Privacy Policy
Last updated: 16 July 2026
Thank you for visiting YAMESSI. We are a small, independent fan/tribute clothing micro-brand based in Portugal, making print-on-demand t-shirts. We know that trusting a small shop with your personal details is a big deal, so we have written this policy in plain, honest language — while still being complete and legally solid. If anything here is unclear, just email us at [email protected] and a real person will reply.
This policy explains what personal data we collect when you visit yamessi.com or place an order, why we collect it, who we share it with, and the rights you have under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Portuguese data-protection law.
We never sell your personal data. YAMESSI does not, and will not, sell, rent or trade your personal information to third parties for money or for their own marketing. We only share data with the trusted service providers we need to run the shop, print your shirt and deliver it to you — nothing more.
1. Who we are & who is responsible for your data
The data controller — the person legally responsible for deciding how and why your personal data is processed — is the operator of the YAMESSI store:
- Legal name: Ladislau Paulo Andrade
- Legal form: Sole trader (Empresário em Nome Individual)
- Established in: Portugal (European Union)
- Website: yamessi.com
- Contact email (all privacy matters): [email protected]
- Phone / WhatsApp: +351 939 681 489
We are established in Portugal (European Union). Because we are a small operation, we are not required to appoint a formal Data Protection Officer, but the email above reaches the person who handles all data-protection questions and requests.
2. Scope of this policy
This policy applies to personal data we process when you:
- browse or interact with the yamessi.com website;
- place, pay for or receive an order;
- contact us for support or ask a question;
- subscribe to our newsletter or marketing.
It does not cover third-party websites we may link to (for example a social-media page), which have their own privacy policies. This policy should be read together with our Cookie Policy and our Terms & Conditions.
3. What personal data we collect
We try to collect as little as possible — only what we genuinely need to serve you. Depending on how you use the shop, this may include:
- Order & shipping details: your first and last name, delivery address, city, postal code, country, and phone number (when the carrier requires it), along with the items you ordered. This is needed to make and deliver your shirt.
- Contact & account details: your email address and any name or details you give us.
- Payment data: you pay by MB WAY or SEPA bank transfer, directly from your own banking app to our account. We never see or store card numbers, banking credentials or logins — no card details are ever entered on this website. What reaches us is what your bank shows on the incoming payment: the payer's name, the amount, the date and the order reference you wrote. If you give us a tax number for the invoice, we process that too.
- Communications & support: the content of emails or messages you send us, so we can help and keep a record of the conversation.
- Newsletter data: if you subscribe, your email address and subscription status.
- Technical & usage data: your IP address, browser and device type, approximate location, and how you use the site. Some of this is collected automatically by our hosting/security provider to keep the site running and safe. Optional analytics/advertising data is collected only if you consent — see section 9 and our Cookie Policy.
We do not intentionally collect special-category data (such as health, religion or political views). Please don't send us sensitive information you don't need to.
4. Why we use your data & our legal bases
Under the GDPR we must have a valid legal basis for each use of your data. Here is what we do and why:
| What we do | Legal basis |
|---|---|
| Process and deliver your order, take payment, provide customer support, handle returns. | Performance of a contract (Art. 6(1)(b)) — the sales contract with you. |
| Issue invoices and keep tax, accounting and transaction records. | Legal obligation (Art. 6(1)(c)) — Portuguese and EU tax/commercial law. |
| Keep the website secure, prevent fraud, fix problems and improve our shop. | Legitimate interests (Art. 6(1)(f)) — running a safe, functional business, balanced against your rights. |
| Send our newsletter, run optional analytics and advertising (Google), and set non-essential cookies. | Consent (Art. 6(1)(a)) — which you can withdraw at any time. |
| Respond to legal requests or defend legal claims. | Legal obligation / legitimate interests. |
5. Who we share your data with
To run the shop we rely on a small number of trusted service providers ("processors") who handle data only on our instructions and under contract. We share the minimum needed for each to do its job:
- Print & shipping partner — Printful: receives your name and delivery address to print your made-to-order shirt and ship it to you. Printful operates fulfilment facilities in the EU, USA and other regions and ships worldwide.
- Payments — our bank and the MB WAY / SEPA systems: your payment travels from your bank to ours. We receive only the payment information described above; your bank, not us, holds your account and card data.
- Order confirmation — WhatsApp / email: if you choose to confirm your order through WhatsApp (Meta Platforms Ireland) or by email, the message you send us is processed by that provider under its own terms. Using WhatsApp is optional — email works just as well.
- Hosting, CDN & security — Cloudflare: serves and protects the website and processes technical data such as IP addresses to keep the site fast and safe.
- Analytics & advertising — Google (Analytics / Ads): loaded only if you give consent via Google Consent Mode v2. Helps us understand site usage and, where enabled, measure ads.
