Effective date: 5 November 2026

This policy explains what personal data is processed when you use exhaustedhumans.com (the "site"), why, on what legal basis, for how long, who receives it, and what rights you have.

1. Who is responsible for your data

The site is run under the name Exhausted Humans from Lisbon, Portugal ("we", "us"). We are the controller of the personal data described in this policy within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR").

For any question about your data or to exercise your rights, write to [email protected].

We have not appointed a data protection officer, as the law does not require one for an operation of this kind.

2. Summary

• We collect only the personal data the site needs to work, to answer you, and to meet our legal obligations.
• We do not sell personal data, and we do not use it for profiling or for decisions made solely by automated means.
• We do not use advertising cookies or cross-site tracking.
• You may ask to see, correct or delete your data at any time.

3. What we process and why

Visiting the site

When you open a page, your browser automatically sends technical data: your IP address, the date and time of the request, the page requested, the page you came from, your browser and operating system, and your device type.

• Purpose: to deliver the site to you, keep it secure, and protect it against attacks, abuse and errors.
• Legal basis: our legitimate interest in operating a secure and working website (Article 6(1)(f) GDPR).
• Retention: we do not keep server logs ourselves. Our hosting and security provider keeps security logs for a limited period, after which they are deleted or anonymised.

Fonts

The site loads its fonts from Google Fonts, a service of Google Ireland Limited. To deliver the font files, Google receives your IP address and basic browser information. Google states that the service does not set cookies and that the data is not used for advertising.

• Purpose: to display the site as designed on every device.
• Legal basis: our legitimate interest in a consistent presentation (Article 6(1)(f) GDPR).

When you contact us

If you write to us, we receive your name, your email address, your message and anything else you choose to include.

• Purpose: to read and answer your message and deal with your request.
• Legal basis: our legitimate interest in answering the people who write to us (Article 6(1)(f) GDPR); where your message concerns a purchase, the performance of a contract (Article 6(1)(b) GDPR).
• Retention: for as long as needed to deal with your request, and then for up to two years in case of follow-up questions or legal claims.

Our email is handled by an email service provider that processes messages on our behalf.

Placing an order

When you order from us, we process your name, shipping and billing address, email address, phone number if you give it, the items ordered, the payment status (not your full card details) and our correspondence about the order.

• Purpose: to take your order, have it delivered, take payment, handle returns and complaints, issue invoices and keep the records the law requires.
• Legal basis: the performance of our contract with you (Article 6(1)(b) GDPR), our legal obligations under tax and accounting law (Article 6(1)(c) GDPR), and our legitimate interest in preventing fraud (Article 6(1)(f) GDPR).
• Who receives it: our e-commerce platform, our payment providers, and our order and delivery partners (which receive your name, shipping address, phone number and the items).
• Retention: order records for the period required by tax and accounting law, currently up to ten years. If you create a customer account, it is kept until you delete it or ask us to.

4. Who receives your data

We share personal data only where needed for the purposes above, and only with:

• our hosting, security and content delivery provider;
• our email service provider;
• our font provider, as described above;
• our e-commerce platform, our payment providers, and our order and delivery partners;
• professional advisers, and public authorities where the law requires it.

Service providers that process data on our behalf do so under a contract that obliges them to follow our instructions and protect the data (Article 28 GDPR). We do not sell or rent personal data. If you ask, we will tell you the names of the specific recipients of your data.

5. Transfers outside the European Economic Area

Some of our providers are based in, or process data in, countries outside the European Economic Area, including the United States. Where the European Commission has not recognised a country as providing adequate protection, the transfer takes place under the EU-US Data Privacy Framework for certified recipients, or under the standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR). You may ask us for more information about these safeguards.

6. Cookies and storage on your device

We do not place cookies on your device, and we do not use cookies for statistics or advertising. For that reason the site shows no cookie banner.

Your cart is kept in your browser's local storage until you go to checkout, so that it is still there on your next visit. It is not sent to us before then, and you can remove it by clearing your browser's site data.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where there is no longer a reason for us to keep it;
• restrict our processing, for example while you contest its accuracy;
• receive data you gave us in a structured, machine-readable format and have it transferred to someone else, where the processing is based on consent or a contract;
• object to processing based on our legitimate interests, on grounds relating to your particular situation, and at any time to processing for direct marketing;
• withdraw your consent at any time, where processing is based on consent. This does not affect the lawfulness of processing before the withdrawal.

To exercise any of these rights, write to [email protected]. We may ask you to confirm your identity. We will reply within one month of receiving your request. Where a request is complex, this period may be extended by two further months, and we will tell you so within the first month. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe the infringement took place. The authority in the country from which we operate is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. We would appreciate the chance to address your concern first.

8. Whether you have to give us your data

The technical data sent by your browser is needed to deliver the site. We need your email address to answer you. The data requested at checkout is needed to conclude and perform the contract; without it we cannot fulfil your order. Everything else you give us is voluntary.

9. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

10. Children

The site is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, write to us and we will delete it.

11. Security

The site is served only over an encrypted connection (HTTPS). Access to personal data is limited to what each purpose requires, and we choose providers that apply appropriate technical and organisational security measures.

12. Visitors from the United States

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act. The site does not track visitors across third-party websites, so it treats every visitor the same whether or not the browser sends a "Do Not Track" signal.

13. Changes to this policy

We may update this policy when our services or the law change. The effective date at the top shows when it was last changed. Where a change is significant, we will say so on the site.

14. Contact

Exhausted Humans, Lisbon, Portugal. Email: [email protected].