PRIVACY AND DATA PROTECTION POLICY

Last updated: October 24, 2025

1. INTRODUCTION

CERÂMIRUPE, CERÂMICAS, S.A., represented by the brand TERRAFINA – stoneware by ceramirupe, is committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, store and protect your personal data when you use our website www.terrafinastore.com and our services.

This policy complies with:

• Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR)
• Portuguese Law No. 58/2019 of August 8 – GDPR implementation law in Portugal

By using our website and services, you confirm that you have read, understood and accept the terms of this Privacy Policy.

2. DATA CONTROLLER

Identification:

• Entity: CERÂMIRUPE, CERÂMICAS, S.A.
• Brand Name: TERRAFINA – stoneware by ceramirupe
• Address: Rua Porto de Linhares, No. 12, 2460-397 Castanheira, Cós, Alcobaça, Portugal
• Email: info@ceramirupe.com
• Website: www.terrafinastore.com

Data Protection Officer (DPO): For matters related to personal data protection, you can contact our Data Protection Officer at info@ceramirupe.com with the subject "DPO".

3. DEFINITION OF PERSONAL DATA

According to GDPR, personal data means any information relating to an identified or identifiable natural person. Personal data includes:

• Name, address, email, phone number
• Date of birth
• Tax identification number
• Location data and electronic identifiers (IP addresses)
• Browsing data (cookies)
• Payment information
• Purchase history and preferences

4. WHAT PERSONAL DATA WE COLLECT AND WHY

4.1. ACCOUNT CREATION AND ORDERS

Data collected:

• Full name
• Delivery and billing address
• Email address
• Phone number
• Tax ID (when applicable)
• Payment information

Purpose:

• Process and manage orders
• Communicate order status
• Issue invoices
• Manage returns and complaints
• Comply with legal and tax obligations

Legal basis: Contract performance and legal obligation

Retention period:

• Invoicing data: 10 years (legal accounting and tax obligation)
• Active account data: while account remains active
• Inactive account data: 3 years after last interaction

4.2. CUSTOMER SUPPORT SERVICE

Data collected:

• Contact information (name, email, phone)
• Communication history
• Complaint or inquiry details
• Order number

Purpose:

• Respond to questions and information requests
• Manage complaints
• Improve customer service
• Resolve technical issues

Legal basis: Legitimate interest and contract performance

Retention period:

• Email communications: 100 days
• Case management: 12 months
• Complaints: 2 years

4.3. NEWSLETTER AND MARKETING COMMUNICATIONS

Data collected:

• Email address
• Name (optional)
• Product preferences
• Email interaction history (opens, clicks)

Purpose:

• Send newsletters and information about new products
• Send personalized offers and promotions
• Inform about events and brand news

Legal basis: Consent

Retention period:

• Until consent is withdrawn
• Inactive contacts (no email opens for over 12 months) may be deleted

How to withdraw consent:

• Click "Unsubscribe" link in emails
• Contact: marketing@terrafinastore.com

4.4. WEBSITE ANALYTICS AND STATISTICS

Data collected:

• IP address (anonymized)
• Browsing data (pages visited, time spent)
• Device type and browser
• Referral source

Purpose:

• Analyze website traffic
• Improve user experience
• Optimize website performance
• Understand visitor preferences

Legal basis: Consent (via cookie banner)

Retention period: Aggregated and anonymized data without time limit

4.5. SOCIAL MEDIA

If you interact with us through our social media pages (Facebook, Instagram, LinkedIn), the processing of your personal data on these platforms is governed by the respective social networks' privacy policies.

5. COOKIE POLICY

5.1. WHAT ARE COOKIES?

Cookies are small text files stored on your device (computer, tablet or mobile phone) when you visit a website. They allow the site to recognize your device and store information about your preferences and actions.

5.2. WHAT COOKIES DO WE USE?

Our website uses the following cookie categories:

A) STRICTLY NECESSARY COOKIES

These cookies are essential for website functionality and cannot be disabled.

Legal basis: Legitimate interest (essential website functionality)

B) PERFORMANCE AND STATISTICAL COOKIES

Allow us to analyze how visitors use the website through aggregated and anonymous data.

More information: Google Privacy Policy

Legal basis: User consent

C) FUNCTIONALITY COOKIES

Allow the website to remember your choices to provide enhanced functionality.

