or our legitimate interest in promoting our own similar products (Article 6(1)(f)) only where the electronic-marketing rules permit the existing-customer exception described in section 4.
  • Reviews: consent to publish your review, chosen display name and submitted images and our legitimate interests in verifying genuine purchases, moderating reviews and addressing feedback. Separate permission is required for reuse beyond the scope you authorised.
  • Creator and affiliate agreements: contract performance, applicable accounting obligations and legitimate interests in managing business contacts and preventing referral fraud.

4. Email, SMS and WhatsApp

We use Omnisend and Shopify messaging tools to manage subscriptions and communications. Emails, promotional SMS and browser notifications are sent only through channels for which we have the necessary permission or other legally valid basis. Giving us a delivery telephone number does not, by itself, subscribe you to marketing SMS or WhatsApp promotions.

Consent to one channel does not automatically cover another. Contacting support, accepting our terms or supplying delivery details does not by itself authorise promotional messages. We record the scope of the permission given and any withdrawal.

Where local law allows an existing-customer exception, we may promote our own similar products using contact details obtained during a sale only if you were given a clear, free and easy opportunity to refuse when those details were collected and in every message. A purchase is not unrestricted permission to send advertising.

Promotional abandoned-cart or browsing reminders follow the applicable marketing and tracking rules. Entering an email at checkout does not, by itself, authorise every reminder or channel.

You can object to direct marketing at any time, free of charge, including related profiling. Use the unsubscribe option in a message or email support@woodnest.co. For SMS, use the opt-out method stated in the message; browser notification permissions can also be changed in your browser. Necessary order, delivery and service messages may still be sent.

WhatsApp: if you contact us there, we use your contact details and messages to respond and assist with your order. Promotional WhatsApp messages require the permission applicable to that communication and an easy way to stop them.

We use WhatsApp Business for customer communications and plan to use connected marketing automations. Shopify Flow and Omnisend may organise or trigger workflows. Where a WhatsApp integration is used, the connected messaging provider also processes the details needed to send and manage the message.

Only the providers involved in a particular communication receive the information needed to deliver and manage it. Where more than one system is involved, we apply your opt-out to the relevant marketing workflows. You can ask us to stop promotional messages in the conversation or by email.

Where permitted, language, country, purchases and interactions help us choose relevant messages. Opening or clicking a message may create an interaction record through tracking technologies; we rely on your consent for this tracking where required. Withdrawing marketing consent does not require you to close your customer account.

5. Cookies, pixels and advertising

Cookies, local storage and similar technologies can keep your cart working, remember privacy choices, measure visits and purchases, or support advertising. A pixel or server-side conversion event may disclose information even if it does not set a browser cookie.

  • Strictly necessary: functions such as checkout, security, session management and remembering privacy choices. These do not require consent where the legal exemption applies. Blocking them in your browser may prevent parts of the store from working.
  • Optional preferences and analytics: remembering optional preferences and understanding use of the store beyond what is strictly necessary.
  • Advertising and measurement: attributing purchases to ads, limiting or personalising ads and creating advertising audiences.

Our advertising activities include Meta, Google, Pinterest, TikTok and OpenAI Ads. Depending on the integration and your choices, advertising partners may receive device or online identifiers, page or product interactions, cart and checkout events, order value and currency, and purchase events.

If contact identifiers are used for matching, they may be hashed; hashing does not necessarily make information anonymous. We do not use product-personalisation text, private gift messages or production images as advertising-event data.

Where consent is required, optional technologies are used only after you consent. You can refuse optional tracking and still make a purchase. Consent to analytics does not automatically mean consent to advertising. You can change or withdraw your choices through the store's cookie preferences control. You can also contact us for information about the technologies and providers involved.

Withdrawing consent stops future optional processing that relies on that consent; it does not automatically delete information already lawfully retained.

Microsoft Clarity: we use behaviour analytics, including heatmaps and session replay, to understand navigation and improve the store. Depending on consent and configuration, this can involve clicks, scrolling, page interactions, device information and online identifiers. Microsoft also processes information under its own Privacy Statement. Optional Clarity tracking is subject to applicable consent requirements. We exclude or mask private form content and product-personalisation details from recordings. Clarity does not need payment-card details or private messages to analyse navigation.

Cookie choices can be specific to a browser or device. You may need to repeat them when using a different device or after deleting stored preferences. Marketing unsubscribes, cookie choices and statutory advertising opt-outs serve different purposes; changing one does not necessarily change the others.

Cookie expiry is not necessarily the same as the retention period for information already received by a provider. Browser controls can also delete or block cookies, but do not necessarily stop server-side processing or remove information already lawfully retained.

