Privacy Policy

1. Data Controller

Avivando — Cultural, Sports and Recreational Association
Tax ID: 518 088 316
Address: Rua Dom Estêvão de Alencastre, no. 51 | 9400-164 Porto Santo
Email: team@colorspxo.com

2. Personal Data Collected

When purchasing wristbands and products, we collect:

• Full name
• Email address
• Phone number
• Tax ID (optional, for invoicing)
• Delivery address (only when you choose postal delivery of merchandise)

Automatically, when visiting the site, technical data may also be collected, such as IP address, device and browser type and browsing data, through cookies (see Cookie Policy).

We do not collect sensitive data (health, religion, sexual orientation, etc.). Payment data (card number, etc.) is entered and processed directly by Easypay and is not stored by us.

3. Purposes of Processing

• Contract performance: order processing, wristband issuance, confirmations and QR access codes, and merchandise delivery;
• Legal obligation: tax and accounting compliance;
• Legitimate interest: fraud prevention and event security;
• Consent: marketing communications (only with express authorization).

4. Data Sharing

Data is shared exclusively with:

• Easypay — payment processing (PCI-DSS Level 1);
• Email providers — transactional emails;
• Cloudflare — static file hosting and security;
• Postal operators — merchandise delivery, where applicable.

We do not sell, transfer, or share personal data with third parties for marketing purposes.

5. International Data Transfers

Some of our processors may handle data on servers located outside the European Economic Area (EEA), namely Cloudflare, Inc. (static file hosting and security) and the transactional email provider, both based in the United States of America. Whenever data is transferred outside the EEA, we ensure it is subject to appropriate safeguards under the GDPR, namely Standard Contractual Clauses approved by the European Commission and/or adherence to the EU-U.S. Data Privacy Framework.

6. Data Retention

• Order data: 5 years (tax obligation);
• Marketing contacts: until consent withdrawal;
• Cookies: as per Cookie Policy duration.

7. Data Subject Rights

Under GDPR (Regulation (EU) 2016/679), you have the right to:

• Access your personal data;
• Rectify inaccurate data;
• Erase data (right to be forgotten), where applicable;
• Restrict or object to processing;
• Data portability;
• Withdraw consent at any time.

To exercise these rights, contact us at team@colorspxo.com.

8. Security

We implement appropriate technical and organizational measures to protect personal data, including SSL/TLS encryption, access controls, and monitoring.

9. Complaints

If you believe your data is not being handled correctly, you may file a complaint with the CNPD — Portuguese Data Protection Authority (www.cnpd.pt).