Montarion Universe
Privacy and cookies
2026-10-06
Data controller and contact details
The data controller is José Luís Santos Monteiro, owner of Montarion Universe, NIF 271034378. Address: Rua Sousa Pinto 199, 1.º E, 4250-481 Porto, Portugal. Contact for privacy and exercise of rights: montarionuniverse@gmail.com. WhatsApp: +351 969 091 148 (messages only).
Data and purposes
The infrastructure processes technical data, such as IP address and HTTP requests, to provide and protect the website. Our legitimate interest is to maintain a functional and secure service. We use the requested language or browser preferences and the approximate country provided by the infrastructure to suggest languages; It is not necessary to provide precise location.
Participation and contact
When you publish a comment or evaluation, the name you chose, text, rating and date are made public, through your voluntary publication action. The basis for this disclosure is consent, which you can withdraw by contacting us. Polls associate a browser identifier with the vote to avoid repetitions; they don't verify your identity. Requests for new editions record book, language, format, request identifier and date and display public counts. These functions correspond to our legitimate interest in providing the participation you request and preserving its integrity. When you contact us, we process the data you send to respond, based on the legitimate interest in providing support or the pre-contractual measures you request.
Optional statistics
Only with consent do we collect pages visited, interactions, reading depth, duration, language, approximate country, device category, operating system and domain of origin. Visitor and session identifiers are transformed into codes before being stored in the database; continue to be pseudonymized data, not necessarily anonymous. The statistics application does not store the IP. The infrastructure can handle it for function and security. Declining does not prevent navigation.
Voting and statistics identifiers
When you ask to vote, the necessary cookie __Host-montarion-poll is set for up to one year to limit one vote per browser. With consent for statistics, montarion-visitor stays at localStorage during the period of this choice and montarion-session at sessionStorage during the session. They are deleted when you refuse or withdraw consent, or when the site detects that the choice has expired. The infrastructure may also use strictly necessary security or administrator authentication mechanisms.
Choices and retention
You can accept or reject statistics in the notice and return to Cookie Preferences in the footer to change your choice. Withdrawing consent does not affect the lawfulness of previous processing or automatically delete records already received: you can request their deletion. You can also delete storage in your browser settings; this can restore the language or the possibility of voting. Comments remain as long as they are published or necessary to resolve a dispute; votes and edition requests as necessary for polling or planning; contacts as necessary for the response and possible defense of rights. Technical and statistical records are kept for the period necessary for security and analysis, subject to review of the need and legal obligations. We do not promise a single deadline for providers’ operational logs.
International providers and transfers
The site uses Sites/OpenAI and Cloudflare infrastructure for hosting, content delivery and storage. Contact via Gmail or WhatsApp also involves Google or Meta and their respective policies. Access to data is limited to the person responsible and the providers necessary to provide the service, without prejudice to legal obligations. Some services may process data outside the European Economic Area; transfers subject to the GDPR must be supported by an adequacy decision or other applicable guarantees, such as standard contractual clauses. You can contact us to obtain information about the guarantees regarding your data.
Your rights
Under the applicable terms, you can request access, rectification, erasure, restriction, portability or objection to processing and withdraw consent. Write to montarionuniverse@gmail.com, indicating the request and the minimum information that allows you to locate the data. We may ask for proportionate information to confirm identity. We respond to rights requests within the legal deadlines, usually one month. You can complain to the National Data Protection Commission (www.cnpd.pt) or the competent supervisory authority, without having to contact us first. We do not use this data for exclusively automated decisions with legal or similar effects or to sell advertising profiles.
External stores and changes
Links to external shops lead to sellers with their own policies. A simple link does not give us card, payment or delivery information for purchases made with those sellers. For direct purchases where we are the seller, the specific information below on orders, payments, invoicing and delivery applies. We will update this policy when processing or providers change and obtain consent where legally required. Translations do not reduce visitors’ legal rights.
Contact form data
José Luís Santos Monteiro, at the address and contact details on this site, is the data controller. The form collects your name, email, subject and message; phone number, order details, book, delivery date and requested remedy are optional and used when applicable. Up to three PDF, JPG or PNG attachments may also document the request; they are held in private storage and sent to the controller’s email to handle the request. Data is used solely to respond and handle enquiries, orders, returns and complaints. Legal bases are pre-contractual steps or contract performance where applicable, legal obligations, and legitimate interests in answering other correspondence and protecting the service against abuse. Message access is restricted to the controller and authorised persons. The site hosting infrastructure is used alongside Resend, which processes data in the United States to send the message and attachments to the controller and a receipt to the sender, and Google/Gmail for the controller’s mailbox, subject to applicable contractual arrangements and safeguards for international transfers. Requests are retained while being handled and for up to 12 months after closure, unless legal duties or disputes require further retention. Abuse prevention uses a technical identifier derived from the IP address and hour, cleared from records after 24 hours upon the next submission; the message record does not store the IP address. Payment details and identity documents are not requested. You may request access, rectification, erasure, restriction or objection where applicable by contacting montarionuniverse@gmail.com, and complain to CNPD. Contacting us does not subscribe you to marketing.
