1. Who is responsible?
João Vidal, operating under the Modvelo brand in Portugal, is responsible for the personal data described here. For privacy questions or requests, email [email protected].
2. Data and purposes
When you contact us by email or WhatsApp, we receive the contact details and message content you provide. For an order, we may also receive your name, delivery or collection-point details, telephone number, order information and billing details where needed. These may come directly from you or from Vinted when you buy there. Providing the necessary contact and delivery details is required to answer your request or fulfil the order; without them, we may be unable to do so. Please do not send sensitive data that we do not need.
3. Legal grounds
We use data to respond to purchase enquiries and fulfil orders under Article 6(1)(b) GDPR; to meet applicable invoicing and other legal duties under Article 6(1)(c); and to handle general enquiries, protect the website and defend legal claims under Article 6(1)(f). Our legitimate interests are customer support, service security and protection of our rights. We do not use your data for automated decisions with legal or similarly significant effects.
4. Website and language preference
Cloudflare hosts and delivers this website and may process technical information such as IP address, request time and browser details to provide and protect the service. The website code does not include advertising pixels or Google Analytics. It reads your browser’s preferred languages to choose an available translation. When you manually choose a language, only that language code is saved on your device using local storage, with no automatic expiry, until you change it or clear the website’s data in your browser. It is not an advertising identifier. Infrastructure security features may use necessary technical cookies.
5. Service providers and external links
Depending on how you contact us or buy, data may be processed by Cloudflare, Google/Gmail, WhatsApp, Vinted and InPost or its delivery partners. Only information needed for the relevant service or legal obligation should be shared. Facebook and Instagram buttons are links or sharing tools, not embedded advertising pixels. When you open an external service, its own privacy policy applies. Some providers may process data outside the European Economic Area. Applicable safeguards may include adequacy decisions or standard contractual clauses; see the provider information below, or contact us for details about your data.
6. How long data is kept
Contact messages are kept for the time needed to resolve the enquiry and necessary follow-up. Order records are kept to fulfil the purchase and related after-sales obligations; records subject to tax or other legal duties are retained for the applicable statutory periods. Relevant records may be kept longer where needed for an ongoing dispute or legal claim. Retention depends on the purpose, applicable obligations and whether a matter remains unresolved. Providers also apply their own retention rules to data for which they are responsible.
7. Your rights
Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction or portability of your data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Write to [email protected]; we may request proportionate information to verify your identity. You may also complain to Portugal’s CNPD — Comissão Nacional de Proteção de Dados, or the supervisory authority in your country of residence or work.
8. Updates and provider information
This policy will be updated when the website or data handling changes. The date above identifies this version. Provider information: Cloudflare · Cloudflare — DPA · Google · Google — EEA · WhatsApp · Vinted · InPost · Facebook / Instagram.