Legal

Privacy Policy

Last updated: 20 May 2026

Boha Sugera ("we", "us", "our") runs this website (bohasugera.com) as a brand showcase. We sell our products through our Etsy shop, not directly on this site. This policy explains the little data we handle when you visit here, and points you to the right place for anything that happens during a purchase.

The short version: This website does not run analytics, does not set its own cookies, and has no shopping cart or login. We can't see who you are. The only personal data we ever receive is what you choose to email us. Purchases happen on Etsy, governed by Etsy's own privacy policy.

1. Who we are

Boha Sugera is a small fashion studio. For privacy questions, email [email protected].

[⚠ LEGAL REVIEW REQUIRED] Insert your registered legal entity name, registered business address, and (if appointed) Data Protection Officer contact. EU/Portuguese registration means GDPR applies and a registered address is expected on this page.

2. What we collect

When you browse

Nothing that identifies you. This is a static website with no analytics, no tracking pixels, and no first-party cookies. We do not build a profile of you.

When you email us

Our contact form and newsletter field open your own email app with a message addressed to us — they do not submit data to a server on this website. If you send that email, we receive whatever you include: your name, your email address, and your message. We use it only to reply to you or, for the newsletter, to send you occasional updates you asked for.

When you buy

All purchases happen on Etsy. Any data you provide at checkout (name, shipping address, payment details) is collected and processed by Etsy under Etsy's Privacy Policy, not by us. We only see the order information Etsy shares with sellers so we can make and ship your order.

3. Third parties

Google Fonts. This site loads two typefaces from Google's font servers. To deliver them, your browser shares your IP address with Google. See Google's Privacy Policy.
Etsy. Our shop and all transactions live on Etsy. Etsy's Privacy Policy governs your data there.
Netlify. Our website is hosted by Netlify, which may log standard server request data (such as IP address) for security and delivery. See Netlify's Privacy Policy.
Social links. We link to Instagram, Pinterest, and YouTube. Visiting those sites is governed by their own policies.

[⚠ LEGAL REVIEW REQUIRED] If you later add analytics (e.g. Plausible), a newsletter provider (e.g. Beehiiv, Mailchimp), or self-host the fonts, update this section. Under GDPR, loading Google Fonts from Google's CDN has drawn legal challenges in the EU; self-hosting the fonts avoids sharing visitor IPs with Google. Consider self-hosting before launch.

4. Legal basis for processing (GDPR)

When you email us, we process your message on the basis of our legitimate interest in answering you, or to take steps at your request before a possible purchase. Newsletter emails are sent only with your consent, which you can withdraw at any time.

[⚠ LEGAL REVIEW REQUIRED] Confirm the legal bases with your attorney once you finalise how email/newsletter sign-ups actually work in production.

5. How long we keep data

We keep emails you send us only as long as needed to handle your enquiry or order, and to meet any record-keeping the law requires (for example, tax records on completed orders). Newsletter subscribers are kept until you unsubscribe.

6. Your rights

If you are in the EU/EEA, the UK, or California, you have rights over your personal data, which may include the right to:

access a copy of the data we hold about you;
correct inaccurate data;
ask us to delete your data ("right to be forgotten");
object to or restrict our use of your data;
withdraw consent for marketing at any time;
lodge a complaint with your data protection authority.

To exercise any of these, email [email protected]. We aim to respond within 30 days. For data tied to an Etsy order, please also use Etsy's own privacy tools, since Etsy is the controller for that data.

[⚠ LEGAL REVIEW REQUIRED] EU users have the right to complain to a supervisory authority. In Portugal this is the CNPD (Comissão Nacional de Proteção de Dados). California (CCPA/CPRA) users have specific opt-out and non-discrimination rights. Confirm the exact wording with counsel.

7. Cookies

This website sets no cookies of its own and runs no analytics or advertising trackers. Because of that, we do not show a cookie banner. If we add analytics or other tools later, we will update this policy and, where required, ask for your consent first.

8. Security

The site is served over HTTPS. Because we don't collect or store personal data on this website, there is no customer database here to breach. Emails you send us are protected by the security of our email provider.

9. Children

This site and our products are intended for adults. We do not knowingly collect data from children under 16.

10. Changes to this policy

If we change how we handle data, we will update this page and change the "last updated" date above. Material changes that affect newsletter subscribers will be communicated by email.

11. Contact

Questions about this policy or your data: [email protected].

This page is provided for transparency and is not legal advice. Have a qualified data-privacy attorney review it before launch.

← Back to Home