This Privacy Policy explains how ROMA studio processes personal data collected through the website, Online Store and contact channels, in accordance with applicable data protection law.

Depending on how you interact with ROMA studio, we may process personal data such as your name, email address, telephone number, address, billing information, NIF/VAT number where provided, information relating to orders, payments, deliveries, contact requests, Projects and Products by Quote, as well as certain technical data required for the operation and security of the services.

Personal data may be processed for the following purposes:

Contact requests, Projects and Products by Quote
To respond to requests for information, prepare quotations or proposals and, where applicable, enter into and perform a contract.
Legal basis: taking steps at the request of the data subject prior to entering into a contract and performance of a contract.

Online Store
To process orders, payments, invoicing, transport, delivery, returns, refunds and customer support.
Legal basis: performance of a contract and, where applicable, compliance with legal obligations.

Tax and accounting obligations
To issue and retain documentation required by law.
Legal basis: compliance with a legal obligation.

Security and fraud prevention
To protect transactions and services against fraudulent, abusive or unlawful use.
Legal basis: legitimate interests in protecting services and transactions and, where applicable, compliance with a legal obligation.

Marketing communications
If ROMA studio makes consent-based marketing communications available, personal data will be used for this purpose only where the applicable consent has been provided. Consent may be withdrawn at any time.

Communications necessary for the management of orders, payments, invoicing, delivery or customer support are not marketing communications and may be sent where necessary for the performance of a contract or compliance with legal obligations.

Certain personal data are necessary to respond to a request, prepare a project or quotation, enter into or perform a contract, or process an order.

Where information is identified as mandatory, failure to provide it may prevent ROMA studio from responding to the request or completing the relevant operation.

Information identified as optional only needs to be provided where the customer chooses to provide it or where it becomes necessary for the relevant purpose.

In order to operate the website, process orders and provide its services, ROMA studio may disclose personal data, where necessary, to the following categories of recipients:

- website, hosting and e-commerce infrastructure providers;
- payment service providers;
- invoicing and accounting services;
- transport and logistics providers;
- email and communication providers;
- technical service providers necessary for the operation of the services;
- public authorities, where disclosure is required by law.

Only the personal data necessary for the relevant purposes will be disclosed.

The e-commerce and checkout components of the Online Store use services provided by Shopify.

ROMA studio uses Shopify features that incorporate Shopify Network Intelligence. In this context, Shopify may process data relating to customers’ interactions with ROMA studio, Shopify and other Shopify merchants in order to provide and improve certain services, including features relating to personalisation, analytics, security, fraud prevention and, where applicable, advertising.

In order to provide these services, certain information may be shared with Shopify and other service providers involved, including in countries other than the country in which the customer is located.

For certain processing activities associated with these services, Shopify acts as a data controller in accordance with its own terms and privacy policy.

Shopify Consumer Privacy Policy
‍
Shopify Privacy Portal

Some service providers used by ROMA studio, including Shopify, may process personal data outside the European Economic Area.

Where an international transfer of personal data is subject to the GDPR, legally recognised transfer mechanisms will be used, including, where applicable, adequacy decisions, Standard Contractual Clauses or other mechanisms recognised under applicable law.

For further information about the applicable transfer mechanisms, data subjects may contact: geral@romastudio.pt

Personal data will be retained only for as long as necessary for the purposes for which they were collected and for any additional periods required by applicable law or necessary for the establishment, exercise or defence of legal claims.

In particular:
- contact requests will be retained for the period necessary to handle and follow up the relevant request;
- data relating to orders, contracts and Projects and Products by Quote may be retained for the duration of the contractual relationship and thereafter for the periods required under applicable law;
- tax and accounting documentation will be retained for the periods required by law;
- data processed on the basis of consent will be used while that consent remains valid or until it is withdrawn, without prejudice to any other applicable legal retention obligations.

The website and Online Store may use cookies and similar technologies necessary for their operation, security, cart and checkout functions.

Where non-essential cookies or similar technologies are used for purposes such as analytics, personalisation or marketing, the information and consent mechanisms required by applicable law will be applied.

Where processing is based on consent, consent may be withdrawn through the preference management mechanisms made available to users.

Under applicable data protection law, data subjects may, where applicable, exercise the following rights:

- access to their personal data;
- rectification;
- erasure;
- restriction of processing;
- objection to processing;
- data portability;
- withdrawal of consent, where processing is based on consent.

To exercise these rights or request information about the processing of personal data, please contact: geral@romastudio.pt

ROMA studio may request information reasonably necessary to verify the identity of the person making the request.

Data subjects have the right to lodge a complaint with the competent supervisory authority.

In Portugal:
‍
Comissão Nacional de Proteção de Dados – CNPD
 www.cnpd.pt

This Privacy Policy may be updated where necessary to reflect changes in applicable law or material changes to ROMA studio’s personal data processing practices.

The updated version will be made available on the website.

The data controller is:

NOVELO POSITIVO - UNIPESSOAL, LDA
Rua António Serafim, CCI-3264, Algeruz
2950-497 Palmela – Portugal

‍Email: geral@romastudio.pt

Last updated: 08/09/2026