Privacy policy

Last updated: 29 July 2026

1. ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how Bishop & Melo, Lda., trading as the ESPIGA Pinto Estate Shop, collects and processes personal data when you:

  • visit or use our website;
  • browse or purchase artworks, editions, publications or related items;
  • create or use a customer account, where available;
  • subscribe to marketing communications;
  • contact us about an order, artwork or service;
  • request condition, provenance or authentication information;
  • submit information concerning a work attributed to ESPIGA Pinto;
  • enquire about consignment or resale; or
  • otherwise communicate or interact with us.

The ESPIGA Pinto Estate Shop is powered by Shopify, which supplies the technical e-commerce platform used to operate the website and checkout.

For the processing described in this Privacy Policy, the data controller is:

Bishop & Melo, Lda.
Trading as ESPIGA Pinto Estate Shop

Registered office:
Edifício CULTIVA
Rua da Indústria, 13
3420-316 Tábua
Portugal

Commercial registration and legal person number: 518 227 022
Tax identification number: 518 227 022
VAT number: PT518227022

Email: shop@espigapinto.com
Telephone: +351 235 094 024

In this Privacy Policy, “we”, “us” and “our” refer to Bishop & Melo, Lda.

2. WHAT IS PERSONAL DATA?

“Personal data” means information relating to an identified or identifiable natural person.

It may include information that directly identifies you, such as your name or email address, as well as information that can identify you indirectly, such as an order number, IP address, device identifier or combination of transaction and contact information.

Information that has been irreversibly anonymised so that no individual can reasonably be identified is not personal data.

3. PERSONAL DATA WE MAY COLLECT

The personal data we collect depends on how you interact with the shop.

3.1 Identification and contact data

This may include:

  • name;
  • billing address;
  • delivery address;
  • country of residence;
  • email address;
  • telephone number; and
  • company name, VAT number or professional details where supplied.

3.2 Order and transaction data

This may include:

  • products viewed or ordered;
  • order number;
  • order date and value;
  • delivery and billing information;
  • returns, withdrawals, refunds and complaints;
  • transaction status;
  • payment method;
  • payment confirmation;
  • customs or delivery information; and
  • correspondence relating to a purchase.

We do not normally receive or retain your complete payment-card number. Card information is processed by Shopify Payments or another authorised payment provider.

For manual bank transfers, we may receive information such as the account holder’s name, payment reference, IBAN details visible on the transfer record and payment confirmation.

3.3 Account data

Where customer accounts are enabled, this may include:

  • account login details;
  • account preferences;
  • order history;
  • saved addresses; and
  • account security and authentication information.

Passwords are handled through the relevant platform functionality and are not ordinarily visible to us in readable form.

3.4 Website and device data

This may include:

  • IP address;
  • browser type;
  • operating system;
  • device type;
  • language;
  • approximate location derived from IP address;
  • unique device or browser identifiers;
  • pages viewed;
  • referral source;
  • dates and times of access;
  • cart and checkout activity; and
  • interactions with the website.

Some of this information is collected through cookies, pixels, local storage and similar technologies.

3.5 Communications and customer-service data

This may include:

  • emails and messages sent to us;
  • telephone or customer-service records;
  • questions about artworks;
  • condition-report requests;
  • delivery instructions;
  • complaints;
  • withdrawal notices; and
  • other information you choose to provide.

Please do not send unnecessary sensitive personal information through ordinary email.

3.6 Collector, provenance and consignment data

If you contact us about a work you own, possible attribution, Estate review, consignment or resale, we may process:

  • your name and contact details;
  • photographs of the artwork;
  • title, medium, dimensions and inscriptions;
  • provenance and ownership history;
  • purchase, inheritance or collection information;
  • certificates, invoices, exhibition records or correspondence;
  • identity or authority information where needed;
  • proposed transaction information; and
  • information concerning other owners, sellers, agents or intermediaries.

You should provide personal data concerning another person only where you are entitled to do so.

Submitting information does not oblige us or the ESPIGA Pinto Estate to authenticate, value, purchase, consign or list a work.

3.7 Marketing data

Where you subscribe to or consent to marketing, we may process:

  • your name;
  • email address;
  • marketing preferences;
  • subscription and unsubscribe history; and
  • interaction with our marketing communications.

3.8 Reviews and submitted content

Where reviews, comments, images or other user-submitted content are enabled, we may process:

  • your name or chosen display name;
  • review or comment;
  • images submitted;
  • rating;
  • purchase-verification information; and
  • related technical or moderation information.

4. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

Directly from you

For example, when you:

  • place an order;
  • create an account;
  • subscribe to communications;
  • complete a form;
  • contact customer service;
  • request artwork information;
  • exercise a consumer or data-protection right; or
  • submit an artwork or consignment enquiry.

Automatically through the website

For example, through:

  • cookies;
  • pixels;
  • server logs;
  • browser storage;
  • analytics technologies; and
  • Shopify’s technical infrastructure.

From service providers

For example, from:

  • Shopify;
  • payment providers;
  • banks;
  • delivery and logistics providers;
  • fraud-prevention providers;
  • website analytics providers; and
  • customer-support or email providers.

From other persons or public sources

For example:

  • a person ordering a gift for you;
  • a joint owner or authorised agent;
  • a collector, dealer or intermediary;
  • public provenance, catalogue or exhibition records;
  • public registers; or
  • legally accessible sources relevant to an artwork review or transaction.

5. WHY WE PROCESS PERSONAL DATA AND OUR LEGAL BASES

Under the General Data Protection Regulation, we must have a lawful basis for processing personal data.

