Privacy Policy
Last updated: 30 July 2026
This Privacy Policy explains how Kstationery, Design e Produção Gráfica, Lda. collects, uses, stores, shares and protects the personal data of users and customers of the online store available at www.maybackpacks.com.
Kstationery is committed to processing personal data lawfully, fairly and transparently, in accordance with Regulation (EU) 2016/679 of 27 April 2016 — the General Data Protection Regulation, hereinafter referred to as the “GDPR” —, Portuguese Law No. 58/2019 of 8 August, and all other applicable legislation.
The publication of this Privacy Policy is for information purposes and does not mean that all personal data processing activities depend on the data subject's consent.
1. Data Controller
The controller responsible for processing personal data is:
Trade name: MAY
Tax Identification Number: 506 821 676
Registered office: Rua de Brito Capelo, 178, 4450-252 Matosinhos, Portugal
Telephone: (+351) 226 101 621
Email: marketing@kstationery.com
For questions relating to personal data protection or to exercise the rights provided for in this Policy, data subjects may contact Kstationery at marketing@kstationery.com.
2. Personal Data Collected
Kstationery may collect and process different categories of personal data, depending on how the user interacts with the website.
2.1. Identification and Contact Data
The following data may be collected:
• name• email address
• telephone number
• billing address
• delivery address
• country
• tax identification number, where required for invoicing
2.2. Order Data
The following data may be collected:
• products purchased• order value and date
• discounts applied
• selected payment method
• payment status
• shipping method
• delivery information
• order history
• returns, complaints and warranty claims
2.3. Payment Data
Payments are processed through payment service providers made available in the online store.
As a rule, Kstationery does not have access to the customer's complete bank card details. However, it may receive limited transaction information, such as payment confirmation, amount, date, payment method and identifiers associated with the transaction.
2.4. Customer Account Data
If the user creates an account in the online store, the following data may be processed:
• email address
• saved addresses
• order history
• account preferences
• authentication information managed by the platform
2.5. Contact and Customer Support Data
When the user contacts Kstationery, the following data may be processed:
• email address
• telephone number
• order number
• message content
• documents, images or other information voluntarily submitted
• communication history
2.6. Technical and Usage Data
When using the website, the following data may be collected automatically:
• device type
• operating system
• browser type and version
• electronic identifiers
• date, time and duration of the visit
• pages visited
• products viewed
• interactions with the website
• source of the visit
• information relating to technical errors and security
This data may be collected through cookies and similar technologies, as described in the section concerning cookies.
2.7. Marketing Data
When the user subscribes to commercial communications, the following data may be processed:
• email address
• date and source of consent
• communication preferences
• information about the delivery, opening and interaction with communications, where applicable
Kstationery does not intend to collect special categories of personal data, such as data relating to health, racial or ethnic origin, religion, political opinions or sexual orientation.
Users should not submit this type of information through forms or contact channels unless it is strictly necessary and expressly requested.
3. How Data Is Collected
Personal data may be collected:
• when creating or using a customer account
• when placing and processing an order
• through communications with Customer Support
• through newsletter subscriptions
• through cookies and similar technologies
• through service providers involved in payment, shipment or delivery of orders
• through the Shopify platform and applications installed in the store
4. Purposes and Legal Bases for Processing
Personal data is processed only for specified, explicit and legitimate purposes.
4.1. Order Processing and Performance
Data is processed to:
• process payment
• prepare and dispatch products
• communicate with the customer regarding the order
• deliver products
• manage cancellations, returns and refunds
Legal basis: performance of a contract or steps taken at the request of the data subject prior to entering into a contract.
Failure to provide mandatory data may prevent the order from being processed and delivered.
4.2. Invoicing and Compliance with Legal Obligations
Data is processed to:
• maintain accounting and tax records
• comply with legal obligations
• respond to legally competent public authorities
Legal basis: compliance with legal obligations applicable to Kstationery.
4.3. Customer Account Management
Data is processed to:
• facilitate future purchases
• allow access to order history
• save addresses and account preferences
Legal basis: performance of the contract and provision of the service requested by the data subject.
4.4. Customer Support
Data is processed to:
• provide assistance
• resolve issues relating to orders
• manage complaints, returns and warranties
• follow up on customer requests
Legal basis: performance of the contract, steps taken prior to entering into a contract, or Kstationery's legitimate interest in providing appropriate support and improving the service.