- Newsletter / email provider: if you subscribe, our email provider stores your address and sends the messages you asked for.
- Shipping carriers & postal services: receive delivery details to get your parcel to you.
- Advisors & authorities: we may share data with our accountant, or with public authorities and courts, where the law requires it.
Where a partner acts as our processor, we have (or are putting in place) a data-processing agreement requiring them to protect your data and use it only for the agreed purpose.
6. International data transfers
Because we use global providers, some of your data may be processed outside the European Economic Area (EEA) — for example in the United States (Printful operations, Cloudflare's network, Google, WhatsApp/Meta). Whenever data leaves the EEA, we rely on appropriate safeguards recognised by the GDPR, such as:
- EU Standard Contractual Clauses (SCCs) approved by the European Commission; and/or
- adequacy decisions (including certification under the EU–US Data Privacy Framework where applicable);
- together with additional technical measures such as encryption in transit.
You can ask us for more detail about the safeguards for a specific transfer by emailing [email protected].
7. How long we keep your data
We keep personal data only as long as we need it, then delete or anonymise it:
- Order, invoice & tax records: retained for the periods required by Portuguese tax and accounting law (generally up to 10 years for accounting/fiscal records).
- Customer-support messages: kept as long as needed to resolve your query and for a reasonable period afterwards.
- Newsletter / marketing data: kept until you unsubscribe or withdraw consent, after which we stop using it and remove it in due course.
- Technical / analytics data: kept for limited periods as set by the relevant provider and our settings — see the Cookie Policy.
8. Your rights under the GDPR
You have strong rights over your personal data. Subject to legal conditions, you may:
- Access — get a copy of the data we hold about you;
- Rectification — correct data that is wrong or incomplete;
- Erasure — ask us to delete your data ("right to be forgotten");
- Restriction — ask us to pause certain processing;
- Portability — receive certain data in a portable format, or have it sent to another provider;
- Object — object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent — at any time, where we rely on consent (this does not affect processing already carried out).
To exercise any right, just email [email protected]. We will respond within one month (as required by the GDPR) and won't charge you unless a request is clearly unfounded or excessive. We may need to verify your identity first, to protect your account.
If you believe we have mishandled your data, you have the right to lodge a complaint with the Portuguese supervisory authority, the CNPD — Comissão Nacional de Proteção de Dados (www.cnpd.pt). We'd appreciate the chance to put things right first, so please do reach out to us too.
9. Cookies & tracking
We use a few essential cookies to make the site work (for example to keep your basket and remember your consent choices). We only load optional analytics and advertising cookies (Google) if you agree, using a consent banner powered by Google Consent Mode v2. You can accept, reject or change your choices at any time. For the full list and details, please see our Cookie Policy.
10. How we keep your data secure
We take reasonable and appropriate measures to protect your data, including:
- Encryption in transit — the whole site runs over HTTPS;
- No card data on this site — payments happen inside your own banking app (MB WAY / SEPA), so there is no card or credential for us to store or leak;
- Data minimisation — we collect and keep only what we need;
- Reputable providers with their own strong security (Cloudflare, Printful, Google).
No system can be guaranteed 100% secure, but if a data breach ever affects your rights, we will act quickly and notify you and the CNPD where the law requires.
11. Children's privacy
Our shop is intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 16 (the age of digital consent in Portugal). Purchases should be made by an adult (18+) or with parental supervision. If you believe a child has given us their data, please email [email protected] and we will delete it.
12. Marketing & newsletter
We only send marketing emails and our newsletter to people who have opted in. Every marketing email includes a one-click unsubscribe link, and you can also unsubscribe any time by emailing [email protected]. Withdrawing consent is easy and free, and won't affect any orders you've already placed. We may still send you essential service messages about an order you made (like a shipping confirmation), as these are part of fulfilling your purchase, not marketing.
13. Changes to this policy
As YAMESSI grows and its services change, we may update this policy. When we do, we'll change the "Last updated" date at the top, and for significant changes we'll give a clearer notice (for example a note on the site or an email if appropriate). Please check back from time to time.
14. How to contact us
For any question, request or concern about your privacy — or to exercise your rights — please contact us:
- Email: [email protected] · Phone / WhatsApp: +351 939 681 489
- Data controller: Ladislau Paulo Andrade · Sole trader (Empresário em Nome Individual) · Portugal (EU). Full legal and tax identification (registered address and tax number) is provided with every order confirmation and invoice, and to anyone who asks for it by email at [email protected].
- Supervisory authority: CNPD — Comissão Nacional de Proteção de Dados, Portugal (www.cnpd.pt)
You may also want to read our Terms & Conditions, Shipping information and Cookie Policy, or head back to the shop. Thanks for supporting a small, independent brand — we take your trust seriously.