Skip to content

Legal

Privacy Policy

Last updated: 6 October 2026

This policy explains what personal data we collect through pewpew.pt, what we use it for, who we share it with and what you can ask of us.

1. Who processes your data

The controller is Sequência Janota - Unipessoal, Lda., tax and registration number (NIPC) 517 402 882 at the Conservatória do Registo Comercial de Aveiro, with a share capital of 1 000 €, trading as PEW PEW.

2. What this policy covers

It covers pewpew.pt in both its Portuguese and English versions, including the merchandise store, the equipment rental catalogue, the customer account area and the contact form. It does not cover contracted production projects, which are governed by the proposal and contract of each job, nor third party platforms where we have a presence, such as social networks or streaming platforms.

3. What we collect, and when

3.1 Contact form

The form on the contacts page (and the "ask a question" form on product pages) sends the topic, name, email and message you write, your language and the page you wrote from to our back office (section 7), which forwards them to our mailbox, from where we reply. To stop spam we count submissions per IP address and per email, in memory only and for one hour.

3.2 Customer account

Creating an account is optional and asks for your name, email address and a password (at least 8 characters). The password is never stored in the clear: we keep only an irreversible cryptographic hash (bcrypt). The session lives in a cookie of ours, described in section 5.

3.3 Store orders and rental bookings

When you place an order or a booking on the site, we collect:

  • name and email address;
  • phone number, if you give it (it is optional at checkout);
  • for Apple Pay or Google Pay payments, the name, email, phone and address you pick in your device's wallet, which the wallet sends us to create the order;
  • tax number and, when you ask for a company invoice, the company name;
  • billing address (street, postal code, town and country), which is also the delivery address if you choose shipping instead of pickup;
  • any notes you want to leave about the order;
  • the items, sizes and quantities and, for rentals, the pickup and return dates;
  • for used equipment, a record that you accepted the condition of each item and the warranty terms, with the version of the listing you saw at checkout;
  • for rentals, the details for the rental agreement: whether you rent as an individual or a company, your full name, the type, number and expiry date of your identification document, your tax number and address and, for a company, its name, tax number (NIPC), address and your role in it. If the pickup is less than 14 days away we also record your request for the rental to start within the withdrawal period;
  • the totals, the rental discount applied, VAT and the shipping cost;
  • the payment method chosen and the reference the payment processor returns;
  • for bank transfer payments, the proof of payment you upload (section 3.6);
  • an order reference and an access code, which let you check the status without creating an account.

Your card details never pass through us: they are entered directly on the payment processor's pages or in your device's wallet (section 7).

3.4 Technical data

The IP address of each request is used to limit repeated attempts on sensitive routes (sign in, registration, order creation and order lookup by reference). Those counters live in memory, in windows of minutes, and never reach the database. Server logs and the logs of the network that sits in front of the site may contain IP address, date, request and browser identification.

3.5 Where your visit came from, and your cookie choice, with the order

If you reached the site through a campaign link (with utm_* parameters, for example from a post or an ad), we record with the order the campaign, the landing page and the site you came from, so we know which campaigns lead to orders. Without cookie consent this only covers the visit in which you order and nothing is stored in your browser. With marketing consent we also record the ad click identifier (gclid, fbclid, ttclid or li_fat_id) and, for the conversion measurement described in section 5.2, the advertising tags' identifiers, the IP address and browser identification at the time of the order. With analytics consent we record the random Google Analytics identifier. We always record the cookie choice you had when you ordered, because that is what decides what may be reported.

3.6 Bank transfer proof of payment

If you pay by bank transfer, we ask for the proof of payment (PDF or image, up to 10 MB) so we can confirm the payment. The file is not stored on the site: it goes straight to a private folder in our back office (section 7), which only the people who confirm payments can open. It holds whatever your bank prints on it, usually the payer's name, the IBAN or part of it, the amount, the date and the description. We use it only to confirm or reject the order's payment and, where needed, to prove it. Basis: performance of the contract (Article 6(1)(b) GDPR) and our legitimate interest in being able to prove the payment (Article 6(1)(f)). The retention period is in section 10.

4. What we do not do

  • Without your consent we load no audience measurement or advertising tool: your browser does not contact Google, Meta, TikTok or LinkedIn. Declining changes nothing about how the site works.
  • We do not send your name, email, phone or address to measurement or ad platforms from the browser. Email and phone only go, turned into an irreversible code (SHA-256), in the cases in section 5.2 and only with marketing consent.
  • We do not sell or hand over personal data to third parties for their own marketing.
  • We do not use Hotjar, session recording or equivalent tools.
  • We do not send a newsletter or promotional messages, because that service does not exist on the site today. If it ever does, it will be with prior consent and with a simple way to withdraw it.

5. Cookies and storage on your device

The site uses cookies and the browser's local storage in three categories:

  • Strictly necessary, always on: the customer account session (pp_sess), your language (NEXT_LOCALE), access to your orders in this browser (ppo_ followed by the reference), the cart (ppCart1), your latest order references (ppOrders1), the checkout draft, the opening animation and your cookie choice (ppConsent2), and Stripe's fraud prevention cookies where it loads.
  • Analytics, only with your consent: Google Analytics (section 5.1).
  • Marketing, only with your consent: the tags of the ad platforms (section 5.2).