4.5. Fraud Prevention and Security
Data may be processed to:
• protect accounts and transactions
• detect abusive use of the website
• ensure system security
• investigate security incidents
Legal basis: Kstationery's legitimate interest in protecting its business, systems and customers, and, where applicable, compliance with legal obligations.
4.6. Management and Defence of Legal Rights
Data may be retained and used to:
• respond to complaints
• exercise or defend rights in judicial, administrative or out-of-court proceedings
• demonstrate compliance with contractual and legal obligations
Legal basis: Kstationery's legitimate interest in defending its rights and complying with legal obligations.
4.7. Newsletter and Commercial Communications
When the user subscribes to the newsletter, their data may be processed to send:
• information about products and collections
• promotional campaigns
• discounts
• brand-related content
Legal basis: the data subject's consent.
Consent may be withdrawn at any time through the unsubscribe link included in each communication or by emailing marketing@kstationery.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
4.8. Website Analysis and Improvement
Subject to consent, where legally required, browsing data may be used to:
• understand the use of pages and features
• identify technical issues
• improve the user experience
• analyse campaign effectiveness
Legal basis: the user's consent where cookies or technologies that are not strictly necessary are used.
4.9. Personalised Advertising and Remarketing
Subject to the user's consent, Kstationery may use cookies and similar technologies to:
• measure advertising campaigns
• display advertisements on social media platforms, search engines or other websites
• show advertising again to users who have visited the store
• create advertising audiences, where applicable
Legal basis: the user's consent.
The use of these technologies depends on the choices made through the cookie banner or preference manager.
5. Mandatory Data
Fields marked as mandatory are necessary to:
• complete delivery
• issue the invoice
• respond to the user's request
• comply with legal obligations
If the user does not provide the required data, it may not be possible to complete the purchase, deliver the products or provide the requested service.
Providing data for newsletters, personalised advertising or other marketing purposes is optional and does not affect the ability to make purchases.
6. Recipients of Personal Data
Kstationery may share personal data, to the extent strictly necessary, with entities that provide services connected with the operation of the store.
These entities may include:
• Shopify, as the e-commerce platform• payment service providers
• banking institutions
• carriers and logistics operators
• invoicing and accounting service providers
• hosting, maintenance, security and technology support providers
• email and communication platforms
• website usage analytics providers
• advertising and digital marketing platforms
• legal, tax or accounting advisers
• judicial, tax, police, regulatory or administrative authorities, where required by law
Service providers processing data on behalf of Kstationery are subject to contractual obligations relating to confidentiality, security and processing data only in accordance with the instructions received.
Certain entities, particularly payment providers, advertising platforms or public authorities, may act as independent controllers, in which case their processing activities will be subject to their own privacy policies.
Kstationery does not sell its customers' personal data.
7. Shopify
The online store www.maybackpacks.com uses the Shopify platform.
Shopify processes certain personal data required for the operation, hosting, security and provision of e-commerce services.
Use of the platform may involve the processing of data by entities within the Shopify group and its service providers, in accordance with the terms and privacy policies applicable to the platform.
8. International Data Transfers
Some service providers used by Kstationery may process personal data outside Portugal or the European Economic Area.
Where data is transferred to countries that are not covered by an adequacy decision adopted by the European Commission, legally recognised safeguards will be used, such as:
• standard contractual clauses approved by the European Commission• binding corporate rules applicable to corporate groups
• other safeguards provided for under the GDPR
Data subjects may request additional information about the applicable safeguards by emailing marketing@kstationery.com.
9. Cookies and Similar Technologies
The website uses cookies and similar technologies.
Cookies are small files stored on the user's device and may serve different purposes.
9.1. Strictly Necessary Cookies
These cookies are required for the operation of the website and make it possible to:
• save products in the shopping cart
• process orders
• ensure security
• remember essential choices
• enable the use of requested features
These cookies do not require consent where they are strictly necessary to provide the service requested.
9.2. Preference Cookies
These cookies allow the website to remember user choices, such as language, location or other settings.
9.3. Analytics Cookies
These cookies make it possible to measure website usage, identify the pages visited and improve performance and the browsing experience.
9.4. Advertising Cookies
These cookies make it possible to measure campaigns, personalise advertisements and display potentially relevant advertising on other websites or platforms.
Preference, analytics or advertising cookies that are not strictly necessary will only be used in accordance with the choices made by the user through the cookie banner.
Users may accept, reject or change their preferences through the consent manager available on the website.
Withdrawing consent must be as easy as giving it.
