DRAFT: this document requires legal review and does not constitute legal advice.
1. Data controller
The PetShop Flow platform is operated by Brunno Martins Carpena, a sole trader, tax number (NIF) 330047680, with address at Br. de Andrias, 4840-100 Terras de Bouro, Braga, Portugal ('PetShop Flow' or 'we'). For data protection matters, contact us at privacidade@petshopflow.com.
We are not currently required to appoint a Data Protection Officer (DPO); should the scale of processing require one, their contact details will be published here.
2. Our dual role: controller and processor
PetShop Flow acts in two distinct roles at the same time, depending on the data concerned:
| Data | Our role |
|---|---|
| Pet shop account data (account holder, subscription billing, team users) | Controller: we determine the purposes and means. |
| End-customer data (pet owners and their animals) that each pet shop uploads to the system | Processor: we process this data on behalf of and under the instructions of the pet shop, which is the controller. |
For end-customer data, the pet shop is the controller and the relationship with PetShop Flow is governed by a Data Processing Agreement (Article 28 GDPR) annexed to the Terms.
3. Categories of data processed
- Identification and contact data: name, email, phone, address.
- Account and profile data: credentials, team role, preferences.
- End-customer (pet owner) data: name, contact and service history.
- Animal data: name, species/breed, microchip, vaccination and care notes (not health data of the data subject under the GDPR, as it relates to animals).
- Billing and payment data: processed by Stripe; we do not store full card details.
- Technical data: IP address, session identifiers, usage and security logs.
4. Purposes and legal bases (Article 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Service delivery, account management, scheduling and payments | Performance of a contract |
| Invoicing, accounting and retention of invoices (VAT) | Compliance with a legal obligation |
| Security, fraud prevention and essential metrics | Legitimate interests |
| Marketing, newsletters, WhatsApp communications and non-essential cookies | Consent |
5. Processors
We rely on the following processors, all bound by data processing agreements:
| Processor | Function |
|---|---|
| Supabase | Database and authentication (personal data hosting) |
| Vercel | Application hosting and delivery |
| Stripe | Payment processing and verification (KYC) |
| Resend | Transactional email delivery |
| Himetrica | Product analytics (site usage and events, subject to consent) |
Pet shops are notified with reasonable prior notice (generally 30 days) of any change to the list of processors and may object under the Data Processing Agreement.
6. International transfers and data residency
We aim to keep data at rest within the European Union (database configured in an EU region). Some processors are US entities; in those cases, transfers rely on Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework, with adequate safeguards.
7. Retention
We retain data for as long as necessary for the purposes above. Specifically: end-customer data (for which we act as processor) is deleted or returned within 30 days after a pet shop account is closed; pet shop account data is retained for the duration of the subscription and for up to 90 days after closure (for export and recovery), then deleted; technical and security logs are retained for up to 12 months; invoices and tax documents are retained for 10 years, as required by Portuguese law. These periods will be confirmed in legal and accounting review.
8. Data subject rights
As a data subject, you have the rights of access, rectification, erasure ('right to be forgotten'), restriction of processing, portability and objection, as well as the right to withdraw consent at any time.
Where we process data as a processor (end-customer data), you should exercise your rights with the responsible pet shop; we support the pet shop in responding. You also have the right to lodge a complaint with a supervisory authority (in the EU, the Portuguese CNPD; in the UK, the ICO).
9. Cookies
We use cookies that are essential to the operation of the platform and, with your consent, non-essential cookies (analytics and measurement). You can manage your preferences via the cookie banner and the preferences link in the footer.
10. Contact
To exercise rights or raise privacy questions, contact privacidade@petshopflow.com.