Privacy policy

1. Data controller

The controller responsible for this website is Floating Hearts, Unipessoal Lda, NIPC 516411420, operating Marhaba Super Market at Avenida António dos Santos, 1 LT, 2000-074 Santarém, Portugal.

Privacy contact: [INSERT PRIVACY CONTACT EMAIL].

2. Information we collect

Depending on how you use the website, we may collect:

• Name, email address and mobile number.
• Account and authentication information.
• Delivery and billing addresses.
• Shopping basket, wishlist and order information.
• Coupon use, product reviews and customer enquiries.
• Technical data such as IP address, browser and session data.
• Payment status and provider references when payments are enabled.

3. Why we use your information

Personal information may be used to:

• Create and manage your customer account.
• Process baskets, orders, delivery and collection.
• Communicate order updates and customer support information.
• Manage refunds, cancellations, reviews and complaints.
• Prevent fraud and protect the website.
• Meet accounting, tax and other legal obligations.
• Improve website performance and customer experience.

4. Legal bases

We process information when it is necessary to perform or prepare a contract, comply with legal obligations, pursue legitimate business and security interests, or when you have given valid consent.

5. Payments

Live online payment processing is not currently enabled. When card or PayPal payments are connected, payment details will be handled by the selected payment provider. Marhaba Super Market should not store complete card numbers or card security codes.

6. Cookies and sessions

The website uses essential cookies and similar technologies for authentication, security, CSRF protection, shopping baskets and session management. Optional analytics or marketing cookies must not be activated without the required consent mechanism.

7. Sharing information

Information may be shared with carefully selected service providers when necessary for hosting, email, delivery, payments, fraud prevention, professional advice or legal compliance.

Providers should receive only the information required to perform their services and must protect it appropriately.

8. International transfers

If a provider processes information outside the European Economic Area, appropriate legal safeguards must be used, such as an adequacy decision or approved contractual protections.

9. Retention

Information is kept only as long as necessary for the purpose for which it was collected and for applicable accounting, tax, fraud prevention and legal retention periods.

10. Your data-protection rights

Subject to applicable conditions, you may request:

• Access to your personal information.
• Correction of inaccurate or incomplete information.
• Erasure or restriction of processing.
• Portability of eligible information.
• Objection to certain processing.
• Withdrawal of consent where processing relies on consent.

11. Complaints

Contact us first so we can investigate your concern. You also have the right to complain to Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados.

12. Security and updates

We use reasonable organisational and technical measures to protect personal information. No internet system is completely risk-free. This policy may be updated when the website, providers or legal requirements change.