Privacy policy

The controller of your data is Samuel Gonçalves, as a sole trader (“Student Storage”, “we”). For any question about personal data, write to [email protected].

We follow the General Data Protection Regulation (GDPR) and the Portuguese implementing law (Law 58/2019). This policy is for customers, site visitors and people on the waiting list. The service is for people aged 18 or over.

• Account and contact: name, email, phone, preferred language, password (stored only in encrypted form, never as text), and, if you sign in with Google, your Google account identifier.
• Booking: package, dates, the delivery and return address, access notes (floor, lift, notes you write), remarks, and the history of the booking's statuses.
• Payment: amounts, status, date and payment references. We do not see or store your card number: Stripe handles it.
• Your belongings: the number of boxes and suitcases, descriptions, sizes, weight, condition notes, photographs (see section 9) and where they are stored.
• Communications: the emails we send you (type, date and delivery status) and those you write to us.
• Discount codes: the code used on your booking.
• Waiting list: your email and language, and the record of your consent.
• Visit statistics: when you open a public page (home, booking, sign-in, registration, legal pages) we count the visit: the page, where you came from (the site only), your IP address and the approximate location Cloudflare infers from it (country, region and city), device type and browser, and a daily code so a visit is counted once. No cookies. We do not count visitors who have “do not track” (DNT/GPC) switched on.
• Technical and security data: IP address, browser type and access logs, for site security, limiting abuse and investigating problems.

• Providing the service you contracted (creating the account, handling the request, delivering, collecting, storing, returning, charging): performance of the contract, GDPR Article 6(1)(b).
• Meeting legal obligations, such as tax and accounting duties and answering authorities: point (c).
• Understanding how the site is used (aggregate visit statistics): legitimate interest, point (f). We keep the IP address and approximate location only for the period given under retention.
• Security, preventing fraud and abuse, defending rights, and improving the service: legitimate interest, point (f). We always weigh the effect on you.
• Service messages (confirmations, payment reminders, end-of-period reminders, notices about the collection): part of the contract.
• News and offers: only with your consent, given separately and which you can withdraw whenever you like (point (a)). The same applies to the waiting list: we only tell you about the launch.

We do not make automated decisions with legal effects on you, and we do not build profiles for advertising.

We share only what is needed, with providers who handle data on our behalf (processors) and are bound by contract:

• Stripe (card payments).
• Resend (sending the service emails).
• Cloudflare (secure access to the site and server, and DNS).
• Google (only if you choose to sign in with Google).
• Hosting: the server holding the site and database is our own.
• Accounting and invoicing: whoever handles our accounting and invoicing, to meet tax obligations.

Whoever shares a discount code (an influencer) sees only numbers and amounts (how many paid bookings, how much they earned); never your name, email, address or other data.

We may also disclose data to authorities where the law requires. We do not sell personal data.

Some of these providers (Stripe, Resend, Cloudflare, Google) belong to groups headquartered in the United States and may process data outside the European Union. In those cases the transfer relies on mechanisms provided for in the GDPR: an adequacy decision (the EU-US Data Privacy Framework) or standard contractual clauses.

• Account: for as long as you have it. You can ask for it to be closed.
• Bookings, payments and invoices: 10 years, the legal accounting and tax retention period. This is why, on an erasure request, we anonymise your personal data but keep the financial records without identification.
• Photographs of your belongings: 12 months after the booking ends (completed, cancelled or refused), so that we can handle claims; deleted automatically. If a dispute is open, they stay until it is closed. The records of how items moved (without photographs) stay with the booking.
• Records of emails sent: 24 months, then deleted automatically.
• Waiting list: 12 months, or until you withdraw consent, whichever comes first; then deleted automatically.
• Visit statistics: 180 days, then deleted automatically.
• Marketing: until you withdraw consent.
• Technical server logs: kept in rotating files of limited size, so they disappear by themselves after a few weeks.
• Backups: the database has daily copies that we keep for 14 days; an erasure reaches the backups when they expire.

You have the right to: access your data (and receive a copy), have it corrected, ask for its erasure, restrict processing, object to processing based on legitimate interest, receive the data in a structured format (portability), and withdraw consent at any time, without affecting what was done before.

To exercise your rights, write to [email protected]. We may ask you to confirm your identity. We reply within one month. Some data must be kept by law (see section 6); in that case we explain what we keep and why.

If you think we have handled your data wrongly, you can complain to the Portuguese data protection authority (CNPD): www.cnpd.pt. We would appreciate it if you contact us first.

We use encrypted connections (HTTPS), passwords stored only in encrypted form, account lockout after failed attempts, team access limited to what each person needs, a record of important actions, daily backups, and private storage for photographs. The warehouse address is never made public. No system is infallible: if there is a data breach that affects you, we tell you and the CNPD as the law requires.

We photograph the boxes and items at collection, on arrival at the warehouse, before return, and if there is damage, to show the condition they were in. Photographs are kept in private storage, only the team sees them, and we remove location information and other hidden data from the file. We avoid photographing people: if someone appears, we ask them to step aside.

When you use an influencer's code, we record that your booking used it, to apply the discount and work out the commission. The influencer sees only totals. For a “first booking only” code, we check your email against earlier bookings.

We only use cookies the site needs to work. Details in the cookie policy.

If we change something important, we tell you by email or on the site. The date of the last update is at the top of this page.