No products
Product successfully added to your shopping cart
There are 0 items in your cart. There is 1 item in your cart.
Those products may also interest you
-
44,95 € -
11,95 € -
3,95 € -
9,95 € -
23,50 € -
5,50 € -
14,95 €
Privacy Policy
Last updated: 01 January 2026
Mundilar Airguns takes the privacy of those who visit and buy on its website seriously. This Policy explains what personal data we collect, for what purposes, on what legal basis, for how long we keep it, who we share it with, and what rights every individual has.
1. Controller
- Controller: Mundilar Airguns — Celso Lima Unipessoal, Lda.
- NIPC: PT 505 121 697
- Registered office: Zona Industrial de Vagos 115-B, 3840-385 Vagos, Portugal
- Contact address: Zona Industrial de Vagos 115-B, 3840-385 Vagos, Portugal
- Contact for privacy matters: [email protected]
Mundilar Airguns is not required to designate a Data Protection Officer under Article 37 of the GDPR.
2. Applicable legislation
This Policy complies with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, the "GDPR"), with Lei n.º 58/2019, de 8 de agosto, the Portuguese Act that gives effect to the GDPR in national law, and with Lei n.º 41/2004, de 18 de agosto, the Portuguese Act on privacy in electronic communications.
3. What data we process, for what purpose and on what basis
We process only the data necessary for each purpose. The table below sets out, for each purpose, the categories of data, the legal basis under Article 6 of the GDPR and the retention period.
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Creation and management of the customer account | Name, email address, encrypted password, telephone number, address, tax identification number (NIF) | Performance of the contract and steps prior to entering into a contract — Art. 6(1)(b) | For as long as the account is active and up to 3 years after the last interaction, after which it is deleted or anonymised |
| Order processing, dispatch and delivery | Name, delivery and billing address, telephone number, email address, order details | Performance of the contract — Art. 6(1)(b) | 10 years, on account of tax and accounting obligations |
| Invoicing and compliance with tax obligations | Name, address, tax identification number (NIF), amounts and supporting documents | Legal obligation — Art. 6(1)(c) | 10 years (Código do IVA, the Portuguese VAT Code, and Decreto-Lei n.º 28/2019) |
| Payment processing | Transaction data. Full card details are processed directly by the payment service provider and are not accessible to Mundilar Airguns | Performance of the contract — Art. 6(1)(b) | In accordance with the payment provider's retention periods; the transaction record follows the tax retention period |
| Age verification and compliance with the legal regime governing weapons | Identity document, date of birth and, where applicable, licence or authorisation | Legal obligation — Art. 6(1)(c) | 10 years, on account of legal obligations |
| Guarantee, returns and after-sales support | Order data, correspondence exchanged, bank details where needed for a refund | Performance of the contract and legal obligation — Art. 6(1)(b) and (c) | For the 3-year guarantee period and, once it ends, for the applicable statutory limitation periods |
| Handling enquiries and complaints | Name, email address, order number, content of the message | Performance of the contract or legitimate interests in replying to those who contact us — Art. 6(1)(b) and (f) | 3 years from the closure of the enquiry; formal complaints, 5 years |
| Sending the newsletter and commercial communications | Email address and, where provided, name | Consent — Art. 6(1)(a). For existing customers and products similar to those purchased, legitimate interests under Article 13-A of Lei n.º 41/2004 | Until consent is withdrawn or an objection is made; and, in any event, after 2 years without any interaction with the communications |
| Fraud prevention and detection | IP address, order and payment data, history of fraud flags | Legitimate interests in protecting our assets and preventing fraudulent use — Art. 6(1)(f) | 1 year from the order, unless proceedings are ongoing |
| Security, technical administration and access logs | IP address, date and time, file requested, volume of data, browser and operating system data, referring site, access provider | Legitimate interests in the security and proper functioning of the website — Art. 6(1)(f) | 1 year from the log entry, unless proceedings are ongoing |
| Usage statistics and improvement of the website | Data collected through analytics cookies, as set out in the Cookie Policy | Consent — Art. 6(1)(a) | The lifespan of each cookie, as stated in the Cookie Policy |
| Establishment and defence of legal claims in judicial or administrative proceedings | The data relevant to the proceedings | Legitimate interests and legal obligation — Art. 6(1)(c) and (f) | Until the decision becomes final or the time limits for appeal expire |
3.1. Legitimate interests. Whenever we rely on legitimate interests as our basis, we have first balanced that interest against the rights and freedoms of the data subjects. Anyone may request information about that balancing exercise using the contact details given in point 1.
3.2. Whether providing the data is mandatory. The fields marked as mandatory in the registration and order forms are necessary in order to enter into and perform the contract or to comply with legal obligations. If they are not provided, the order cannot be completed. Providing data for the newsletter is optional and refusing to do so has no consequences for the commercial relationship.
3.3. Accuracy of the data. Users warrant that the data they provide to us is true and undertake to inform us of any relevant change, in particular to the delivery address or the email address.
4. Source of the data
The data we process is, as a rule, provided directly by the data subject. We also automatically collect technical browsing data, as described in the table in point 3 and in the Cookie Policy. We may receive information from payment service providers and carriers in connection with the fulfilment of an order.
5. Who we share the data with
5.1. We do not sell or transfer personal data to third parties for those third parties' own commercial purposes.
5.2. Processors. We use service providers who process personal data on our behalf and on our instructions, under processing contracts concluded in accordance with Article 28 of the GDPR. The categories of processors are as follows:
- Website hosting and infrastructure — Hetzner Online GmbH
- Email and newsletter delivery platform — Amazon Web Services
- Payment service providers — Unicre S.A, PayPal, Revolut, IfthenPay
- Carriers and logistics operators — CTT, DPD, DHL, UPS, GLS, MRW, CORREOS EXPRESS, FEDEX
- Invoicing and accounting software — SAGE
- Website analytics tools — Google (Google Analytics) and Hotjar
5.3. Other recipients. Data may also be disclosed to judicial, police, tax or administrative authorities where there is a legal obligation or a formal, reasoned request, and to lawyers, auditors and courts in connection with the establishment or defence of legal claims.