Detailed information about the cookies used, their providers, purposes and duration should be consulted in the Cookie Policy or in the preference manager available on the website.
10. Commercial Communications
Kstationery will only send newsletters and promotional communications electronically where there is an appropriate legal basis.
Where sending such communications depends on consent, consent will be requested freely, specifically, knowingly and unambiguously.
Data subjects may unsubscribe from communications at any time:
• through the unsubscribe link included in each message• by emailing marketing@kstationery.com
Unsubscribing from marketing communications does not affect the sending of messages that are strictly necessary for order fulfilment, account security, invoicing, delivery, returns or Customer Support.
11. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected, without prejudice to retention periods imposed by law.
In particular:
• data relating to orders, payments and invoicing will be retained for the periods required to comply with tax, accounting and legal obligations• customer account data will be retained while the account remains active and for the period necessary to defend legal rights
• data relating to complaints, returns and warranties will be retained for the period required to manage them and for the applicable limitation periods for exercising or defending legal rights
• Customer Support data will be retained for the period necessary to resolve the request and defend legal rights
• data used for newsletters will be retained until consent is withdrawn or until it is no longer necessary
• data collected through cookies will be retained for the periods indicated in the consent manager or Cookie Policy
• data necessary for fraud prevention and security will be retained for a period appropriate to the relevant purpose and identified risk
When data is no longer required, it will be deleted, anonymised or kept blocked where its retention is required by law.
12. Data Subject Rights
Under the applicable legislation, data subjects may exercise the following rights:
• the right to rectify inaccurate or incomplete data
• the right to erasure
• the right to restriction of processing
• the right to data portability
• the right to object to processing
• the right to withdraw consent at any time
• the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects, where applicable
These rights are not absolute and may be subject to the conditions and limitations provided for by law.
To exercise their rights, data subjects should contact: marketing@kstationery.com.
The request should clearly identify the right the data subject wishes to exercise.
Kstationery may request additional information that is strictly necessary to confirm the identity of the applicant and prevent the disclosure of data to unauthorised third parties.
The exercise of rights is generally free of charge. In the case of manifestly unfounded or excessive requests, particularly due to their repetitive nature, the measures provided for by law may apply.
Kstationery will respond to the request within the time limits established by the applicable legislation.
13. Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with the competent supervisory authority.
In Portugal, the supervisory authority is:
Comissão Nacional de Proteção de Dados — CNPD
Avenida D. Carlos I, 134, 1.º
1200-651 Lisbon
Telephone: (+351) 213 928 400
Email: geral@cnpd.pt
Website: www.cnpd.pt<
Data subjects are advised to contact Kstationery first at marketing@kstationery.com so that the matter may be reviewed and resolved.
Prior contact with Kstationery does not limit or affect the right to lodge a complaint with the CNPD.
14. Data Security
Kstationery implements technical and organisational measures appropriate to the level of risk in order to protect personal data against:
• loss
• alteration
• unauthorised disclosure
• unauthorised access
• unlawful or accidental processing
These measures may include access controls, the use of passwords, permission management, backups, system protection, security measures provided by Shopify and contractual obligations imposed on service providers.
Security measures are reviewed and updated whenever necessary.
Although no system can guarantee absolute security, Kstationery seeks to reduce risks in accordance with good practices and applicable legal requirements.
15. Links to Third-Party Websites
The website may contain links to pages or services managed by third parties.
Kstationery does not control the privacy practices of these third parties. Users should review the relevant privacy policies before providing personal data through such websites or services.
16. Children's Data
The online store is not intended to be used directly by minors without the involvement or authorisation of their legal representatives.
Kstationery does not knowingly collect personal data from minors for marketing purposes without the legally required authorisation.
If a legal representative believes that a minor's personal data has been collected improperly, they may contact Kstationery at marketing@kstationery.com.
17. Changes to the Privacy Policy
Kstationery reserves the right to update this Privacy Policy whenever necessary, including due to:
• changes to the services provided
• the implementation of new features
• changes to service providers
• changes to data processing practices
Any changes will be published on this page, together with the date of the latest update.
Where changes are relevant to the rights and interests of data subjects, Kstationery may provide additional information through the website or the available contact details.
18. Contact Details
For questions relating to this Privacy Policy, the processing of personal data or the exercise of data subject rights, please contact:
Rua de Brito Capelo, 178<
4450-252 Matosinhos
Portugal
Telephone: (+351) 226 101 621
Email: marketing@kstationery.com