Legal basis: User consent

D) THIRD-PARTY COOKIES

Our website may use third-party services that set their own cookies:

• Payment processors (when applicable)
• Shipping carriers (for order tracking)
• Live chat providers (when active)

Terrafina does not control these cookies. Please consult these providers' privacy policies for more information.

5.3. HOW TO MANAGE COOKIES?

You can manage or delete cookies through:

1. Cookie Banner On your first visit, a banner appears where you can:

• Accept all cookies
• Reject optional cookies (essential cookies only)
• Customize your preferences by category

2. Browser Settings You can configure your browser to block or delete cookies:

• Chrome: Settings > Privacy and security > Cookies
• Firefox: Options > Privacy & Security > Cookies
• Safari: Preferences > Privacy > Cookies
• Edge: Settings > Privacy > Cookies

Note: If you disable essential cookies, some website features may not work properly (shopping cart, checkout process).

3. Online Tools

• Your Online Choices – manage advertising cookies
• Network Advertising Initiative – opt-out of behavioral advertising

5.4. COOKIE DURATION

• Session cookies: automatically deleted when you close the browser
• Persistent cookies: remain on the device for the indicated period or until manually deleted

6. SHARING DATA WITH THIRD PARTIES

Terrafina may share your personal data with third parties in the following situations:

6.1. SERVICE PROVIDERS

We work with suppliers who process data on our behalf:

• Web hosting and infrastructure: servers and email
• Payment processors: for secure transactions
• Shipping carriers: for order delivery
• Marketing tools: newsletter sending and analysis
• CRM platforms: customer management

These providers:

• Act as data processors
• Are bound by data protection agreements
• Can only process data according to our instructions
• Are required to implement appropriate security measures

6.2. BUSINESS PARTNERS

In case of specific partnerships, data may be shared with:

• Authorized commercial representatives
• Distribution partners (in B2B context)

In these cases, you will always be informed and have the option to object to sharing.

6.3. LEGAL OBLIGATIONS

We may disclose personal data when legally required to:

• Tax and revenue authorities
• Judicial and regulatory authorities
• Supervisory entities

6.4. COMPANY SALE OR MERGER

In case of sale, merger or restructuring of the company, personal data may be transferred to the acquiring entity, maintaining all data protection obligations.

7. INTERNATIONAL DATA TRANSFERS

7.1. DATA LOCATION

Personal data is primarily stored within the European Economic Area (EEA).

7.2. TRANSFERS OUTSIDE THE EEA

Some service providers (such as Google Analytics) may transfer data outside the EEA. In these situations, we ensure adequate protection through:

• Standard Contractual Clauses approved by the European Commission
• Adequacy certifications recognized by the EU
• Other appropriate safeguards in compliance with GDPR

You can request more information about international transfers at: info@ceramirupe.com

8. DATA SECURITY

Terrafina implements technical and organizational measures to protect your personal data:

8.1. TECHNICAL MEASURES

• SSL/TLS encryption for data transmission
• Firewalls and intrusion detection systems
• Regular and secure backups
• Access control with authentication
• Regular security updates

8.2. ORGANIZATIONAL MEASURES

• Staff training on data protection
• Internal information security policies
• Confidentiality agreements with employees and providers
• Need-based access controls
• Incident response procedures

8.3. PAYMENT SECURITY

Payment data is processed by PCI-DSS certified platforms. Terrafina does not store complete credit card data.

9. YOUR RIGHTS AS DATA SUBJECT

According to GDPR, you have the following rights:

9.1. RIGHT OF ACCESS

You can request confirmation whether we process personal data about you and obtain a copy of that data.

How to exercise: info@ceramirupe.com

9.2. RIGHT TO RECTIFICATION

You can request correction of incorrect or incomplete personal data.

How to exercise: info@ceramirupe.com

9.3. RIGHT TO ERASURE ("RIGHT TO BE FORGOTTEN")

You can request deletion of your personal data, except when:

• There are pending or processing orders
• There are open complaints in after-sales service
• There are outstanding debts
• We must keep data due to legal obligation (e.g., invoicing for 10 years)
• There is suspicion of improper use of services in the last 4 years

How to exercise: info@ceramirupe.com

9.4. RIGHT TO RESTRICTION OF PROCESSING

You can request restriction of processing of your data in the following situations:

• You contest the accuracy of the data (during verification)
• Processing is unlawful but you oppose erasure
• We no longer need the data but you need it for legal claims
• You objected to processing (during verification of legitimate interest)

How to exercise: info@ceramirupe.com

9.5. RIGHT TO DATA PORTABILITY

You can receive personal data you provided in a structured, commonly used and machine-readable format, and transmit it to another controller.

