Privacy and Cookies Policy

1. Scope and legal framework

For the purposes of this Privacy Policy, the terms “we”, “our” or “Bread & Friends” refer to the entity responsible for processing personal data, identified below. The terms “user”, “data subject” or “you” refer to the individual who accesses or uses the website or contacts us through the channels made available on it.

Our interactions with customers, visitors, partners and other stakeholders are based on a relationship of trust. For this reason, we consider the protection and confidentiality of personal data to be an essential responsibility and process personal data only where there is a specified purpose and an appropriate legal basis.

This Policy applies to the Bread & Friends website and explains what personal data may be collected, the purposes for which it is used, how long it may be retained, with whom it may be shared and the rights available to data subjects.

Personal data is processed in accordance with Regulation (EU) 2016/679 — the General Data Protection Regulation (“GDPR”) —, Portuguese Law No. 58/2019 of 8 August, and all other applicable Portuguese and European data protection legislation.

2. Name and address of the data controller

The entity responsible for processing personal data through this website is:

For privacy-related matters or to exercise any of the rights described in this Policy, data subjects may use the general contact details provided on the website.

3. Contact form and contact by email

Description and scope of processing

Where a contact form is made available on the website, users may use it to contact us electronically. The information entered into the form is transmitted to Bread & Friends and processed so that we can manage and respond to the request.

Depending on the fields included in the form, the data processed may include first name, surname, email address, telephone number, selected location or establishment, subject, reason for contacting us and the content of the message.

Users may also contact us through the email addresses provided on the website. In such cases, the personal data supplied by the user as part of that communication will be processed.

Legal basis

Processing required to respond to a contact request may be based on the legitimate interest of Bread & Friends in managing requests and communications addressed to it. Where the contact relates to pre-contractual steps requested by the user or to the performance of a contractual relationship, processing may also be based on those steps or on that relationship.

Purpose

The data is used to review, route and respond to the request, including, where appropriate, forwarding it to the most suitable establishment or team. Technical data associated with the submission may also be used to prevent fraud, spam, misuse of the form and to protect our IT systems.

Retention

Data is retained for as long as necessary to manage and conclude the request and, where there is a contractual relationship, legal obligation or need to establish, exercise or defend legal claims, for the additional applicable period. Once there is no longer a need to retain the data, it will be deleted or anonymised, without prejudice to backup copies maintained during the relevant technical cycles.

4. Collection, processing and use of personal data

We only collect personal data that is adequate, relevant and limited to what is necessary for each purpose. Data may be provided directly by the data subject, arise from communications with Bread & Friends or be generated technically while using the website.

Depending on the interaction, the following categories of personal data may be processed:

• identification data, such as first name and surname;
• contact information, such as email address and telephone number;
• information relating to a request, subject, message or selected establishment;
• professional information, where relevant to press enquiries, partnerships, events or business relationships;
• technical website usage data, such as IP address, browser, device, operating system, and date and time of access;
• consent preferences and information relating to cookies and similar technologies.

We do not use personal data for purposes incompatible with those for which it was originally collected without an appropriate legal basis. Whenever consent is required by law, it will be requested specifically and may be withdrawn as described in this Policy.

5. Purposes and legal bases for processing

Depending on the circumstances, personal data may be processed for the following purposes:

• responding to requests for information, enquiries, feedback, press requests, partnerships, events or other communications;
• forwarding enquiries to a particular establishment or team;
• managing pre-contractual, contractual or commercial relationships requested by the data subject;
• ensuring the operation, stability, prevention of misuse and security of the website;
• complying with legal obligations or responding to requests from competent authorities;
• measuring and improving use of the website where there is an appropriate legal basis and, where required, consent;
• sending marketing communications only where there is a valid legal basis for doing so.

The legal bases relied upon may include performance of a contract or steps taken prior to entering into a contract, compliance with a legal obligation, the legitimate interests of Bread & Friends and the consent of the data subject, depending on the specific purpose.

6. Recipients, service providers and sharing of data

Personal data is only made available to persons and entities that require access to it for the purposes described above. This may include internal teams, Bread & Friends establishments, technology providers and other service providers supporting hosting, maintenance, security, forms, communications, technical analysis or website management.

Where a service provider processes personal data on our behalf, we seek to ensure that it acts as a processor in accordance with Article 28 of the GDPR and is subject to appropriate confidentiality, security and data protection obligations.

Personal data may also be disclosed to public bodies, administrative, judicial or law enforcement authorities where required by law or where necessary for the establishment, exercise or defence of legal claims.

We do not sell personal data to third parties.

7. Provision of the website and creation of log files

Data processed

Whenever the website is accessed, the systems supporting it may automatically record technical information required for the provision, security and diagnosis of the service.

