Last updated: 7 August 2026
This policy explains what personal data we collect through pewpew.pt, what we use it for, who we share it with and what you can ask of us. It replaces the policy of the old store at store.pewpew.pt, which ran on WooCommerce and is no longer in service: the current site is a different system, built with different tools, and the previous text described practices that are not ours.
1. Who processes your data
The controller is Sequência Janota, Unipessoal, Lda, trading as PEW PEW.
2. What this policy covers
It covers pewpew.pt in both its Portuguese and English versions, including the merchandise store, the equipment rental catalogue, the customer account area and the contact form. It does not cover contracted production projects, which are governed by the proposal and contract of each job, nor third party platforms where we have a presence, such as social networks or streaming platforms.
3. What we collect, and when
3.1 Contact form
The form on the contacts page runs entirely in your browser. The subject, name, email and message you type are used to compose a message that opens in your own mail program. At that step nothing is sent to our servers and nothing is stored. We only receive your data if you choose to send that email, and what we receive is what you wrote, which then sits in our mailbox.
3.2 Customer account
Creating an account is optional and asks for your name, email address and a password (at least 8 characters). The password is never stored in the clear: we keep only an irreversible cryptographic hash (bcrypt). The session lives in a cookie of ours, described in section 5.
3.3 Store orders and rental bookings
Checkout is closed while we prepare the launch. With that gate in place no orders are created on the site and requests go by email. Once checkout opens, an order collects:
- name and email address;
- phone number, required for MB WAY payments, because that is the number the app sends the approval request to;
- tax number and, when you ask for a company invoice, the company name;
- billing address (street, postal code, town and country), which is also the delivery address if you choose shipping instead of pickup;
- any notes you want to leave about the order;
- the items, sizes and quantities and, for rentals, the pickup and return dates;
- the totals, the rental discount applied, VAT and the shipping cost;
- the payment method chosen and the reference the payment processor returns;
- an order reference and an access code, which let you check the status without creating an account.
Your card details never pass through us: they are entered directly on the payment processor's pages (section 7).
3.4 Technical data
The IP address of each request is used to limit repeated attempts on sensitive routes (sign in, registration, order creation and order lookup by reference). Those counters live in memory, in windows of minutes, and never reach the database. Server logs and the logs of the network that sits in front of the site may contain IP address, date, request and browser identification.
4. What we do not do
- There is no audience measurement or advertising tooling on the site. No Google Analytics, Tag Manager, Meta Pixel, Hotjar, Plausible or equivalent.
- We do not profile visitors, we do not run behavioural advertising and we do not use your data to target ads.
- We do not sell or hand over personal data to third parties for marketing purposes.
- We do not send a newsletter or promotional messages, because that service does not exist on the site today. If it ever does, it will be with prior consent and with a simple way to withdraw it.
Because we set no measurement or advertising cookies, the site does not need to ask for cookie consent: the ones that exist are strictly necessary for the service you asked for.
5. Cookies and storage on your device
- pp_sess (our cookie): holds the customer account session, as a signed token that contains only the account identifier. It is HttpOnly, so page JavaScript cannot read it, it is SameSite=Lax, in production it only travels over HTTPS, and it expires after 7 days. It only exists once you sign in, and signing out deletes it.
- NEXT_LOCALE (cookie of the site's internationalisation library): remembers the language you picked, so we do not ask again.
- ppCart1 (browser local storage): the contents of your cart, so it survives navigation and closing the tab. It stays on your device.
- ppOrders1 (browser local storage): your most recent order references, up to 20, with their access codes, so you can reopen an order status without an account. It stays on your device.
- ppIntro (browser session storage): marks that the opening animation has been seen, so it is not repeated during the same visit.
You can delete all of this in your browser settings. Deleting pp_sess ends the session. Deleting the others loses your cart and your saved references, with no other consequences.
When you use the PayPal buttons on the payment page, your browser loads PayPal code from www.paypal.com, which may set its own cookies in that context under PayPal's privacy policy. This only happens on that page and only if you choose that payment method.
6. Why we use your data, and on what legal basis
- To handle your order or booking, which includes checking availability, taking payment, preparing pickup or shipping, and talking to you about the order. Basis: performance of the contract (Article 6(1)(b) GDPR).
- To keep the customer account you created and its order history. Basis: performance of the contract.
- To invoice and meet tax and accounting obligations. Basis: legal obligation (Article 6(1)(c)).
