Last updated: October 15, 2026

Padaria Ribeiro (SOCOPÃO - Padaria e Confeitaria, Lda.), as the data controller, is committed to guaranteeing the privacy and protection of the personal data of users of the website padariaribeiro.com, in accordance with the General Data Protection Regulation (GDPR) and other applicable legislation.

1. Data Controller

  • Company Name: SOCOPÃO - Padaria e Confeitaria, Lda.
  • Tax ID (NIF): 501889663
  • Address: Praça Guilherme Gomes Fernandes 21, 4050-526 Porto, Portugal
  • Privacy Contact E-mail: [email protected]

2. Personal Data Collected and Purposes

We collect and process your personal data for the following purposes:

  • Contact, Order and Catering Forms: We collect your name, e-mail, phone number and message and, for order or catering requests, the requested date (and, for orders, also the time and the shop), in order to respond to your request, prepare catering proposals or process order requests.
  • Job Applications: We collect name, e-mail, phone contact, CV and message submitted through the Opportunities page (including open applications), for the exclusive purpose of evaluating and managing recruitment processes.
  • Whistleblowing Channel: We collect the category of the infringement and the description of the facts and, only if you provide them, the date or period of the facts and any attachments; your name and contact details are only collected if you choose not to remain anonymous. This data is processed exclusively by the persons designated to comply with Law no. 93/2021.
  • Newsletter: If you subscribe to our newsletter, we collect your e-mail address and the language in which you subscribed, in order to send you news, seasonal products and offers from our shops. Your subscription only becomes active once you confirm it through the link we send you by e-mail (double opt-in). To understand which communications are useful, we record whether you open our newsletters and which links you click.
  • Browsing and Cookies: We collect browsing data (IP address, browser type) to ensure the website works correctly and for statistical purposes (if you accept the corresponding cookies). See our Cookie Policy for more details.
  • Anti-Spam Verification (Cloudflare Turnstile): Our forms use the Cloudflare Turnstile service to distinguish real users from automated access, which may involve Cloudflare processing technical data from your device/browser. See the Cloudflare Turnstile Privacy Policy.
  • Map (Google Maps): The Contact page shows a Google Maps map; loading it sends Google technical data from your device/browser, such as your IP address. See Google's Privacy Policy.

3. Legal Basis for Processing

The processing of your personal data has the following legal bases, depending on the purpose:

  • Contact, order, catering and job application requests: steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to the requests we receive (Article 6(1)(f) GDPR);
  • Whistleblowing Channel: compliance with a legal obligation (Article 6(1)(c) GDPR and Law no. 93/2021);
  • Anti-spam protection (Cloudflare Turnstile) and the technical operation of the site: our legitimate interest in the security of the site (Article 6(1)(f) GDPR);
  • Newsletter and analytics or advertising cookies: solely your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

4. Data Retention

Data submitted through the contact, order and catering forms is kept for the period necessary to respond to your request and is deleted from the site after 12 months.

Personal data and CVs submitted for job applications (including open applications) will be kept for 12 months, the period necessary to evaluate the recruitment process and any compatible opportunities that may arise during that time, after which they will be deleted, unless the data subject requests their deletion earlier.

Newsletter subscribers' e-mail addresses are kept for as long as the subscription is active. Once you unsubscribe, you will no longer receive any communications. Subscription requests not confirmed within 30 days are not added to the newsletter list.

The report, its attachments and any personal data it contains are kept for 5 years from receipt and, regardless of that period, for as long as any related judicial or administrative proceedings are pending (Law no. 93/2021, article 20). They are then deleted.

5. Sharing Data with Third Parties

Your personal data will not be sold, rented or shared with third parties for commercial purposes. It may only be transmitted to technical service providers (e.g. web hosting providers, IT support, or the Cloudflare Turnstile anti-spam protection service) acting on our behalf under strict confidentiality agreements and GDPR compliance.

The newsletter is managed and sent through the Brevo platform (Sendinblue SAS, France), which acts as our data processor and stores the data within the European Union.

Data submitted in job applications is processed internally by our team, solely for the purpose of evaluating the application.

6. Your Rights

Under the GDPR, as the data subject, you have the right to:

  • Request access to your personal data;
  • Request the rectification of inaccurate or incomplete data;
  • Request the erasure of your data ("right to be forgotten");
  • Request the restriction of processing or object to it;
  • Withdraw your consent at any time.

To exercise any of these rights, simply send a request by e-mail to: [email protected].

You can unsubscribe from the newsletter at any time using the "unsubscribe" link included in every e-mail, or by writing to [email protected].

7. Right to Lodge a Complaint

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority in Portugal:

Comissão Nacional de Proteção de Dados (CNPD)
Website: www.cnpd.pt