Privacy Policy
1. Who is the data controller
CONTORNO LÍQUIDO - LDA
Registered office: Rua de Pinto Bessa, 122, Armazém 2, 4300-427 Porto, Portugal
NIPC: 516480600
E-mail for data protection matters: cervejadosdiabos@gmail.com
Telephone: +351 914 048 339
The Company has not appointed a Data Protection Officer, as it is not required to do so under Article 37 of the GDPR. Requests relating to personal data should be sent to the e-mail address above, with the subject line "Data protection".
2. Scope of this policy
This policy covers personal data processed by Contorno Líquido - Lda through this website, at its establishment and in connection with the beers, beverages, events and online sales it provides.
It does not cover the food service at the venue, which is operated independently by Pitadamaravilha, Lda. (NIPC 510780784), under the Sandwitch brand. That company is a separate controller for the personal data it collects, and requests concerning its processing should be addressed to it directly.
It also does not cover third-party platforms such as social media, which process your data under their own policies.
3. What we process, why, and on what legal basis
3.1 Browsing this website
Data: IP address, browser and device type, operating system, date and time of access, pages requested, referring page, diagnostic logs.
Purpose: security, availability, error diagnosis and technical administration of the website.
Legal basis: legitimate interest in operating and protecting the website (Article 6(1)(f) GDPR).
Retention: up to 12 months, then deleted or rotated.
3.2 Cookies and local storage
Data: your cookie banner choice and technical identifiers necessary for the website to function.
Purpose: core website operation and recording your preference.
Legal basis: strictly necessary storage is exempt from consent under Article 5 of Law no. 41/2004; any non-essential technology requires your consent (Article 6(1)(a) GDPR).
Retention: your cookie choice is stored for 180 days, after which you are asked again.
See clause 4 for details and for how to change your choice.
3.3 Contacting us
Data: name, e-mail address, telephone number and the content of your message.
Purpose: answering enquiries and managing the relationship with customers, suppliers and partners.
Legal basis: steps taken at your request prior to entering into a contract, or performance of a contract (Article 6(1)(b)); otherwise legitimate interest in responding (Article 6(1)(f)).
Retention: up to 3 years from the last contact, unless a longer period is required for a contract or legal claim.
3.4 Bookings and events
Data: name, contact details, number of guests, date and time, and any information you provide about the booking.
Purpose: managing table, group and private event bookings, and organising events.
Legal basis: performance of a contract or pre-contractual steps (Article 6(1)(b)).
Retention: up to 12 months after the booking date, unless a payment or invoice is involved, in which case clause 3.6 applies.
3.5 Online orders
Data: name, billing and delivery address, e-mail, telephone, tax identification number where requested, order contents, delivery details and payment confirmation. Card and bank details are handled directly by the payment provider and are not stored by us.
Purpose: processing, delivering and invoicing orders, handling returns, withdrawal requests and guarantee claims, and preventing fraud.
Legal basis: performance of a contract (Article 6(1)(b)); legal obligations relating to invoicing and consumer law (Article 6(1)(c)); legitimate interest in preventing fraud (Article 6(1)(f)).
Retention: 10 years for invoicing and accounting records; other order data for up to 3 years after delivery, in line with the legal guarantee period.
3.6 Invoicing, accounting and tax
Data: name, address, tax identification number, transaction details.
Purpose: issuing invoices and complying with tax and accounting obligations.
Legal basis: compliance with a legal obligation (Article 6(1)(c)).
Retention: 10 years, as required by Portuguese tax and commercial legislation.
3.7 Age verification
Data: confirmation that you are at least 18 years of age. Where an identity document is shown at the venue or on delivery, it is inspected visually and no copy is made or retained.
Purpose: complying with the prohibition on selling alcoholic beverages to minors.
Legal basis: compliance with a legal obligation under Decree-Law no. 106/2015 of 16 June (Article 6(1)(c)).
Retention: for online orders, the declaration is kept with the order record. No identity document data is retained.
3.8 Photography and audiovisual recording at events
Data: images and recordings in which visitors may be identifiable.
Purpose: documenting and promoting the venue and its events.
Legal basis: legitimate interest in documenting and promoting our activity (Article 6(1)(f)). Where an image focuses on an identifiable individual as its main subject, we ask for consent (Article 6(1)(a)).
Retention: for as long as the material remains relevant for promotional or archival purposes.
Signage indicating recording is displayed at the relevant locations. You may object to the use of an image in which you are identifiable, or ask for its removal, using the contacts in clause 1. We will act on such a request unless there are compelling legitimate grounds which override your interests.
3.9 Complaints
Data: identification and contact details and the content of the complaint.
Purpose: handling complaints, including those submitted through the electronic Complaints Book.
Legal basis: compliance with a legal obligation under Decree-Law no. 156/2005 (Article 6(1)(c)); establishment or defence of legal claims (Article 6(1)(f)).
Retention: 5 years from the closure of the complaint.
3.10 Social media
Data: your profile name, messages, comments and reactions on our pages.
Purpose: communicating with the public and managing our pages.
Legal basis: legitimate interest in communicating about our activity (Article 6(1)(f)).
Retention: for as long as the content remains published on the relevant platform.