Applies when:

• Processing is based on consent or a contract
• Processing is carried out by automated means

How to exercise: info@ceramirupe.com

9.6. RIGHT TO OBJECT

You can object to processing of your data when:

• Processing is based on Terrafina's legitimate interest
• Data is used for direct marketing (including profiling)

Objection to direct marketing:

• Click "Unsubscribe" in emails
• Contact: marketing@terrafinastore.com

Other objections: info@ceramirupe.com

9.7. RIGHT NOT TO BE SUBJECT TO AUTOMATED DECISION-MAKING

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

Note: Currently, Terrafina does not use fully automated decisions with legal effects.

9.8. RIGHT TO WITHDRAW CONSENT

When processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

How to exercise:

• For marketing: marketing@terrafinastore.com or links in emails
• For cookies: via banner or browser settings
• Others: info@ceramirupe.com

9.9. RIGHT TO LODGE A COMPLAINT

If you believe your rights are not being respected, you can lodge a complaint with:

Portuguese Data Protection Authority (CNPD)

• Address: Av. D. Carlos I, 134 - 1º, 1200-651 Lisbon, Portugal
• Phone: +351 213 928 400
• Email: geral@cnpd.pt
• Website: www.cnpd.pt

9.10. HOW TO EXERCISE YOUR RIGHTS

To exercise any of the above rights:

1. Send a request by email to info@ceramirupe.com
2. Include:
   • Full name
   • Email associated with account
   • Clear description of request
   • Copy of valid ID document (for identity verification)

Response time: 30 days (can be extended by 60 days in complex cases, with justification)

Cost: Free (except in case of manifestly unfounded or excessive requests)

10. CHILDREN'S DATA

Our website and services are intended exclusively for persons aged 18 or over.

We do not intentionally collect personal data from persons under 18. If you become aware that a minor has provided us with personal data, please contact us immediately so we can delete that information.

11. LINKS TO THIRD-PARTY WEBSITES

Our website may contain links to third-party websites. Terrafina is not responsible for the privacy practices of these sites.

We recommend reading the privacy policies of all websites you visit.

12. DATA RETENTION

Personal data is retained only for as long as necessary for the purposes for which it was collected:

After the indicated periods, data is securely deleted or anonymized for statistical purposes.

13. CHANGES TO PRIVACY POLICY

Terrafina reserves the right to update this Privacy Policy periodically to reflect:

• Changes in our data processing practices
• Legislative changes
• New features or services

How you will be informed:

• The latest version is always available at: www.terrafinastore.com/privacy-policy
• Significant changes will be communicated by email to registered customers
• The "Last updated" date at the top of the document will be changed

We recommend reviewing this policy regularly to stay informed.

14. CONTACTS

For any questions about this Privacy Policy or about the processing of your personal data:

General email: info@ceramirupe.com
Marketing queries: marketing@terrafinastore.com
Data Protection Officer: info@ceramirupe.com (subject: "DPO")
Address: Rua Porto de Linhares, No. 12, 2460-397 Castanheira, Cós, Alcobaça, Portugal

15. GLOSSARY

Personal data: Information relating to an identified or identifiable person.

Data subject: Natural person to whom personal data relates.

Data controller: Entity that determines the purposes and means of processing personal data.

Data processor: Entity that processes personal data on behalf of the controller.

Processing: Any operation performed on personal data (collection, recording, organization, storage, consultation, use, communication, deletion, etc.).

Consent: Free, specific, informed and unambiguous indication of wishes by which the data subject accepts processing of their data.

GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

EEA: European Economic Area (EU Member States + Iceland, Liechtenstein and Norway).

DPO: Data Protection Officer.

END OF DOCUMENT

ACCEPTANCE STATEMENT

By using the website www.terrafinastore.com and Terrafina services, you declare that you have read, understood and accepted the terms of this Privacy and Data Protection Policy.

© 2025 CERÂMIRUPE, CERÂMICAS, S.A. | TERRAFINA – stoneware by ceramirupe
All rights reserved.

Last updated: October 24, 2025