Privacy policy

Last updated: 2026-06-16

This Privacy Policy describes how Richard & Guerra, LDA (“LeLigne”, “we”, “us” or “our”) collects, uses, and discloses personal data when you visit, use, or make a purchase or other transaction on the website leligne.com (the “Site”), or otherwise communicate with us.

Please read this Privacy Policy carefully. By using the Site, you acknowledge that you have read this Privacy Policy and understand how your personal data is processed.

This Privacy Policy applies to all visitors of the Site, whether you are a consumer (B2C), a business customer (B2B), a newsletter subscriber, a media or press contact, or simply browsing.

This Privacy Policy is available in English and French.

1. Data controller

The data controller responsible for the processing of your personal data is:

Richard & Guerra, LDA (trading as “LeLigne”)

  • Registered office: Rua Santos Pousada, 441 RC, 4000-486 Porto, Portugal
  • Legal form: Sociedade por Quotas
  • Share capital: EUR 10,000
  • Portuguese tax number (NIPC) and intra-EU VAT number: PT 518420388
  • Registered with the Conservatória do Registo Comercial of Porto

For any question relating to this Privacy Policy or the processing of your personal data, please contact us at:

  • Email: contact@leligne.com
  • Postal address: Richard & Guerra, LDA — Rua Santos Pousada, 441 RC, 4000-486 Porto, Portugal

2. Scope and definitions

In this Privacy Policy:

  • “Personal data” means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”).
  • “Processing” means any operation performed on personal data, as defined in Article 4(2) GDPR.
  • “Data controller” means the entity that determines the purposes and means of the processing, as defined in Article 4(7) GDPR. For the purposes of this Privacy Policy, the data controller is LeLigne.
  • “Processor” means any entity that processes personal data on behalf of the data controller, as defined in Article 4(8) GDPR.
  • “Cookie” means any tracker, identifier, or similar technology placed on or read from your device when visiting the Site.

3. Personal data we collect

We collect personal data directly from you when you interact with us, automatically when you use the Site, and from third parties such as our service providers.

Category Examples of data
Identity and contact details Name, billing address, shipping address, email address, phone number
Account information (if you create an account) Username, password (hashed), preferences, order history
Order and transaction details Items ordered, prices, dates, payment status, delivery information, returns
Payment information Payment method, last four digits of payment card, transaction reference (we do not store full payment card numbers)
Communications with us Content of emails or messages exchanged for customer support, claims, or commercial enquiries
B2B-specific data Company name, professional contact details, position, VAT number, professional purchasing history
Newsletter data Email address, subscription preferences, interaction with our emails (open / click)
Technical data IP address, browser type, device identifiers, pages viewed, time spent, referring URL
Cookie data Cookie identifiers, consent choices (see Section 9)

We do not knowingly collect personal data from children under 16. The Site is not directed at children. If you believe a child has provided us with personal data, please contact us so we can delete it.

4. Purposes of processing, legal bases, and retention periods

We process your personal data for the purposes set out below. Each purpose is associated with a legal basis under Article 6 GDPR and a retention period.

4.1 B2C order management

  • Purpose: process your order, manage payment, organise delivery, handle returns and the right of withdrawal, send transactional emails (order confirmation, dispatch, delivery).
  • Legal basis: performance of the contract you have entered into with us (GDPR Article 6(1)(b)).
  • Data: identity, contact details, billing and shipping addresses, order details, payment information.
  • Retention: for the duration of the order processing, then archived to comply with our legal accounting and tax obligations (see Section 4.3).

4.2 B2B order management

  • Purpose: process your purchase order, issue invoices (including deposit invoices), manage payment, organise delivery, handle B2B claims under our B2B General Terms and Conditions.
  • Legal basis: performance of the contract (GDPR Article 6(1)(b)) and our legitimate interest in managing the business relationship (GDPR Article 6(1)(f)).
  • Data: company name, professional contact details, position, VAT number, order details, payment status.
  • Retention: for the duration of the business relationship, then archived to comply with our legal accounting and tax obligations (see Section 4.3).

4.3 Accounting and tax compliance

  • Purpose: comply with Portuguese accounting and tax obligations applicable to us as a Portuguese company.
  • Legal basis: compliance with a legal obligation to which we are subject (GDPR Article 6(1)(c)).
  • Data: invoicing data (identity, billing address, VAT number where applicable, order and amount details), bookkeeping records.
  • Retention: 10 years from the end of the calendar year to which the document relates, in accordance with Article 19 of Decree-Law no. 28/2019 of 15 February, Article 123 of the Portuguese Corporate Income Tax Code (CIRC), Article 52 of the Portuguese VAT Code (CIVA), and Article 40 of the Portuguese Commercial Code.