This information may include:

• browser type and version;
• operating system and device type;
• IP address;
• date and time of access;
• the page or source from which the user reached the website;
• pages or resources requested;
• technical information relating to errors, security or performance.

Purpose and legal basis

This data is processed in order to provide the website correctly, ensure its stability and security, detect technical incidents or attempts at misuse and, where necessary, generate aggregated statistical information. As a general rule, this processing is based on the legitimate interest of Bread & Friends in maintaining a secure and functional digital presence.

Retention

Technical logs are retained only for as long as necessary for security, diagnostic and operational purposes, without prejudice to additional retention periods where required by law, in connection with a security incident or for the establishment, exercise or defence of legal claims.

8. Use of cookies

Cookies are small files or identifiers stored on or read from a user's device when visiting a website. They may be required to provide technical functions, remember preferences, measure use of the website or, where authorised, support analytics and marketing functionality.

Some cookies are deleted when the browser session ends. Others remain on the device for a defined period or until they are deleted by the user.

Strictly necessary cookies

These cookies are used for essential website functions, security, session management, technical preferences or storage of consent choices. Because they are necessary to provide the service requested, they may not require prior consent where permitted by applicable law.

Preference cookies

These cookies make it possible to remember certain choices made by the user in order to provide a more consistent experience where this functionality is enabled.

Measurement and analytics cookies

Where used, these cookies allow us to understand in aggregate how the website is used — for example, pages visited, traffic sources, session duration and interactions — in order to improve content, structure, performance and the user experience.

Marketing cookies

Where used and authorised, these cookies may be used to measure campaigns, limit the repetition of advertisements or understand interactions with content and external channels. These cookies should not be activated before consent has been obtained where consent is legally required.

Managing preferences

Users may manage or change their preferences through the cookie consent mechanism made available on the website. Users may also configure their browser to block or delete cookies, although doing so may affect certain functionality.

9. Analytics, maps, social media and other external services

The website may use external services for audience measurement, technical tag management, displaying maps, linking to social media platforms or providing other functionality. Depending on the tool used and the user's consent choices, these services may involve the processing of technical data, online identifiers or the setting of cookies.

Where legally required, services that are not strictly necessary are activated only after consent has been obtained. Users may review their choices through the cookie management mechanism.

Links to external platforms, including social networks and mapping services, may redirect users to services managed by third parties. From that point onwards, data processing is also governed by the policies and terms of those third parties.

10. International data transfers

Some technology providers may process personal data in countries outside the European Economic Area. Where this occurs, we seek to ensure that there is a legally valid transfer mechanism and appropriate safeguards in place, including, where applicable, adequacy decisions, Standard Contractual Clauses approved by the European Commission and additional protective measures.

11. Data retention periods

Personal data is retained for as long as necessary to fulfil the purpose that justified its collection and processing. The specific retention period may vary according to the type of contact, the existence of a contractual relationship, applicable legal obligations and the need to establish, exercise or defend legal claims.

When personal data is no longer required, it will be deleted, anonymised or retained in restricted form for the period strictly necessary to comply with legal or technical obligations.

12. Data subject rights

Under the GDPR and applicable legislation, data subjects may exercise the following rights where the respective legal requirements are met:

• right of access to the personal data being processed and information relating to that processing;
• right to rectification of inaccurate or incomplete data;
• right to erasure of personal data in the circumstances provided for by law;
• right to restriction of processing;
• right to object to processing based on legitimate interests, where legally applicable;
• right to data portability, where applicable;
• right to withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

Where personal data is processed for direct marketing purposes, the data subject may object to such processing at any time. Following an objection, the data will no longer be used for that purpose.

To exercise their rights, data subjects should contact Bread & Friends using the contact details provided on the website. We may request additional information strictly necessary to confirm the identity of the requester and protect their data against unauthorised access.

13. Protection of children

The website is not specifically directed at children and is not intended to intentionally collect personal data from children through its general functionality. If we become aware that personal data relating to a child has been provided without the necessary legal basis, we will take appropriate steps to delete that data to the extent technically and legally possible.

14. Security

Bread & Friends implements technical and organisational measures designed to protect personal data against destruction, loss, alteration, unauthorised disclosure or access. These measures are reviewed taking into account the nature of the data, the context of the processing, technological developments and the associated risks.

Although appropriate measures are implemented, no system connected to the Internet can guarantee absolute security. In the event of a security incident having a relevant impact on personal data, the assessment, containment and notification procedures required by applicable law will be followed.

15. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with a supervisory authority where they consider that the processing of their personal data infringes applicable data protection legislation.

In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese Data Protection Authority.

16. Changes to the Privacy and Cookies Policy

This Policy may be revised whenever there are legal, technical or operational changes, or changes to the personal data processing activities carried out through the website. The current version will be made available on this page.

Last updated: September 2026.