6. Transfers outside the European Economic Area
6.1. Some of the providers we use — in particular Google and Hotjar — may process data in countries outside the European Economic Area, especially in the United States of America.
6.2. Those transfers are made under one of the following mechanisms provided for in Chapter V of the GDPR:
- the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023, where the recipient is certified under that framework;
- standard contractual clauses approved by the European Commission, accompanied, where necessary, by supplementary measures.
6.3. Any data subject may request information about the mechanism applicable to a specific transfer and obtain a copy of the safeguards in place, using the contact details given in point 1.
7. Automated decision-making and profiling
7.1. Orders are subject to a partly automated check designed to detect transactions suspected of fraud. That check analyses factors such as the consistency between the billing and delivery addresses, the order history, the country the payment comes from and unusual behaviour patterns.
7.2. An order flagged by this process is not automatically refused: it is always reviewed by a member of staff before any decision is taken. Even so, and in accordance with Article 22 of the GDPR, the data subject has the right to obtain human intervention, to express their point of view and to contest the decision, using the contact details given in point 1.
8. Commercial communications and direct marketing
8.1. Subscribing to the newsletter is free and optional. To those who are not customers, commercial communications are sent only with prior, express consent.
8.2. To those who are already customers, we may send communications about products similar to those purchased, under Article 13-A of Lei n.º 41/2004. Every communication offers an easy, free way to refuse further messages.
8.3. Right to object to direct marketing. Everyone has the right to object at any time, and at no cost, to the processing of their data for direct marketing purposes. Once that right is exercised, the data is immediately no longer processed for that purpose. The objection may be made through the unsubscribe link included in every communication, in the customer area of the website, or by message to the contact details given in point 1.
9. Cookies
The website uses cookies and equivalent technologies. Cookies strictly necessary for the site to work are placed without the need for consent. All other cookies — in particular analytics, functional and advertising cookies — are placed only after prior, freely given, specific, informed and unambiguous consent, given through the consent banner. Consent may be refused as easily as it is given and may be withdrawn at any time. All information about the cookies used, their purposes and their lifespans is set out in the Cookie Policy.
10. Data security
We take appropriate technical and organisational measures to protect personal data against unauthorised destruction, loss, alteration, disclosure or access, in particular: encrypted transmission over HTTPS using the TLS protocol; access control with individual authentication; restricting access to staff who need it for their duties; backups; and the use of firewalls. Data is stored on servers with restricted access, in controlled facilities.
11. Personal data breaches
In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, we will notify the Comissão Nacional de Proteção de Dados within 72 hours, in accordance with Article 33 of the GDPR, and will communicate the breach to the data subjects affected whenever the risk is high, in accordance with Article 34.
12. Rights of data subjects
12.1. Under Articles 15 to 22 of the GDPR, everyone has the following rights in relation to their personal data:
- Access — to obtain confirmation that their data is being processed and to access that data and information about the processing;
- Rectification — to have inaccurate data corrected or incomplete data completed;
- Erasure — to obtain the erasure of the data, in the situations provided for by law;
- Restriction of processing — in the situations provided for by law;
- Data portability — to receive the data they have provided in a structured, commonly used and machine-readable format, and to transmit it to another controller, where the processing is based on consent or on a contract and is carried out by automated means;
- Objection — to object to processing based on legitimate interests, on grounds relating to their particular situation, and to object, without having to give reasons, to processing for direct marketing;
- Not to be subject to decisions based solely on automated processing — as set out in point 7.
12.2. Withdrawal of consent. Where processing is based on consent, that consent may be withdrawn at any time, as easily as it was given. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of the consent previously given.
12.3. How to exercise these rights. The rights may be exercised by message to [email protected], or by letter to Mundilar Airguns, Zona Industrial de Vagos 115-B, 3840-385 Vagos. We will reply within one month of receiving the request, extendable by two months in particularly complex cases, of which we will inform you. We may need to ask for additional information to confirm the identity of the person making the request.
12.4. Complaint to the supervisory authority. Without prejudice to any other remedy, everyone has the right to lodge a complaint with the supervisory authority, which in Portugal is the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa — [email protected] — www.cnpd.pt.
13. Minors
The sale of the products offered on this website is restricted to persons aged 18 or over. They are intended exclusively for persons aged 18 or over, under the legislation applicable to weapons and ammunition. For that reason, we do not knowingly collect data from persons under 18, nor are they allowed to create an account or place orders. If we become aware that we have collected data from a minor, we will erase it as soon as possible. Anyone who becomes aware of such a situation may contact us using the contact details given in point 1.
14. Links to other sites and social networks
The website may contain links to third-party sites, including social networks. Mundilar Airguns does not control and is not responsible for the privacy practices of those sites, which are governed by their own policies. We recommend that you read them. Those platforms may record information about users' activity, including visits to this website.
15. Changes to this Policy
This Policy may be updated, in particular as a result of legislative changes, new website features or changes in the service providers used. The date of the last update and the version number appear at the start of the document. Whenever the changes are material — in particular where they involve new purposes or new legal bases — we will inform data subjects in advance by appropriate means, in particular by email or by a prominent notice on the website. Previous versions may be requested using the contact details given in point 1.
16. Applicable law
This Policy is governed by Portuguese law. The Portuguese courts have jurisdiction over disputes arising from it, without prejudice to the rules of jurisdiction applicable to consumer disputes and to the right to complain to the CNPD.