The full list, with the name, owner, purpose and duration of each cookie, and the providers active at any given time, is in the Cookie Policy. You choose in the cookie notice, by category, with "Accept all" and "Reject all" side by side; your choice is stored in your browser with its date and the version of the list, and we ask again after 6 months or when the list changes. You can change it at any time through the "Cookies" link in the footer: withdrawing consent stops the tags straight away and deletes their cookies on our domain.

When you use the PayPal buttons or pay on Stripe's pages, those services may set their own cookies on their domains, under their privacy policies. This only happens at payment and only with the method you choose.

5.1 Audience measurement (Google Analytics)

We use Google Analytics 4, a service of Google Ireland Limited, to understand how many people visit the site, where they come from and what they do on it. It is only loaded after you accept analytics: without that acceptance your browser never contacts Google. Basis: consent (Article 6(1)(a) GDPR).

With measurement on, your browser sends Google the pages viewed, the steps through the shop and rental (products viewed, cart, checkout and paid purchases, with the order reference, value and items), technical data about your device and browser, and the random identifier from the _ga cookies. Never your name, email, phone or address. We use Google Consent Mode v2: the advertising signals are only on if you also accept marketing. Google Analytics 4 does not log the full IP address. Google may process this data outside the European Economic Area, under the conditions in section 8.

5.2 Advertising

We may advertise on platforms such as Google (Google Ads), Meta (Facebook and Instagram), TikTok and LinkedIn. The platforms in use at any time are listed in the Cookie Policy and in the cookie panel; a platform that isn't listed there receives nothing. Only with your marketing consent, the site loads those platforms' tags to: know which ads led to visits, bookings and purchases (conversion measurement), show ads to people who already visited the site (remarketing), and find people with similar interests. Each platform receives the pages viewed, the shop steps (product viewed, cart, checkout, purchase with the reference, value and items) and the identifier of your browser or of the ad click, and may combine them with what it already knows about you if you have an account with it. Basis: consent (Article 6(1)(a) GDPR).

So that purchases are counted even when the browser can't report them, we may also use: Google Ads enhanced conversions, where your email goes to Google turned into an irreversible code (SHA-256); and, once payment is confirmed, our server reporting the purchase to Google Analytics (with the random _ga identifier, only with analytics consent) and to Meta's Conversions API (with your email and phone in that irreversible code, the IP address, browser identification and Meta's identifiers, only with marketing consent). We only do this with the consent you had when you placed the order (section 3.5).

For the collection and transmission of data by the Meta and LinkedIn tags we are joint controllers with those platforms, under the addenda they provide; what they do with the data afterwards, for their own purposes, is their own responsibility.

6. Why we use your data, and on what legal basis

  • To handle your order or booking, which includes checking availability, taking payment, preparing pickup or shipping, and talking to you about the order. Basis: performance of the contract (Article 6(1)(b) GDPR).
  • To keep the customer account you created and its order history. Basis: performance of the contract.
  • To invoice and meet tax and accounting obligations. Basis: legal obligation (Article 6(1)(c)).
  • To answer messages and quote requests. Basis: pre-contractual steps and, beyond those, our legitimate interest in replying to people who write to us (Article 6(1)(f)).
  • To keep the site secure, blocking password guessing, abuse of the payment routes and fraudulent bookings. Basis: legitimate interest (Article 6(1)(f)).
  • To measure the site's audience with Google Analytics, only after you accept it in the cookie notice. Basis: consent (Article 6(1)(a)), which you can withdraw at any time.
  • To measure and optimise our advertising on ad platforms (section 5.2), only after you accept marketing in the cookie notice. Basis: consent (Article 6(1)(a)), which you can withdraw at any time.
  • To know which campaign led to each order (section 3.5), using the campaign parameters of the link you arrived through. Basis: our legitimate interest in understanding which communication works (Article 6(1)(f)); what is stored in your browser and the click identifiers depend on your consent.
  • To remember your language and your cart on your device, because that is what makes the site work as you expect. Basis: delivering the service you asked for.

7. Who we share it with

We share the minimum needed, and only for the purposes above:

  • Stripe (Stripe Payments Europe, Limited, Ireland), for card, Apple Pay and Google Pay payments. The card is entered on Stripe's own pages or in your device's wallet and does not pass through us. We send the email address, the order line descriptions, the amount and the reference.
  • PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), when you choose to pay with PayPal. We send the order reference and the amount, and approval happens in the customer's PayPal account.
  • Bank transfer: the payment goes through your bank and ours, and the proof of payment goes to our back office (section 3.6).

The active payment methods are card, Apple Pay and Google Pay (through Stripe), PayPal and bank transfer. MB WAY payments (through euPago) are not active: they do not appear at checkout and euPago receives no data at all. If we turn them on, we will update this policy first.