- To answer messages and quote requests. Basis: pre-contractual steps and, beyond those, our legitimate interest in replying to people who write to us (Article 6(1)(f)).
- To keep the site secure, blocking password guessing, abuse of the payment routes and fraudulent bookings. Basis: legitimate interest (Article 6(1)(f)).
- To remember your language and your cart on your device, because that is what makes the site work as you expect. Basis: delivering the service you asked for.
7. Who we share it with
We share the minimum needed, and only for the purposes above:
- Stripe, for card payments. Payment happens on Stripe's own pages: the card is entered there and does not pass through us. We send the email address, the order line descriptions, the amount and the reference.
- PayPal, when you choose to pay with PayPal. We send the order reference and the amount, and approval happens in the customer's PayPal account.
- euPago, for MB WAY payments. We send the order reference, the amount and the phone number you gave.
At launch, the only active payment method is card, through Stripe. The PayPal and MB WAY descriptions above apply if and when we turn those methods on: a method that is off does not appear at checkout and receives no data at all.
- PEW PEW connect, our internal back office, where production and logistics handle the order. When an order is paid, the site sends it the reference, name, email, phone, total, payment method, notes, the order lines with rental dates, and also the address, tax number, company and language. It is a PEW PEW system, not a third party service.
- Cloudflare, which serves the site in front of our own server as a delivery and protection network. Traffic, including your IP address, passes through that infrastructure.
- CARTO and OpenStreetMap: the map on the contacts page is built from image tiles your browser requests from basemaps.cartocdn.com, with OpenStreetMap data. That request reveals your IP address and the map area loaded, and only happens if you open the contacts page.
- Invoicing and accounting providers, and the Portuguese tax authority where the law requires it.
- Public authorities or courts, when the law requires it or when it is necessary to defend our rights.
Beyond this list the site calls no third party services: fonts, images and video are served from our own domain.
8. Transfers outside the European Economic Area
The site's server and database are in Portugal. Some of the providers listed above are part of international groups and may process data outside the European Economic Area. When that happens, the transfer must be covered by one of the GDPR mechanisms, such as a European Commission adequacy decision or standard contractual clauses.
9. Where the data lives and how we protect it
- Orders and accounts live in a database on our own server, with access restricted to the people who need it to work.
- Passwords exist only as bcrypt hashes.
- The session is a signed HttpOnly cookie, valid for 7 days.
- The site is served over HTTPS only, with a content security policy and security headers.
- Sign in, registration, order and lookup routes have attempt limits.
- Requests between the site and the back office are signed and rejected outside a window of a few minutes.
- Card data does not pass through our systems.
No system is perfect. If there is a personal data breach that puts your rights at risk, we follow the notification duties set out in the GDPR.
10. How long we keep it
- Customer account: for as long as you keep it. If you ask for deletion, we delete the account data except what the law requires us to retain.
- Orders and invoicing documents: for the period required by Portuguese tax law, currently 10 years.
- Orders created and never paid: kept only while useful for support and for understanding problems in the buying flow. You can ask us to delete them at any time.
- Email messages: kept while needed to reply and to follow up on the request. You can ask us to delete them at any time.
- Rate limiting counters: minutes, in memory only.
11. Your rights
You have the right to ask for access to your data, to correct it, to have it erased, to restrict processing, to object to processing based on legitimate interest, and to receive the data you gave us in a usable format, for yourself or for another controller (portability). Where processing depends on consent, you can withdraw it at any time, without affecting what was done before on that basis.
To exercise any of these rights, write to contact@pewpew.pt. We may need to confirm your identity before answering, so that we do not hand data to someone who is not the data subject. We reply within one month, extendable under the GDPR when the request is complex. Exercising your rights costs you nothing and carries no consequence for you.
If you believe we handle your data improperly, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados: www.cnpd.pt.
12. Children
The site, the store and the rental service are not aimed at children and we do not ask children for data. If you know a minor has left personal data with us, write to contact@pewpew.pt and we will delete it.
13. Changes to this policy
If we change how we handle personal data, we update this text and the last updated date at the top. When a change is significant and we have a way to reach you, we will say so.
14. Contact
PEW PEW (Sequência Janota, Unipessoal, Lda), Rua do Urjal 48, 3830-173 Ílhavo, Portugal. Email contact@pewpew.pt, phone +351 969 784 500.