Last updated: 21 July 2026

This Privacy Policy explains how the “Help Marco” fundraising campaign (“we”, “us”) collects, uses, shares and protects your personal data when you visit this website, make a donation, place an order in the shop, or contact us. We are committed to handling your data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and the Brazilian General Data Protection Law (LGPD).

1. Who is responsible for your data

The data controller for this site is the operator of the Help Marco campaign. For any privacy request or question you can reach us at help-marco@vivid-pixel.com.br.

2. What data we collect

• Order data (shop): your email address, and — collected by our payment provider during checkout — your name, shipping address, and phone number.
• Donation data: your email address and any name you choose to display as a supporter.
• Contact data: the name, email address and message you submit through the contact form.
• Payment data: card and payment details are entered directly with our payment providers. We never receive or store your full card number.
• Technical data: limited server logs (such as a request identifier and timestamps) used for security and to operate the service.

3. How we use your data and our legal basis

• To process and fulfil your order or donation — legal basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7, V).
• To send you transactional emails (order confirmation, payment status, shipping, cancellation, donation receipt) — performance of a contract / legitimate interests (GDPR Art. 6(1)(b) and (f); LGPD Art. 7, V and IX).
• To answer your messages — legitimate interests in responding to you (GDPR Art. 6(1)(f); LGPD Art. 7, IX).
• To prevent fraud and keep the service secure — legitimate interests (GDPR Art. 6(1)(f); LGPD Art. 7, IX).
• To meet accounting and tax obligations — legal obligation (GDPR Art. 6(1)(c); LGPD Art. 7, II).

We do not use your data for automated decision-making that produces legal effects, and we do not sell your personal data.

4. Who we share your data with

We share the minimum data necessary with the service providers (processors) that operate this campaign:

• Stripe — payment processing.
• Ko-fi — donation processing (where offered).
• Printful — production and shipping of shop orders (receives your name, shipping address, email and phone so your order can be delivered).
• Amazon Web Services — hosting and database infrastructure (Amazon ECS, Amazon RDS) and transactional email (Amazon SES).

Each provider processes your data only to provide their service to us, under their own privacy terms.

5. International data transfers

Some of our providers are located outside the European Economic Area, the UK and Brazil (for example, in the United States). Where your data is transferred internationally, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms recognised under the LGPD.

6. Cookies and local storage

This site keeps cookie use to a minimum. We currently use only strictly necessary and functional storage — we do not use advertising or third-party analytics cookies.

• Shopping cart (local storage): we store your cart in your browser so it persists between pages. It stays on your device and is not sent to us for tracking.
• Consent choice (local storage): we remember your cookie choice so we don’t ask again on every visit.
• Payment provider cookies: when you go to checkout, Stripe may set its own cookies on its domains to process the payment and prevent fraud. These are set by Stripe and governed by its privacy policy.

You can clear this storage at any time from your browser settings. If we ever introduce analytics or marketing cookies, we will ask for your consent first through the cookie banner.

7. How long we keep your data

We keep order, donation and transaction records for as long as necessary to run the campaign and to comply with our legal, accounting and tax obligations. After that, we delete or anonymise the data. Contact messages are kept only as long as needed to handle your request.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive a copy of your data in a portable format, and to withdraw consent at any time where processing is based on consent (GDPR Arts. 15–22; LGPD Art. 18). To exercise any of these rights, email us at help-marco@vivid-pixel.com.br.

You also have the right to lodge a complaint with your local data protection authority — in the EU, your national supervisory authority; in the UK, the ICO; and in Brazil, the ANPD.

9. Children’s privacy

This site is not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. How we protect your data

We use encryption in transit (HTTPS), verify payment webhook signatures, and restrict access to order details using a private access token. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date above and, for significant changes, provide a more prominent notice.