4.4 Customer account management

  • Purpose: allow you to create and manage a customer account on the Site, save your preferences, view your order history, and accelerate future orders. For business (B2B) customers, the account also provides access to our B2B catalogue, applicable pricing conditions, and to the management of Existing Customer status under our B2B General Terms and Conditions.
  • Legal basis:
    • Consumers (B2C): your consent (GDPR Article 6(1)(a)). Account creation is always optional; a guest checkout is available for every order.
    • Business customers (B2B): performance of the contract or of pre-contractual steps taken at your request (GDPR Article 6(1)(b)). A B2B account is required to access the B2B catalogue, applicable pricing, and to manage the commercial relationship.
  • Data: account credentials, contact details, preferences, order history.
  • Retention: for the duration of the account, then 3 years after the last log-in, after which the account is deleted or anonymised. You may delete your account at any time by contacting us.

4.5 Newsletter and commercial communications

  • Purpose: send our newsletter, news about new collections, exclusive offers, and other commercial communications.
  • Legal basis: your consent (GDPR Article 6(1)(a)), freely given when you subscribe.
  • Data: email address, first name (optional), subscription date, interaction with the emails sent.
  • Retention: until you unsubscribe, plus 3 years after the last interaction, in order to evidence your consent and manage any subsequent claim. You may unsubscribe at any time using the link at the bottom of every email.

4.6 Customer service and after-sales support

  • Purpose: respond to your enquiries, manage claims, returns, withdrawals, warranty cases, and any other support requests.
  • Legal basis: performance of the contract (GDPR Article 6(1)(b)) for order-related enquiries; our legitimate interest in maintaining a quality customer relationship (GDPR Article 6(1)(f)) for general enquiries.
  • Data: identity, contact details, content of communications, order references.
  • Retention: 5 years from the last contact. This duration reflects the 3-year legal guarantee of conformity applicable to consumer sales under Portuguese law (Decreto-Lei no. 84/2021, of 18 October, Article 12) and the 2-year period during which a consumer may bring an action after notifying a non-conformity (Article 18 of the same Decree-Law). After this period, data is deleted or anonymised, in accordance with the principles of data minimisation and storage limitation (GDPR Article 5(1)(c) and (e)).

4.7 B2B prospecting and commercial development

  • Purpose: identify and engage with potential business customers (concept stores, decoration shops, interior architects), manage our commercial CRM, follow up on enquiries, attend trade shows.
  • Legal basis: our legitimate interest in developing our business activity (GDPR Article 6(1)(f)). We balance this interest against your rights and freedoms; you may object at any time (see Section 7).
  • Data: company name, professional contact details, position, business sector, history of significant contacts (calls, meetings, exchanges).
  • Retention: 5 years from the last significant contact (a meaningful exchange such as a reply to an email, a phone call, a meeting, a trade show contact, or a catalogue request — but not a mere mailing list inclusion or an automated email click).

4.8 Site security and fraud prevention

  • Purpose: ensure the security of the Site, prevent and detect fraud, abuse, and unlawful activity.
  • Legal basis: our legitimate interest in protecting the Site, our customers, and our business (GDPR Article 6(1)(f)).
  • Data: technical data (IP address, browser, device), order patterns, security logs.
  • Retention: technical security and fraud-prevention logs are managed by Shopify in accordance with the Shopify Data Processing Addendum and Shopify’s own retention policy. For details, see https://www.shopify.com/legal/privacy.

4.9 Audience measurement and statistics

  • Purpose: measure audience, understand how visitors use the Site, and improve the Site experience.
  • Legal basis: your consent (GDPR Article 6(1)(a)), expressed via the cookie consent banner (see Section 9).
  • Data: technical data, navigation data, anonymised or pseudonymised statistics.
  • Retention: see cookie-specific durations in Section 9.

4.10 Compliance with legal obligations and management of legal claims

  • Purpose: respond to lawful requests from public authorities, comply with court orders, exercise or defend legal claims.
  • Legal basis: compliance with a legal obligation (GDPR Article 6(1)(c)) and our legitimate interest in defending our rights (GDPR Article 6(1)(f)).
  • Retention: for the duration necessary to respond to the request or to manage the claim, then archived in accordance with applicable limitation periods.

5. Recipients and processors

We share your personal data only with the following categories of recipients, and only to the extent necessary for the purposes set out in Section 4:

Recipient Role Country
Shopify Inc. Hosting of the Site, e-commerce platform, transactional emails, customer accounts Canada, with infrastructure in the United States
Shopify Payments Processing of online payments Canada / United States, depending on the payment method
Infomaniak Network SA Hosting of our professional email mailboxes (contact@, support@, pro@leligne.com) — including the content of incoming and outgoing communications; cloud storage of business documents and any customer-related data we store outside the Shopify platform; domain name registration and DNS for leligne.com Switzerland
Order fulfilment and operational support providers (e.g., carrier for delivery, accounting service provider for invoicing and tax compliance) Order fulfilment, delivery, accounting and tax compliances Portugal, France, Belgium
Public authorities Response to lawful requests (tax, customs, judicial) Portugal and EU

Each of our processors acts on the basis of a written agreement (Article 28 GDPR), under our instructions, with appropriate technical and organisational security measures, and only for the purposes set out above.

