What we know about you, and for how long

Order data

Name, email, phone, delivery address, what you bought and in what size. Legal basis: performance of the contract. Kept for 10 years, because tax and commercial law require it.

Enquiry data

Name, email, optional phone, country, and whatever you write in the message. Legal basis: our legitimate interest in answering you. Kept for 24 months.

Fit measurements

Instep height, foot length, optional forefoot width, usual size, and any past rub locations you choose to tell us. Legal basis: your consent. Kept for at most 12 months.

Marketing consent

Your email and the fact you opted in. Legal basis: consent, withdrawable at any time. Kept until you withdraw it, plus the record of withdrawal.

Technical data

Server logs with IP address and request time, kept 30 days for security and abuse prevention. Legal basis: legitimate interest.

We do not buy contact lists, we do not enrich your record with data from brokers, and we do not run advertising trackers on this site.

First: the fit finder on this site sends nothing anywhere. When you move the ruler on the Instep Fit page, the matching runs entirely in your browser. No measurement leaves your device, and there is nothing for us to store.

Measurements only reach us if you deliberately send them — through the size recommendation form or by email. When you do:

• They are used for one purpose only: to suggest which sizes and styles are likely to fit.
• They are kept for a maximum of 12 months and then deleted. Every record carries its own deletion date from the moment it is created.
• They are never used to build a health profile, infer a medical condition, segment you for advertising, or train any model.
• They are not shared with anyone outside the company, and never with an insurer, an employer or a data broker.

We treat them carefully because information about your body deserves it, not because a regulator forced the point. And to be clear about what they are not: a size suggestion is a geometric comparison, not medical advice, and nothing we send you assesses your health.

Only the processors we need to run the shop:

• The carrier delivering your parcel — name, address, phone for delivery notifications.
• The licensed payment services provider that runs the payment page — the payment data you enter there goes to them directly, not through us.
• Our hosting and email providers, acting on documented instructions under Article 28 contracts.
• Our accountants and, where the law requires it, the tax authority.

Where a processor is outside the European Economic Area, the transfer runs on the European Commission’s standard contractual clauses. We do not sell personal data, and there is nothing on this site that would let us.

Access what we hold, correct it, delete it, restrict how we use it, object to processing based on legitimate interest, receive a portable copy, and withdraw any consent you gave — including for the measurements above — without that affecting anything done before you withdrew it.

Email support@artshoespt.mom. We answer within 30 days, usually within two working days, and we do not charge for it.

You have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt. If you live elsewhere in the European Union you may complain to your own national data protection authority instead. For consumer matters that are not about data, the routes are the electronic complaints book and CICAP – Centro de Informação de Consumo e Arbitragem do Porto.

This site is not intended for anyone under 13, and we do not knowingly collect their data. Between 13 and 17, an order requires a parent or guardian’s email address and consent, which we ask for at checkout. If you believe a child’s data has reached us, tell us and we will delete it.

The site is served over HTTPS only. Access to order records is restricted to the people who handle orders, over authenticated connections. Card details never touch our systems at all — see payment security. If a breach ever affects your rights we will tell the CNPD within 72 hours and you without undue delay.