B2B Privacy Policy

Effective from 2026-05-03. Applies to data processing on the b2b.ioutlet.pt portal.

1. Data Controller

ILOVEDIGITAL UNIPESSOAL, LDA (Portuguese VAT 514344342), Rua de Olivença 9 Loja 27, 3000-306 Coimbra, Portugal. Contact: [email protected].

2. Data Collected

We collect only professional data needed for the B2B relationship:

(a) Company identification — name, VAT number, country, address;
(b) Professional contact — representative email and phone;
(c) Business type and self-declared monthly volume;
(d) Usage data — IP and user agent when downloading the catalog, order history and timestamps;
(e) Authentication data — username and password (the latter stored only as a bcrypt hash).

3. Purposes

(a) Portal access management and quote preparation;
(b) Compliance with tax obligations (invoicing, intra-EU recapitulative statement);
(c) Catalog access auditing (anti-fraud, protection of confidential pricing);
(d) Transactional communications about the account and orders.

4. Legal Basis

Performance of the contract (GDPR art. 6(1)(b)), legitimate interest in protecting the catalog and anti-fraud (art. 6(1)(f)), and compliance with legal obligations — in particular tax (art. 6(1)(c)).

5. Sub-processors

To deliver the service we rely on:

(a) Hetzner Online GmbH (Germany) — hosting;
(b) Cloudflare Inc. (EU/USA) — CDN and Turnstile anti-bot (DPA, SCCs);
(c) Dropshipping partner (EU) — order processing and shipment (only data strictly necessary for delivery), under DPA/SCCs;
(d) Google Ireland Ltd. (EU/USA) — Google Workspace, transactional email delivery (DPA, SCCs);
(e) Carriers — CTT and/or the logistics operators used by the dropshipping partner, for delivery purposes only (only data necessary for shipment).

6. Retention

We retain data for the duration of the commercial relationship and up to 10 years after its end, as required by applicable tax law (Portuguese CIVA art. 52). Catalog download logs are kept for 30 days.

7. Data Subject Rights

You have the right to access, rectify, erase (insofar as no retention obligation applies), port and object to processing by contacting us at [email protected]. You may also lodge a complaint with the Portuguese Data Protection Authority (CNPD).

8. International Transfers

Where data is processed by sub-processors outside the European Economic Area, transfers are covered by Standard Contractual Clauses approved by the European Commission.

9. Security

All pages are served over HTTPS. Passwords are stored as hashes. Each downloaded file contains a unique identifier for traceability in case of leakage.

10. Changes

This policy may be updated. We will notify by email at least 30 days in advance for any substantial change.