6. International transfers outside the EU/EEA

Some of our processors are established outside the European Union (EU) or the European Economic Area (EEA). When we transfer your personal data outside the EU/EEA, we ensure that an appropriate level of protection is in place, in accordance with Chapter V of the GDPR.

Processor Country Transfer mechanism
Shopify Inc. Canada (commercial sector) European Commission adequacy decision 2002/2/EC, confirmed by the Commission report of 15 January 2024
Shopify (US infrastructure) United States EU-U.S. Data Privacy Framework (where applicable to Shopify) and/or Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914)
Infomaniak Network SA Switzerland European Commission adequacy decision 2000/518/EC of 26 July 2000, confirmed by the Commission report of 15 January 2024 (COM(2024) 7 final)

For transfers to Shopify, the Standard Contractual Clauses are incorporated in the Shopify Data Processing Addendum, publicly available at https://www.shopify.com/legal/dpa. The full text of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 is also publicly available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.

For transfers to Infomaniak Network SA in Switzerland, no additional safeguards beyond the adequacy decision are required under Article 45 GDPR. The processing of personal data by Infomaniak is governed by a data processing agreement compliant with Article 28 GDPR and Article 9 of the Swiss Federal Act on Data Protection (nFADP). Infomaniak’s standard Data Processing Agreement is publicly available at: https://www.infomaniak.com/

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Article 15): obtain confirmation that we process your personal data, a copy of that data, and information on how we process it.
  • Right to rectification (Article 16): obtain the correction of inaccurate or incomplete personal data.
  • Right to erasure (Article 17): obtain the deletion of your personal data, in the cases provided for by the GDPR.
  • Right to restriction of processing (Article 18): obtain the restriction of processing in the cases provided for by the GDPR.
  • Right to data portability (Article 20): receive a copy of your personal data in a structured, commonly used, machine-readable format, and have it transmitted to another data controller, where the processing is based on your consent or on a contract.
  • Right to object (Article 21): object to the processing of your personal data based on our legitimate interest, including for B2B prospecting purposes.
  • Rights relating to automated decision-making (Article 22): not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. LeLigne does not carry out solely automated decision-making of this kind.
  • Right to withdraw your consent (Article 7(3)): withdraw your consent at any time, where processing is based on your consent. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at contact@leligne.com, or by post at the address provided in Section 1. We may need to verify your identity before processing your request. We will respond within one month of receipt of your request, in accordance with Article 12(3) GDPR. This period may be extended by two further months where necessary, taking into account the complexity and number of requests.

You also have the right to lodge a complaint with a supervisory authority. As Richard & Guerra, LDA is established in Portugal, the lead supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD):

You may also lodge a complaint with the supervisory authority of your country of habitual residence, your place of work, or the place of the alleged infringement (Article 77 GDPR). The list of EU/EEA supervisory authorities is available on the European Data Protection Board’s website: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, disclosure, or destruction. These measures include, in particular:

  • Use of recognised, secure platforms — Shopify for the Site, e-commerce, online payments and customer accounts ; Infomaniak for our professional email mailboxes and cloud storage of business documents;
  • Encryption of communications between your browser and the Site (HTTPS / TLS);
  • Restricted access to personal data on a need-to-know basis;
  • Written processing agreements with each of our processors (Article 28 GDPR);
  • Regular review of our security practices.

No security measure is impenetrable, and we cannot guarantee absolute security. We recommend that you use a strong, unique password for your customer account, and that you do not share your account credentials.

9. Cookies and tracking technologies

This section provides detailed information about the cookies and similar tracking technologies used on the Site, in accordance with Article 5(3) of Directive 2002/58/EC (“ePrivacy Directive”), Article 5 of Portuguese Law no. 41/2004 of 18 August (as amended), and the GDPR.

9.1 What is a cookie?

A cookie is a small text file placed on your device (computer, smartphone, tablet) by a website you visit. Cookies allow the website to remember information about your visit (preferences, login status, items in your cart) and to collect information about how you use the website.

We also use similar tracking technologies (local storage, pixels) — referred to collectively as “cookies” in this section.

9.2 Consent management

We use Shopify’s native cookie consent banner (Customer Privacy) to obtain your consent to the use of non-essential cookies. The banner is displayed when you first visit the Site and offers four cookie categories:

  • Required — pre-selected and not subject to consent (strictly necessary cookies, see Section 9.3);
  • Personalization — not pre-selected, requires your consent;
  • Marketing — not pre-selected, requires your consent;
  • Analytics — not pre-selected, requires your consent.