  • OVH (OVH SAS, France), which rents us the server the site runs on and where the site's order and account database lives, in a data centre in France.
  • PEW PEW connect, our internal back office, where production and logistics handle the order. When an order is paid, or when the proof of a bank transfer arrives, the site sends it the reference, name, email, phone, total, payment method, notes, the order lines with rental dates, and also the address, tax number, company and language. For rentals it also sends the rental agreement details (section 3.3): the agreement is drawn up and signed in connect. Contact form messages and bank transfer proofs also arrive there. It is a PEW PEW system, on a server of our own at our premises in Portugal, not a third party service.
  • Cloudflare (Cloudflare, Inc.), which serves the site and the back office in front of our servers as a delivery and protection network, and where we keep the back office backups. Traffic, including your IP address, passes through that infrastructure.
  • Google Workspace (Google Ireland Limited), our email service: the messages you send us and the emails about your order that we send you go through our Google email account.
  • CARTO and OpenStreetMap: the map on the contacts page is built from image tiles your browser requests from basemaps.cartocdn.com, with OpenStreetMap data. That request reveals your IP address and the map area loaded, and only happens if you open the contacts page.
  • Google (Google Ireland Limited), when you accept analytics or marketing in the cookie notice: it receives the data described in sections 5.1 and 5.2 to provide Google Analytics and Google Ads.
  • Meta (Meta Platforms Ireland Limited), TikTok (TikTok Technology Limited) and LinkedIn (LinkedIn Ireland Unlimited Company), when we use them and only if you accept marketing: they receive the data described in section 5.2.
  • Invoicing and accounting providers, and the Portuguese tax authority where the law requires it.
  • Public authorities or courts, when the law requires it or when it is necessary to defend our rights.

Beyond this list the site calls no third party services: fonts, images and video are served from our own domain.

8. Transfers outside the European Economic Area

The site's server and its database are in France, in an OVH data centre, and the back office is in Portugal: both inside the European Union. Some of the providers listed above are part of international groups and may process data outside the European Economic Area, mainly in the United States. When that happens, the transfer is covered by one of the GDPR mechanisms: the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework (as are Google, Meta, LinkedIn, Stripe, PayPal and Cloudflare) or, otherwise, standard contractual clauses approved by the Commission (the basis TikTok relies on, as it may give group companies in the United States, Singapore, Malaysia and China access to the data). The detail for each cookie provider is in the Cookie Policy.

9. Where the data lives and how we protect it

  • Orders and accounts live in the site's database, on the server we rent from OVH, and paid orders also in the back office, always with access restricted to the people who need it to work.
  • Passwords exist only as bcrypt hashes.
  • The session is a signed HttpOnly cookie, valid for 7 days.
  • The site is served over HTTPS only, with a content security policy and security headers.
  • Sign in, registration, order and lookup routes have attempt limits.
  • Requests between the site and the back office are signed and rejected outside a window of a few minutes.
  • Card data does not pass through our systems.

No system is perfect. If there is a personal data breach that puts your rights at risk, we follow the notification duties set out in the GDPR.

10. How long we keep it

  • Customer account: for as long as you keep it. If you ask for deletion, we delete the account data except what the law requires us to retain.
  • Orders and invoicing documents: for the period required by Portuguese tax law, currently 10 years.
  • Orders created and never paid: kept only while useful for support and for understanding problems in the buying flow. You can ask us to delete them at any time.
  • Email messages: kept while needed to reply and to follow up on the request. You can ask us to delete them at any time.
  • Bank transfer proofs and withdrawal requests: with the order they relate to, for the same period, because they are the evidence of the payment and of the withdrawal.
  • Visit origin and cookie choice stored with the order (section 3.5): the same period as the order.
  • Cookies and browser storage: the period for each is in the Cookie Policy. On the ad platforms, their own periods apply.
  • Rate limiting counters: minutes, in memory only.

11. Your rights

You have the right to ask for access to your data, to correct it, to have it erased, to restrict processing, to object to processing based on legitimate interest, and to receive the data you gave us in a usable format, for yourself or for another controller (portability). Where processing depends on consent, you can withdraw it at any time, without affecting what was done before on that basis.

To exercise any of these rights, write to contact@pewpew.pt. We may need to confirm your identity before answering, so that we do not hand data to someone who is not the data subject. We reply within one month, extendable under the GDPR when the request is complex. Exercising your rights costs you nothing and carries no consequence for you.

If you believe we handle your data improperly, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados: www.cnpd.pt.

12. Children

The site, the store and the rental service are not aimed at children and we do not ask children for data. If you know a minor has left personal data with us, write to contact@pewpew.pt and we will delete it.

13. Changes to this policy

If we change how we handle personal data, we update this text and the last updated date at the top. When a change is significant and we have a way to reach you, we will say so.

14. Contact

PEW PEW (Sequência Janota - Unipessoal, Lda., tax and registration number (NIPC) 517 402 882 at the Conservatória do Registo Comercial de Aveiro, share capital 1 000 €), Rua do Urjal, n.º 48, 3830-173 Ílhavo, Portugal. Email contact@pewpew.pt, phone +351 969 784 500.