Privacy policy
How we handle your data when you visit Wonder Tree and when you buy. In short: we only collect what we need to ship your parcel (and, if you sign up for the newsletter, to send you news), we do no profiling and we never sell data to anyone.
1. Who handles your data
The data controller is Skin Border, Unipessoal Lda, trading under the Wonder Tree brand.
Registered office: Rua Pinheiro Chagas, n.º 69, R/C Direito, 1050-176 Lisboa, Portugal · NIPC 516165232
For any question about your data: orders@skinborder.com.
We are a small craft business and have not appointed a Data Protection Officer (DPO), as this is not required for processing on our scale. The person who runs the shop will answer you directly.
2. What data, why, and on what legal basis
When you buy
First and last name, email address, phone number, shipping address, items purchased, amounts, and the language you placed the order in. You choose the country on our website; you enter the rest on Stripe's payment page, which passes it to us once payment is complete.
Why: to prepare and ship your order, send you the confirmation, give you a private page showing the shipping status, and handle any returns or warranty claims.
Legal basis: performance of the sales contract (Art. 6(1)(b) of Regulation (EU) 2016/679, the "GDPR"). Without this data we cannot fulfil the order.
We never see your card details. Payment takes place entirely on Stripe's page: we only receive the result and the shipping details.
Legal obligations
We keep sales records to meet the tax and accounting obligations of Portuguese law, and the data needed to handle withdrawal and the legal guarantee.
Legal basis: legal obligation (Art. 6(1)(c) GDPR).
When you withdraw from a purchase
Name, email, order number, items you are returning, and the date and time of your statement. We need these to record the withdrawal, send you the acknowledgement and refund you.
Legal basis: legal obligation and performance of the contract (Art. 6(1)(b) and (c) GDPR).
When you write to us
Your email address and what you tell us, so that we can reply.
Legal basis: performance of the contract or, if you write before buying, pre-contractual steps at your request (Art. 6(1)(b) GDPR).
When you visit the site
Like any website, the server records the IP address, date and time and the page requested in its technical logs. These are needed to run the site and protect it from abuse.
Legal basis: our legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR).
Visit statistics
We count visits to know how many people look at the shop, where they come from (for example a search engine or Instagram), whether they use a phone or a computer, and which products they look at and add to the cart. We do this with our own counter, on our own server: no cookies, no external services such as Google Analytics, and your IP address is not stored.
To count a person only once a day, the server computes an anonymous code from the IP address and the browser type, mixed with a random key that changes every day; the next day the key and the codes are deleted, so it is not possible to trace you or recognise you on later days. Only totals remain, such as “40 people from Instagram on Monday”. The people who run the shop are not counted.
Legal basis: our legitimate interest in understanding how the site is used in order to improve it (Art. 6(1)(f) GDPR).
Newsletter
If you sign up with the «From the workshop» form: your email address, the language of the site, the date of your request and of your confirmation, and the wording of the consent you accepted. We only write to tell you about new pieces and upcoming batches.
How: after signing up you receive an email with a confirmation button; until you press it you are not subscribed and we do not write to you. At the bottom of every email from us there is a link to unsubscribe: one click and your address is removed from the list.
Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time without consequences.
We do not use your data for profiling, advertising or automated decision-making, and we never sell it to anyone.
3. Who we share it with
| Who | Why |
|---|---|
| Aruba S.p.A. (Italy) | Hosts the website, the database and the shop's mailbox. Processes data on our behalf as a processor. |
| Stripe Payments Europe, Ltd. (Ireland) | Handles payment. For payment processing and fraud prevention it acts as an independent controller under its own privacy policy. |
| The courier delivering your parcel | Receives your name, address and phone number, for delivery only. |
| Google (Google Fonts) | The site's typefaces are loaded from Google's servers; to do so, your browser sends your IP address to Google. No cookies are set. |
| Advisers and authorities | Our accountant for tax obligations, and public authorities where the law requires it. |
Stripe and Google may transfer data to the United States. These transfers rely on the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the European Commission.
4. How long we keep it
- Orders and withdrawals: for the period required by Portuguese tax law for accounting records (normally 10 years), after which we delete them.
- Newsletter subscription: for as long as you stay subscribed. If you unsubscribe, your address is removed from the list straight away; requests that are never confirmed are deleted automatically after 30 days.
- Emails you send us: as long as needed to reply and to handle any warranty claim, at most 3 years from delivery.
- Server logs: for the period set by our hosting provider, normally a few months.
- Visit statistics: the daily anonymous code is deleted the next day; anonymous totals are kept for no more than 25 months.
- Language preference and cart: stored in your browser; see the cookies section.
5. Your rights
At any time you can ask us to access, correct or erase your data, restrict its processing, receive it in a machine-readable format (portability), and object to processing based on our legitimate interest. Write to orders@skinborder.com: we will reply within one month.
Some data cannot be erased early because the law requires us to keep it (for example, invoice data): in that case we will tell you, and keep it locked without using it for anything else.
If you believe we are handling your data unlawfully, you can lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or with the authority of the country where you live.
6. Cookies and browser storage
The site uses no profiling, advertising or analytics cookies, and contains no third-party tracking tools. Our visit statistics also work without cookies. That is why we do not ask for consent with a banner: we only use technical tools that are necessary for services you request.
| Name | Purpose | Duration |
|---|---|---|
wt_lingua (cookie) | Remembers the language you chose, so you don't have to change it on every page. Only created if you pick a language from the selector. | 1 year |
wondertree_carrello (browser storage) | Remembers what you put in your cart. It stays in your browser and is not sent to us until you go to checkout. | 14 days |
PHPSESSID (cookie) | Only in the shop's private management area. Customers never receive it. | Until the browser is closed |
When you go to the payment page you are on Stripe's website, which uses its own cookies to run the payment and prevent fraud, as described in its cookie policy.
You can delete the site's cookies and storage at any time from your browser settings: you will only lose your chosen language and the contents of your cart.
Last updated: 08/11/2026