Effective date: 23 May 2026
Version: 1.0
This Privacy Policy explains how Tâmara (“we”, “us”, “our”) collects, uses, shares and protects information about you when you visit tokobr.com or place an order with us.
We are the data controller for the personal information described below. If you have questions about this policy or your rights, contact us at hello@tokobr.com.
1. Information we collect
We collect the following categories of personal information:
- Order information — name, billing and shipping address, email, phone number, items purchased, order total.
- Payment information — handled directly by our payment processor (Stripe). We receive only a confirmation token and the last four digits of your card; we do not store full card numbers on our servers.
- Account information — if you create an account: email, hashed password, order history, saved addresses.
- Marketing information — email address if you subscribe to our newsletter, your opt-in status.
- Contact information — anything you send through our contact form or by email.
- Technical information — IP address, browser type, device identifiers, pages viewed, referring URL, timestamps. Collected automatically through cookies and similar technologies.
- Cookies — see Section 8 below.
We do not knowingly collect sensitive categories (health, religion, biometric data, political opinions) and do not require them to use our service.
2. How we use your information
- Fulfil and ship your orders, handle returns, and provide customer support.
- Process payments securely through Stripe.
- Send transactional emails (order confirmation, shipping updates, account notices).
- Send marketing emails if you opted in (you can unsubscribe in one click from any email).
- Detect and prevent fraud, abuse, and security incidents.
- Comply with legal obligations (tax records, consumer protection law, food safety reporting).
- Improve the website and our products through aggregated analytics.
3. Legal bases (GDPR / LGPD)
Where the EU GDPR or Brazilian LGPD applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Order fulfilment, payment, shipping | Performance of a contract |
| Transactional emails | Performance of a contract |
| Marketing emails | Your consent (revocable at any time) |
| Fraud prevention, site security | Our legitimate interest in protecting our business |
| Tax records, accounting | Legal obligation |
| Analytics / personalisation cookies | Your consent |
4. How we share your information
We share personal information only with the following categories of recipients, and only as needed:
- Payment processor — Stripe Payments Europe Ltd. (processes card details directly; we do not see them).
- Shipping carriers — the carrier handling your specific region (name, address, phone for delivery).
- Email service provider — for transactional and marketing emails.
- Hosting and infrastructure — our web host and CDN.
- Professional advisors — accountants, auditors, lawyers when legally required.
- Authorities — when compelled by valid legal process (subpoena, court order).
We do not sell your personal information. We do not share it with advertising networks.
5. International transfers
Tâmara is based in the United Arab Emirates. When you order from outside the UAE, your information is transferred to the UAE for processing. When we use service providers based elsewhere (e.g. Stripe in Ireland, our hosting in the EU), your information may be transferred to those countries.
For transfers out of the EU/UK, we rely on Standard Contractual Clauses or equivalent safeguards. For transfers out of Brazil, we comply with LGPD Article 33.
6. How long we keep your information
- Order records — 10 years (UAE commercial law and EU tax obligations).
- Account information — until you ask us to delete the account.
- Newsletter subscription — until you unsubscribe.
- Contact form messages — 2 years.
- Server logs — 90 days.
We anonymise or delete data once the retention period ends.
7. Your rights
Depending on where you live, you may have the right to:
- Access — request a copy of the personal information we hold about you.
- Rectification — correct inaccurate or incomplete information.
- Erasure — ask us to delete your information (“right to be forgotten”).
- Restriction — limit how we process your information.
- Portability — receive your information in a machine-readable format.
- Objection — object to processing based on legitimate interest or direct marketing.
- Withdraw consent — at any time, for any processing based on consent.
- Complaint — lodge a complaint with your local data protection authority.
To exercise any of these rights, email hello@tokobr.com. We will respond within 30 days.
8. Cookies
- Strictly necessary — cart, session, security, language preference. These cannot be disabled.
- Functional — remember your region/currency preference.
- Analytics — measure how visitors use the site (anonymised). Set only with your consent.
We do not currently use advertising or cross-site tracking cookies.
You can manage cookie preferences through your browser settings or through our cookie banner (when present).
9. Children
Tâmara is intended for adults. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with information, contact us and we will delete it.
10. Security
We use HTTPS site-wide, encrypted databases, restricted staff access, and regular security review. No system is perfectly secure; if a breach affects your data we will notify you and the relevant authority within 72 hours of becoming aware.
11. Changes to this policy
We may update this policy from time to time. Material changes will be announced by email (if you have an account or subscription) and by a notice on the site for at least 30 days. The “Effective date” at the top reflects the latest version.
12. Contact
- Email: hello@tokobr.com
- Postal: Tâmara, Dubai, United Arab Emirates (full studio address to be added)
This policy was last reviewed on 23 May 2026.