Privacy policy | Arco-Íris & Borboletas

Last updated: 19 October 2026

Your trust is at the heart of everything we do. This policy explains, in plain words, what personal data we collect when you visit arcoiriseborboletas.shop, place an order or talk to us, what we use it for, who we share it with and how you stay in control.

1. Who is responsible for your data

Arco-Íris & Borboletas
Av. Agostinho Neto, Nr. 182, Maputo, Mozambique
E-mail: info@arcoiriseborboletas.shop
WhatsApp: +258 85 555 5504

We handle your data in line with the Constitution of the Republic of Mozambique and Law no. 3/2017 of 9 January (Electronic Transactions Law). For visitors from other countries we follow the same principles of international good practice, including those of the European Union’s General Data Protection Regulation (GDPR) where it applies.

2. What we collect and when

When you place an order: first and last name, mobile (WhatsApp) number, e-mail, province, city and delivery address (no address is needed if you pick up in store), any notes you write, the products, amounts, the delivery and payment options you choose and the payments we record.
When you create an account (optional): the details above and a password, which is stored encrypted — not even we can see it.
When you use the contact form: name, e-mail, mobile number (optional), subject and message.
When you talk to us on WhatsApp or by e-mail: your number or address, your profile name, your messages and any payment proof you send.
When you leave a review or comment: name, e-mail (never published) and your text.
When you browse the site: IP address, browser and device type, pages visited and date and time, logged by the server and firewall for security, plus the cookies described in section 8.

What we do not collect: we never ask for or store card details, M-Pesa PINs or banking passwords. We do not need health information either: blog articles are for information only, and we ask you not to send us clinical details.

3. Why we use your data and on what basis

To process and deliver your order — confirm payment, prepare and deliver it or arrange pickup, issue the invoice, send order e-mails and give support. Basis: performing our sales contract with you.
To meet legal obligations — accounting, tax and requests from competent authorities. Basis: legal obligation.
To answer your messages and requests, including exchanges and returns. Basis: the contract or your request.
To protect the site and our customers — preventing fraud, attacks and abuse. Basis: legitimate interest.
To understand where visits come from (for example Instagram or Google), in aggregate, to improve the shop. Basis: your consent, given in the cookie preferences.
To send news or offers, only if you explicitly ask for them. You can stop them at any time. Basis: consent.

We never sell or rent your data to anyone, and we do not make automated decisions about you based on it.

4. Payments

M-Pesa and bank transfer payments happen outside the website, directly in your M-Pesa account or your bank. We only receive confirmation of the payment and any proof you choose to send us. M-Pesa and the banks handle your data under their own privacy policies.

5. Who we share it with

We share only what is needed, with those who help us provide the service and are bound to protect your data:

Website and e-mail hosting — the servers that run the site and our mailboxes.
Backups — stored on Microsoft OneDrive, so we can restore the shop if something breaks.
Website security — the Wordfence firewall checks IP addresses to block attacks.
Deliveries — for orders to other provinces, Portador Diário receives your name, mobile number and destination. For deliveries in Maputo, the person delivering receives your name, mobile number and address.
WhatsApp (Meta) — when you choose to talk to us on WhatsApp, messages go through that service.
Authorities — only when the law requires it.

Technical maintenance of the site is done by an IT service provider, who only accesses data when that task requires it.

6. Transfers outside Mozambique

Some of the services above (for example Microsoft, Meta/WhatsApp and Wordfence) may store data on servers outside Mozambique, including in the European Union or the United States. We choose well-known providers that apply appropriate security and data protection safeguards.

7. How long we keep it

Orders and invoices: for the retention period required by commercial and tax law.
Customer account: while you keep it active; you can ask us to delete it at any time.
Messages and contact requests: up to 2 years after our last contact, unless they are part of an order.
Reviews and comments: while they are published.
Server security logs: for a short time, usually up to 90 days.
Backups: regularly replaced by newer ones.
Cookies: as set out in section 8.

8. Cookies

Cookies are small files stored in your browser. We use three kinds, and only the essential ones work without your permission:

Essential — basket and checkout (woocommerce_*, wp_woocommerce_session_*), your chosen language (pll_language), logging in (wordpress_*) and your cookie choice (aib_consent, kept for 6 months).
Statistics — where visits come from, such as Instagram or Google (sbjs_*, set by WooCommerce, up to 6 months). They help us see what works, without identifying anyone.
Marketing — to measure ads and campaigns. We do not use any at the moment.

We do not use Google Fonts or other external services that track you: the site’s fonts and files are served from our own server. You can change your choice at any time in Cookie preferences (also in the site footer).

9. How we protect your data

The site uses an encrypted connection (HTTPS), a firewall, restricted and protected admin access, automatic security updates and regular backups. Payment details never pass through the site. No system is 100% foolproof, but if an incident ever puts your data at risk, we will let you know without delay.

10. Your rights

At any time and free of charge, you can:

find out what data we hold about you and get a copy;
correct data that is wrong or incomplete;
ask us to delete your data, except what the law requires us to keep (such as invoices);
object to, or ask us to restrict, how we use it;
receive your data in a commonly used format to take it elsewhere;
withdraw your consent (for example in the cookie preferences), without affecting what was done before.

To use any of these rights, write to info@arcoiriseborboletas.shop or message us on WhatsApp. We may ask you to confirm your identity, and we reply within 30 days at the latest. If you disagree with our answer, you can complain to the competent authority.

11. Children

We sell items for babies and children, but the shop is meant for adults. We do not knowingly collect data from anyone under 18. If you know a minor has sent us personal data, contact us and we will delete it.

12. Links to other sites

The site links to Instagram, Facebook and WhatsApp. When you follow those links, their own privacy policies apply.

13. Changes to this policy

We may update this policy when the way we work changes or when the law requires it. The date at the top shows the current version; important changes will also be highlighted on the site.

14. Contact

Any questions about this policy or your data? Write to info@arcoiriseborboletas.shop or send us a message on WhatsApp. We will be happy to help.