The platform operators are independent or joint controllers for the data they collect through their own tools. Their policies apply in addition to this one.
4. Cookies and similar technologies
This website uses strictly necessary storage to operate correctly and to remember the choice you make in the cookie banner. Strictly necessary storage does not require consent under Article 5 of Law no. 41/2004.
- dd_cookie_choice_v2 (local storage, first party) – records whether you accepted or rejected non-essential technologies, and the date of that choice. Stored for 180 days.
- Session and platform cookies (first party) – set by the website platform to serve pages, maintain security and balance load. Deleted when the browser session ends or shortly afterwards.
If maps, video players, analytics or advertising tools are added to this website in the future, they will only be loaded after you have given consent, and this policy will be updated before they are used.
You can also block or delete cookies through your browser settings. Blocking strictly necessary storage may prevent parts of the website from working.
To change the choice you made in the cookie banner:
5. Who receives your data
We do not sell personal data. We share it only where necessary, with:
- Website platform and hosting provider, which stores the website and its server logs.
- Google Ireland Limited / Google LLC, as provider of the e-mail service used for our contact address, which therefore processes the content of correspondence sent to us.
- Meta Platforms Ireland Limited, in respect of interactions on our Facebook and Instagram pages.
- Payment service providers, which process payment data directly and independently for online orders.
- Carriers and logistics operators, for the delivery of orders.
- Ticketing platforms, where tickets for an event are sold through them.
- Our accountant and, where necessary, lawyers or auditors, bound by professional secrecy.
- Public authorities, where we are legally required to provide information, including tax, food safety, consumer protection and law enforcement authorities.
Service providers acting on our instructions do so as processors under a written agreement meeting Article 28 of the GDPR.
6. Transfers outside the European Economic Area
Some of the providers listed above are part of groups established in the United States, in particular the providers of our e-mail and social media services. Where personal data is transferred outside the European Economic Area, the transfer takes place on the basis of an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the provider is certified under it, or on the basis of standard contractual clauses adopted by the European Commission, together with any additional measures required.
You may request further information about the safeguards applied using the contacts in clause 1.
7. How long we keep your data
Retention periods are stated for each purpose in clause 3. In summary:
- Server and security logs: up to 12 months.
- Cookie banner choice: 180 days.
- Correspondence: up to 3 years from the last contact.
- Bookings: up to 12 months after the booking date.
- Order data: up to 3 years after delivery.
- Invoicing and accounting records: 10 years, as legally required.
- Complaints: 5 years from closure.
Where data is needed to establish, exercise or defend a legal claim, it is kept until that claim is resolved and the applicable limitation periods have expired.
8. Your rights
Under the GDPR you have the right to:
- obtain confirmation as to whether we process your data, and access to it;
- have inaccurate data rectified and incomplete data completed;
- have your data erased, where one of the grounds in Article 17 applies;
- obtain restriction of processing in the cases set out in Article 18;
- receive the data you provided in a structured, commonly used and machine-readable format, and have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means;
- object at any time to processing based on legitimate interests, on grounds relating to your particular situation, and to object at any time and without giving reasons to processing for direct marketing;
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
- lodge a complaint with a supervisory authority.
To exercise these rights, write to cervejadosdiabos@gmail.com. We reply within one month of receipt, extendable by two further months where the request is complex, in which case we will inform you within the first month. We may ask for information needed to confirm your identity where there is reasonable doubt.
The supervisory authority in Portugal is:
CNPD – Comissão Nacional de Proteção de Dados
Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal
Telephone: +351 213 928 400 | E-mail: geral@cnpd.pt
9. Is providing your data mandatory
Providing personal data is not a general legal obligation. However, some data is necessary to enter into or perform a contract: without it we cannot confirm a booking, process an order or issue an invoice. Where data is required by law, in particular for invoicing and for age verification, we cannot provide the service without it. The consequences of not providing data are limited to our inability to provide the corresponding service.
10. Children
This website is not directed at persons under 18, and the sale of alcoholic beverages to minors is prohibited. Under Article 16 of Law no. 58/2019, where processing is based on consent in the context of information society services, consent given by a minor is only lawful from the age of 13, and below that age it must be given by the holders of parental responsibility.
We do not knowingly collect data from minors for the purpose of selling alcoholic beverages. If you believe a minor has provided us with personal data, please contact us and we will delete it.
11. Automated decisions
We do not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you, nor do we carry out profiling for that purpose. Payment providers may run automated fraud checks as part of their own service and under their own policies.
12. Security
We apply technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR, including encrypted connections to this website, access control, limitation of access to those who need it, and agreements with our service providers. No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.
Where a personal data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, in addition to notifying the CNPD as required.
13. External links
This website may contain links to external services, including social media platforms, map services, payment providers, ticketing platforms and the electronic Complaints Book. Those services operate independently, under their own privacy policies, and we are not responsible for them.
14. Changes to this policy
This policy may be updated to reflect changes in our activity, in the services we use or in applicable law. The version in force is the one published on this page, identified by the version number and date at the top. Where changes are material, we will make them visible on the website before they take effect.
15. Contact
For any question about this policy or about how we handle personal data, write to cervejadosdiabos@gmail.com or use the contacts in the Legal Notice.