Lebbeke — Chocolaterie Artesanal
PTEN
Customer Care

Privacy and Data Protection Policy

LEBBEKE values the privacy and security of the information about its customers, partners and visitors.

This Privacy Policy aims to transparently explain how we collect, use, store and protect the personal data provided through our website, customer service channels and other platforms, in compliance with Brazilian Federal Law No. 13,709/2018 — the Brazilian General Data Protection Law ("LGPD").

1. What data we collect

We may collect the following personal data:

Identification data

  • Full name;
  • CPF (Brazilian taxpayer ID), when needed to issue tax documents;
  • Date of birth, when voluntarily provided.

Contact data

  • Email address;
  • Phone number and WhatsApp;
  • Delivery and billing address.

Purchase-related data

  • Order history;
  • Products purchased;
  • Payment information processed by our payment providers.

It is important to note that LEBBEKE does not store full credit card details or sensitive banking information, as these operations are handled directly by the contracted payment providers.

Browsing data

  • IP address;
  • Device and browser type used;
  • Pages accessed;
  • Cookies and similar technologies used to improve your browsing experience.

LEBBEKE Universe statistics

Current status: LEBBEKE Insights is enabled to record page-view events on the LEBBEKE Universe page (universo.lebbeke.com.br) and clicks on the links presented there, solely to measure the reach of and interaction with that content, in accordance with the scope described in this policy. For each event, we will process: the date and time; the link clicked, if any; the domain of the referring website (never the full address of the originating page); campaign parameters (utm), when present; the device type (mobile, tablet or desktop), estimated from browser information; and the approximate location (country, region and city), provided by our content delivery network (CDN) based on the connection IP address.

The IP address and browser information (User-Agent) are not written directly to the records of these statistics. They are used in memory, at the time of the request, to generate a cryptographic digest (SHA-256 hash); the User-Agent is also used to estimate the device type. From that digest, the recording function derives HMAC codes using a secret that changes daily, which are used to prevent the same visit from being counted twice (deduplication) and to control submission frequency. These verification codes are deleted within 7 days. These mechanisms reduce identifiability but do not, by themselves, amount to absolute anonymization.

Raw events contain temporary identifiers (such as the verification code and a temporary visit identifier) and are therefore treated as pseudonymized data, not anonymous data. The resulting daily aggregated statistics contain no individual identifier.

We do not use cookies, browser local storage or any persistent identifier for these statistics, and we do not cross-reference these events with customer accounts, orders or registrations.

Providers involved: Cloudflare acts as the content delivery network (CDN), intermediating the connection and providing the approximate location; Lovable Cloud receives the recording request and stores the records in a managed database. These providers may keep their own technical infrastructure logs, in accordance with their respective policies.

2. Purposes of data use

The data collected may be used to:

  • Process and deliver orders;
  • Issue invoices;
  • Provide customer service;
  • Communicate about orders, deliveries and support;
  • Send information about products, launches and promotional campaigns, when authorized by the customer;
  • Improve the browsing experience and usability of the site;
  • Comply with legal and regulatory obligations;
  • Prevent fraud and ensure the security of operations;
  • Measure the reach of and interaction with the links on the LEBBEKE Universe page, through aggregated statistics of views and clicks, with no advertising, profiling or data-sale purpose.

3. Data sharing

LEBBEKE may share personal data only when necessary to carry out its activities, including with:

  • Payment providers;
  • Shipping carriers and logistics operators;
  • Hosting and technology platforms;
  • Analytics and digital marketing tools;
  • Public authorities, when required by law or court order.

Under no circumstances do we sell or trade our customers' personal data.

4. Storage and security of information

We adopt appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration or any form of inadequate or unlawful processing.

Although we employ recognized information security practices, no system is completely immune to risk, which is why we work continuously to improve our protection processes.

5. Cookies and similar technologies

Our site may use cookies to:

  • Ensure the platform functions properly;
  • Remember user preferences;
  • Analyze browsing activity for statistical purposes;
  • Personalize content and advertising campaigns.

Users may configure their browser at any time to block or delete cookies, although certain site features may be affected as a result.

LEBBEKE Universe statistics do not use cookies or similar tracking technologies.

6. Data subject rights

Under the LGPD, data subjects may request, at any time:

  • Confirmation that their data is being processed;
  • Access to stored data;
  • Correction of incomplete, inaccurate or outdated information;
  • Anonymization, blocking or deletion of unnecessary data;
  • Data portability, when applicable;
  • Withdrawal of previously granted consent;
  • Deletion of personal data, subject to legal retention obligations.

7. Data retention period

Personal data will be stored only for as long as necessary to fulfil the purposes described in this policy, as well as to meet LEBBEKE's legal, tax, regulatory and rights-defense obligations.

Raw LEBBEKE Universe statistics events are kept for up to 35 days; verification codes, for up to 7 days. After these periods, only daily aggregated statistics (totals by link, source, device, country and city) remain, with no individual identifier, for up to 25 months. Deletion is carried out by an automated maintenance routine that runs periodically; therefore, data is deleted at the first run of the routine after each period expires, and not necessarily at the exact moment of expiry.

8. Exercising your rights and contacting us

Requests related to privacy, data protection or the exercise of rights under the LGPD may be sent to atendimento@lebbeke.com.br. Through the same channel, data subjects may object to the processing of their data, where applicable, including with respect to LEBBEKE Universe statistics. Each request will be assessed in accordance with applicable law, subject to LEBBEKE's legal and regulatory obligations.

LEBBEKE will make the necessary efforts to respond to requests within the timeframes set out by applicable law.

9. Updates to this policy

This Privacy Policy may be updated periodically to reflect legislative, regulatory or operational changes.

We recommend checking this page periodically for any updates.

Last updated: October 2026.