Privacy & Cookies Policy
Last updated: 1 September 2026
Your privacy matters to Mrs H. This Privacy & Cookies Policy explains what personal data we collect through this website (the "Site"), why, and how we handle it, in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Portuguese data protection law.
1. Who we are (data controller)
The data controller is Sandra Heaton, trading as Mrs H, a sole trader (trabalhador independente) registered for tax purposes in Portugal under the simplified regime (recibos verdes), with business address in Cascais, Portugal, NIF 241900565. Contact for privacy matters: hello@theworldofmrsh.com.
2. What we collect
● Newsletter sign-up: your email address, and first name if you provide it.
● Contact form: your name, email address, and the content of your message.
● Automatically, via cookies and analytics: IP address, browser and device type, pages visited, and approximate location, via Squarespace's built-in analytics. We are not currently using any other analytics, advertising or tracking tool (such as Google Analytics or Meta Pixel); if that changes, this section will be updated before the new tool goes live.
We only describe tools that are actually in use on the live Site; this section is updated whenever that changes.
3. Why we collect it (legal basis)
● Newsletter: to send the newsletter you asked to receive — legal basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.
● Contact form: to respond to your enquiry — legal basis: our legitimate interest in dealing with correspondence sent to us (Article 6(1)(f) GDPR) or, where your message concerns steps you have asked us to take before entering into a contract, Article 6(1)(b) GDPR.
● Essential cookies/analytics needed to operate the Site: our legitimate interest in the Site functioning correctly (Article 6(1)(f) GDPR).
● Non-essential analytics, advertising or tracking cookies: your consent, given through our cookie-consent tool (Article 6(1)(a) GDPR); these are not activated unless and until you consent.
4. Cookies
Essential cookies, which are necessary for the Site to function, are used without requiring your consent. Non-essential cookies — for example, analytics or advertising cookies — are only placed once you have given your consent through the cookie banner that appears on your first visit (Squarespace's built-in cookie banner, with “Accept all” and “Decline all” buttons shown together, plus a “Manage cookies” option for more detailed choices). You can change your cookie preferences at any time via the “Cookie Preferences” button. A list of the specific cookies used on the Site, their purpose and duration, is available on request at hello@theworldofmrsh.com.
5. Who we share data with
We do not sell your personal data. We share it only with service providers who help us run the Site, currently: Squarespace (hosting, built-in analytics and cookie banner), Squarespace Email Campaigns (newsletter). We are not currently using any affiliate or tracking platform; if that changes, this section will be updated before the new platform goes live. Where any of these providers is located outside the European Economic Area, we only transfer data to them where an appropriate safeguard applies, such as an EU adequacy decision or Standard Contractual Clauses.
6. How long we keep data
● Newsletter data: for as long as you remain subscribed, plus 30 days afterwards to record your unsubscribe request and prevent re-contacting you.
● Contact form data: for 12 months after your enquiry is resolved, unless a longer period is needed to deal with a related legal claim.
7. Your rights
Depending on the legal basis that applies, you may have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data deleted; restrict or object to our processing of it; receive certain data in a portable format; and withdraw your consent at any time (which does not affect processing carried out before withdrawal). To exercise any of these rights, contact hello@theworldofmrsh.com. You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
8. Children
This Site is not directed at children, and we do not knowingly collect personal data from children.
9. Changes to this policy
We may update this Privacy & Cookies Policy from time to time; the "last updated" date above will reflect the most recent revision.