Direct purchase privacy
Information prepared for the launch of direct purchases. It applies when José Luís Santos Monteiro, owner of Montarion Universe, is identified as the seller. Publishing this policy does not mean sales are already open. Purchases made with external retailers follow those retailers’ policies.
Controller and required information
The data controller is José Luís Santos Monteiro, tax number 271034378, Rua Sousa Pinto, 199, 1.º E, 4250-481 Porto, Portugal; montarionuniverse@gmail.com; WhatsApp +351 969 091 148 (messages only). Direct purchases involve your name, email, billing and delivery addresses, country, tax details when supplied or legally required, phone number when needed for delivery, selected books and editions, quantities, prices, taxes, shipping charges, order reference and status, payment, delivery and support correspondence. Required fields are identified during checkout. Without essential information we cannot complete or deliver the order; other information is optional.
Purposes and legal bases
Information needed to process the purchase, collect payment, produce and deliver books, send confirmations and provide support is processed for pre-contractual steps at your request and performance of the contract (GDPR Article 6(1)(b)). Invoicing, tax reporting, statutory retention and compliance with consumer rights are based on legal obligations (point (c)). Fraud and abuse prevention and defence of rights rely on legitimate interests in protecting the business and transactions, balanced against your rights (point (f)). Consent is not requested for processing essential to the contract or required by law.
Payments and service providers
The store uses Shopify to manage checkout and orders and Moloni to issue invoices. Payments are processed by the provider identified at checkout; do not send card numbers or security codes through the contact form. The seller receives transaction details needed to confirm payments, reconcile amounts and issue refunds; full card details are processed by the payment provider. To produce and deliver books, strictly necessary order and recipient information is shared with Lulu Direct or Cloudprinter, depending on the service actually used, and the production partners and carriers involved. They receive information necessary for their task, rather than general access to the customer’s history. In the standard Lulu Direct integration, the seller is controller of its order data and Lulu processes it on the seller’s behalf; using a printer does not transfer all seller obligations to Lulu.
Other recipients and communications
Necessary information may also be received by hosting providers Sites/OpenAI and Cloudflare, email services used (Google/Gmail and Resend; the latter processes email delivery data in the United States), authorised support staff and accountants or advisers subject to applicable duties. Tax authorities, courts or other public bodies receive information where there is a legal basis. Providers may act on our behalf or, for operations determined by law or their own services, as independent controllers. Payment, invoicing, delivery, return and complaint messages are service communications. A purchase does not subscribe you to advertising or newsletters; marketing based on consent requires a separate choice and can be refused or cancelled.
Retention
Invoices and necessary supporting tax records are retained for the Portuguese statutory period, generally 10 years, unless another legally applicable period applies. Operational order information is kept while fulfilling the contract and, after delivery, only as long as necessary for returns, guarantees, legal duties and possible claims or disputes, taking applicable statutory periods into account. Information no longer needed is deleted or anonymised. Support messages follow the contact form retention period: up to 12 months after closure, unless a documented legal duty or dispute requires longer retention. An erasure request does not remove records that must legally be retained.
International transfers and protection
Shopify and payment, production, delivery, hosting and communication providers may process information outside the European Economic Area, including when delivery takes place in another country. Transfers subject to the GDPR may only take place under an applicable basis: an adequacy decision, appropriate safeguards such as standard contractual clauses and supplementary measures where needed, or a strictly applicable statutory derogation, including necessity to perform an international delivery requested by the customer. You can ask the controller’s email for information about destinations and a copy or description of applicable safeguards, with protection of third-party data and confidential information. Access is restricted to those who need information for their task and subject to appropriate security and confidentiality measures.
Your rights
You can request access, rectification, erasure, restriction and, where applicable, portability or objection by emailing montarionuniverse@gmail.com. Where processing is based on consent you may withdraw it without affecting earlier processing. You may object to processing based on legitimate interests on grounds relating to your situation and to direct marketing at any time. Where applicable local law requires a faster response, we meet that deadline. We respond within GDPR deadlines, normally one month; any lawful extension is communicated with its reasons. You can complain to CNPD (www.cnpd.pt) or the competent data protection authority in your country without contacting us first. We do not make solely automated decisions with legal or similarly significant effects on customers; this does not describe independent providers’ own decisions, which they must explain in their notices.
Checkout cookies
Once checkout is available, cookies or equivalent mechanisms strictly necessary for the cart, session, security and payment may be used. Statistics or advertising requiring consent depend on the visitor’s prior choice. Site preferences do not automatically consent to optional tools in an external checkout; relevant information and choices must be available within checkout itself.