You can:

  • Accept all the cookie categories by clicking “Accept all”;
  • Reject all non-essential cookies by clicking “Decline all”;
  • Choose specifically which categories you accept and click “Save my choices”.

Refusing non-essential cookies is as easy as accepting them. Your choice is recorded and applies to subsequent visits.

You can change your cookie preferences at any time by clicking the “Terms and Policies” button displayed on the Site, or by deleting the cookies stored on your device through your browser settings.

9.3 Categories of cookies used on the Site

9.3.1 Required cookies (strictly necessary)

These cookies are necessary for the Site to function properly and to deliver the services you have requested. They include cookies for visitor and session identification, cart contents, secure session and customer authentication, selected currency, country and language preference, and customer login state. Without them, basic features such as logging in, adding items to your cart, or completing a purchase would not work.

  • Legal basis: not subject to consent under Article 5(3) of Directive 2002/58/EC and the corresponding exception in national law (cookies “strictly necessary for the provision of an information society service explicitly requested by the user”).
  • Typical duration: from session length (a few minutes) to 1 year, depending on the cookie.

9.3.2 Personalization cookies

These cookies allow the Site to remember choices you have made (such as the country you visit from, your language preference, or content you have already viewed) in order to provide a more personalised experience. They include, for example, cookies tracking your original referrer or the landing page through which you arrived on the Site.

  • Legal basis: your consent (GDPR Article 6(1)(a) and ePrivacy Directive Article 5(3)).
  • Typical duration: up to 2 weeks.

9.3.3 Marketing cookies

These cookies are used to track visitors across websites and to display advertisements that are relevant to the visitor.

  • Legal basis: your consent (GDPR Article 6(1)(a) and ePrivacy Directive Article 5(3)).
  • Status on leligne.com at the date of this Privacy Policy: LeLigne does not currently deploy marketing cookies beyond those Shopify may set as part of its native cookie management for unselected categories. If we add marketing partners (such as Meta Pixel, Google Ads, TikTok Pixel, or similar) in the future, we will update this Privacy Policy and the cookie banner accordingly, and your prior consent will be required.

9.3.4 Analytics cookies

These cookies allow us to count visits, identify the most popular pages, and understand how visitors use the Site, in order to improve it. They include, for example, cookies that record visit identifiers and unique visitor identifiers used to compile aggregated audience statistics.

  • Legal basis: your consent (GDPR Article 6(1)(a) and ePrivacy Directive Article 5(3)).
  • Typical duration: from 30 minutes to 1 year, depending on the cookie.

9.4 Full list of Shopify cookies

The cookies listed in Section 9.3 are illustrative. Shopify maintains a comprehensive list of all cookies that may be deposited by the Shopify platform, depending on the features used. This list is updated by Shopify as the platform evolves.

You can consult the full list at: https://www.shopify.com/legal/cookies.

Not all the cookies listed by Shopify are deposited on leligne.com — only those corresponding to the features actually used on the Site (e-commerce, customer accounts, cart, checkout, etc.).

9.5 Third-party cookies added by LeLigne

In addition to the cookies deposited by the Shopify platform, LeLigne may use selected third-party services (advertising, analytics, embedded content) that deposit their own cookies on your device.

At the date of this Privacy Policy: LeLigne does not deploy any third-party cookie beyond those of the Shopify platform described in Section 9.3 and listed by Shopify at the link in Section 9.4.

If we add third-party services in the future, we will list them here, with the identity of the publisher, the purpose, the typical duration, and a link to the publisher’s privacy policy.

9.6 Managing your cookie preferences

You may manage your cookie preferences in two ways:

  • Via the floating “Terms and Policies” button on the Site, which reopens the consent banner and allows you to change your choices at any time;
  • Via your browser settings, which allow you to block or delete cookies. Each browser provides instructions for managing cookies in its help section.

9.7 Consequences of refusing cookies

  • Refusing Required cookies is not technically possible, as the Site cannot function without them.
  • Refusing Personalization cookies may result in a less personalised browsing experience (for example, you may have to re-enter your country or language preference each time you visit).
  • Refusing Marketing cookies has no current impact on the Site, as LeLigne does not deploy any marketing cookie at the date of this Privacy Policy (see Section 9.3.3). If we deploy marketing cookies in the future, refusing them will mean that any advertising you may see on third-party websites will be less tailored to your interests, but the volume of advertising will not change.
  • Refusing Analytics cookies has no impact on your experience but means that your visit will not be counted in our audience statistics.

10. Contact

For any question, complaint, or request related to this Privacy Policy or the processing of your personal data, please contact us at:

  • Email: contact@leligne.com
  • Postal address: Richard & Guerra, LDA — Rua Santos Pousada, 441 RC, 4000-486 Porto, Portugal