6. Who receives information

We disclose the information needed for the relevant purpose to the following recipients:

  • Shopify: hosting, storefront, checkout, orders and related commerce services. Shopify processes information on our behalf and, for certain services, for its own purposes. See the Shopify Consumer Privacy Policy and Shopify privacy portal.
  • Shopify Inbox, messaging tools and Shopify Flow: customer conversations, transactional or permitted marketing messages, and workflows using order events, customer records and preferences. A workflow may pass necessary data to connected providers for the purposes described here; automation does not create permission for a new use.
  • WhatsApp/Meta and messaging providers: contact details, messages and delivery information needed to operate our WhatsApp communications.
  • Payment and instalment providers: the provider of the payment method you select at checkout, for payment processing, fraud checks, refunds and, where relevant, credit assessment. Its privacy notice applies to its independent processing.
  • Carriers, shipping services and customs intermediaries: recipient, address, contact and shipment information needed for delivery and customs clearance.
  • Omnisend: contact details, subscription and suppression status, order information and permitted interactions for communications and reporting. See Omnisend's legal and privacy information.
  • Loox and Judge.me: order verification, review invitations where permitted, and the reviews or images you submit. Public reviews display the information you choose to publish, not your private billing or delivery details. If we migrate between review providers, we transfer the review content and associated verification or preference records needed to continue that service, subject to the original permissions. Migration does not create new marketing consent. You may contact us about correction or removal of your personal information in a review.
  • Shopify Collabs and participating creators: affiliate administration and referral reporting. Creators receive only information necessary for their involvement; participation does not entitle them to a customer contact list.
  • Advertising partners: the information described in section 5, subject to applicable consent and opt-out rules.
  • Product options and cart tools: providers supporting personalisation choices, cart features and related order information where their tools are used.
  • Microsoft Clarity: the analytics information described in section 5.
  • Operational providers and advisers: authorised support, IT, accounting, production and legal providers where needed to operate the business.
  • Authorities and transaction advisers: where legally required, to protect or exercise legal rights, or for a genuine business reorganisation or transfer with appropriate safeguards.

Providers acting on our instructions are subject to appropriate processing obligations. Recipients processing data for their own payment, platform, security or advertising purposes may act as independent controllers. Where a particular activity involves joint controllership, you can ask us about the applicable allocation of responsibilities and exercise your rights against either joint controller as provided by law.

Shopify enhanced services: Shopify Network Intelligence is enabled for our store. Shopify may combine data from interactions with our store, other merchants and Shopify to provide enhanced services, including personalisation, fraud protection and advertising. Shopify and relevant third parties may process that information in other countries. Applicable consent and opt-out choices apply; Shopify's privacy portal above explains how to exercise rights directly with Shopify.

7. International processing

Wood Nest operates in Portugal. Our commerce, communications and advertising providers can process information in other countries, including Canada and the United States. Delivery outside Portugal also involves recipients in the destination country and, where necessary, transit countries.

European hosting does not mean that all processing remains in Europe. Shopify describes processing by group companies and service providers in several countries. Details of its recipients and locations are available in Shopify's subprocessor information. Provider and shipping arrangements determine which overseas recipients are involved in your interaction.

Where information is transferred outside the EEA, we use a legally recognised transfer mechanism: an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, with additional measures where necessary. A provider's location alone does not establish that a transfer is adequately protected.

For UK or Swiss information, the corresponding local transfer rules and safeguards apply where required. Where relevant, these include the UK transfer addendum or agreement and Swiss adaptations. You may contact us for information about recipients, destination countries and a copy or explanation of the safeguards, subject to necessary redactions to protect others.

8. How long we keep information

We keep information according to its purpose, legal requirements, outstanding obligations and the time needed to resolve a genuine dispute. Different parts of an order record may have different retention needs.

  • Invoices and legally required accounting records: generally 10 years under Portuguese tax rules, with the start date and any exceptions determined by the applicable rule. This does not justify keeping all browsing or marketing data for 10 years.
  • Order, delivery and support records: through fulfilment and the relevant returns, warranty and claims periods; afterwards only the information needed for remaining legal obligations or claims.
  • Production files and personalisation content: while needed to manufacture, deliver, correct or address an issue with the product. We do not retain reusable personalisation files indefinitely merely because invoice records must be kept.
  • Accounts: while the account is used or reasonably needed for the customer relationship, subject to closure requests and review of whether inactive accounts are still needed. Legal transaction records may remain after closure.
  • Marketing: while there is valid permission or another permitted basis and a continuing reason to contact you. Opting out stops marketing; a minimal suppression record may remain to prevent further unwanted messages.
  • Consent and rights requests: as needed to demonstrate compliance, respect choices and resolve related claims.
  • Reviews and affiliate records: for the publication or contractual purpose, subject to removal requests, moderation needs, and applicable accounting or claims requirements.
  • Technical and analytics data: for the period needed to investigate security events or produce the relevant analytics, taking account of configured deletion periods and provider limits. We distinguish identifiable records from genuinely anonymous statistics. You may request the retention information applicable to a particular service.

Information no longer needed is deleted or irreversibly anonymised. Restricted backup copies are removed through the backup lifecycle and are not used for ordinary marketing. A legal hold may preserve limited relevant records for a dispute or mandatory obligation.

9. Your choices and privacy rights

Depending on applicable law and the processing concerned, you may request access, correction, erasure, restriction, a portable copy of eligible data, and withdrawal of consent. Withdrawal does not affect the lawfulness of processing before it.

You may object to processing based on legitimate interests on grounds relating to your situation. You may object to direct marketing and related profiling at any time.

Send requests to support@woodnest.co or our registered office. Please identify the right you wish to exercise and the email address or other details associated with your interaction with us. You do not have to create an account to make a request. We ask only for information reasonably needed to verify identity or authority. We do not routinely require an identity document for every request.

For GDPR requests, we respond without undue delay and normally within one month. If a lawful extension of up to two further months is necessary because of complexity or the number of requests, we explain this within the initial month. Other applicable local deadlines are respected. Requests are normally free; any permitted refusal or fee will be explained.

Deletion is not absolute: necessary invoice, legal-claim or suppression records may be retained. We explain any applicable limitation and available complaint options.

You may complain to CNPD — Comissão Nacional de Proteção de Dados in Portugal, or the competent authority where you live, work or believe an infringement occurred. You do not need to contact us first before exercising this right.

10. Customers in other countries

Mandatory local rights remain applicable where the relevant law covers our activities. This policy does not waive them or require all privacy complaints to be brought in Portugal.

  • United Kingdom: where UK data protection law applies, you have the applicable access, correction, deletion, objection and other rights, and can complain to the Information Commissioner's Office.
  • Switzerland: where the Federal Act on Data Protection applies, you may exercise applicable access, correction and other rights, and contact the Federal Data Protection and Information Commissioner.
  • Canada: applicable federal or provincial laws may provide access, correction, withdrawal of consent and complaint rights. You may raise a concern with us or contact the Office of the Privacy Commissioner of Canada or the relevant provincial authority. Information processed overseas can be subject to lawful access by authorities in that jurisdiction.
  • Australia and New Zealand: where their privacy laws apply, you may request access or correction and complain about our handling of your information. If we cannot resolve your concern, contact the OAIC in Australia or the Privacy Commissioner in New Zealand.

United States: where applicable state law covers our activities, rights may include access, correction, deletion, portability, opting out of sale or sharing and targeted advertising, certain limits on sensitive information, appeal and non-discrimination. Advertising disclosures can qualify as “sale” or “sharing” even without a monetary payment.

Use our Do not sell or share my personal information / targeted advertising opt-out page, or email support@woodnest.co to exercise the applicable opt-out rights.

Where legally required, we honour recognised opt-out preference signals such as Global Privacy Control for the processing covered by the signal. We do not require identity verification for an advertising opt-out unless the applicable law permits it. An authorised agent may submit a request subject to appropriate verification. If a request is refused, email us with the subject “Privacy appeal”. We will review the decision and explain the outcome, applicable deadline and further complaint route under the relevant law. We do not unlawfully discriminate against you for exercising a privacy right.

11. Personalised items, children and public content

Our store is intended for adult purchasers and is not directed at children. We do not knowingly use children's information for targeted advertising or sell or share it for advertising purposes. However, an adult may provide a child's name for a personalised item. That is personal information too: it is used for the order and associated support, not as permission to market to the child.

Please provide only information necessary for the product, ensure you are entitled to provide another person's information, and avoid sensitive information or unnecessary details about children. If we receive information that should not have been supplied, contact us so we can assess and remove or restrict it as appropriate.

Submitting a name or photograph for production does not automatically authorise us to publish it in advertising or on social media. Separate permission is needed for that use. Reviews and images that you choose to publish may be visible to other visitors; avoid including private addresses or other unnecessary identifying details.

12. Security and automated tools

We use proportionate technical and organisational measures to protect information, including controlled access and secure transmission. No system is risk-free. Where an incident triggers legal notification duties, we notify the competent authority and affected individuals as required.

We may use automated segmentation to group customers by language, location, purchase history or permitted interactions and select relevant messages. This can affect which offers you receive. You can object to direct-marketing profiling at any time. Such segmentation is different from a solely automated decision with legal or similarly significant effects. Payment or credit providers may use automated fraud or credit assessments under their own notices. If you believe an automated decision has significantly affected your order, contact us for an explanation and, where applicable, human review or assistance contacting the relevant provider.

13. Updates and contact

We update this policy when our processing or legal requirements change. Material changes are communicated appropriately, and fresh consent is sought where required. Continuing to browse does not, by itself, amount to consent to new optional processing.

For questions, requests or a copy of this policy in an accessible format, contact support@woodnest.co.