5.1 Processing and fulfilling orders

We process personal data to:

  • receive and assess orders;
  • verify payment;
  • issue invoices;
  • arrange packaging and delivery;
  • provide order updates;
  • administer withdrawals, returns and refunds;
  • handle damaged or missing deliveries; and
  • provide contractual customer service.

Legal basis: performance of a contract or steps requested before entering into a contract.

5.2 Payments and fraud prevention

We process personal data to:

  • process card or bank-transfer payments;
  • confirm receipt of funds;
  • prevent fraudulent transactions;
  • verify suspicious activity;
  • protect customer accounts; and
  • secure the shop and checkout.

Legal basis: performance of a contract, compliance with legal obligations and our legitimate interests in preventing fraud and maintaining secure services.

5.3 Accounting, tax and legal compliance

We process data to:

  • issue and retain invoices;
  • maintain accounting records;
  • comply with tax, VAT, customs and commercial obligations;
  • respond to courts, regulators and public authorities;
  • administer consumer complaints; and
  • establish, exercise or defend legal claims.

Legal basis: compliance with legal obligations and, where relevant, our legitimate interests in protecting our legal position.

5.4 Customer service and communications

We process personal data to:

  • answer questions;
  • provide condition or product information;
  • manage complaints;
  • resolve order issues;
  • respond to withdrawal requests; and
  • maintain appropriate business correspondence.

Legal basis: performance of a contract, steps requested before entering into a contract and our legitimate interests in providing effective customer service.

5.5 Artwork, provenance and Estate enquiries

We may process information supplied concerning a work to:

  • carry out a preliminary review;
  • assess provenance or ownership information;
  • communicate with you about the work;
  • consider possible authentication, research, consignment or resale;
  • protect the integrity of the Estate’s records; and
  • detect misleading, fraudulent or conflicting claims.

Legal basis: steps requested before entering into a possible agreement, our legitimate interests in conducting responsible art-market and Estate activities, and the establishment, exercise or defence of legal claims where relevant.

A separate agreement or privacy notice may be provided if a formal authentication, research, consignment or agency process is undertaken.

5.6 Operating and improving the website

We may process technical and usage information to:

  • operate the website;
  • maintain functionality;
  • diagnose errors;
  • measure basic performance;
  • prevent abuse;
  • understand how the shop is used; and
  • improve navigation and user experience.

Legal basis: our legitimate interests in operating, securing and improving the shop.

Where non-essential cookies or similar technologies require consent, the relevant processing is based on your consent.

5.7 Marketing communications

We may use your contact details to send newsletters, new-release notices, exhibition or Estate updates, product information and other promotional communications where:

  • you have given consent; or
  • another lawful basis permits the communication.

You may unsubscribe at any time using the link in the communication or by contacting us.

Legal basis: consent or another basis permitted by applicable direct-marketing law.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5.8 Personalised advertising

We will use personal data for targeted or personalised advertising only where the relevant tools are enabled and applicable law permits it.

Where consent is required for advertising cookies, pixels or similar technologies, those tools should not be activated until valid consent has been obtained.

Legal basis: consent where required, or legitimate interests where legally permitted.

5.9 Reviews and submitted content

Where enabled, we may process reviews or other submitted content to:

  • publish customer feedback;
  • verify purchases;
  • moderate unlawful or inappropriate content;
  • respond to reviews; and
  • protect the integrity of the website.

Legal basis: your consent where applicable, performance of the service you request and our legitimate interests in operating and moderating the shop.

6. COOKIES AND SIMILAR TECHNOLOGIES

The website may use cookies and similar technologies for purposes including:

  • essential website operation;
  • cart and checkout functions;
  • security and fraud prevention;
  • remembering user preferences;
  • analytics;
  • performance measurement; and
  • advertising, where enabled.

Strictly necessary cookies may be used without consent where permitted by law because they are required to provide a service expressly requested by the user or to operate essential functionality.

Analytics, advertising and other non-essential technologies will be used only in accordance with applicable consent requirements.

You can manage available cookie choices through our cookie banner or privacy-preferences interface.

Further information about the technologies actually used should be provided in our Cookie Policy or cookie-preferences panel.

Browser settings may also allow you to restrict cookies, although blocking essential cookies may affect checkout or website functionality.

7. SHOPIFY

The shop is hosted and powered by Shopify.

Shopify processes personal data to provide services including:

  • website hosting;
  • storefront operation;
  • checkout;
  • security;
  • fraud prevention;
  • infrastructure;
  • technical support; and
  • platform improvement.

Depending on the feature and processing activity, Shopify may act as:

  • our processor;
  • an independent controller; or
  • another form of responsible party recognised by applicable law.

Information submitted through the shop is transmitted to Shopify and may also be processed by Shopify affiliates and service providers.

Shopify may process data relating to your interactions with our shop and, where relevant Shopify features are enabled, your interactions with other Shopify merchants or Shopify consumer services.

Further information is available in Shopify’s consumer privacy notice and privacy portal.

Shopify provides merchants with customer-privacy tools, but merchants remain responsible for checking that privacy settings, cookie controls, installed applications and policy wording accurately reflect their actual activities.

8. WHO MAY RECEIVE PERSONAL DATA?

We may disclose personal data where necessary to the following categories of recipients.

Shopify and technical providers

Including providers of:

  • website hosting;
  • e-commerce infrastructure;
  • cloud storage;
  • website security;
  • technical support;
  • analytics; and
  • customer-account functionality.

Payment and banking providers

Including:

  • Shopify Payments;
  • payment-card processors;
  • acquiring banks;
  • fraud-prevention services; and
  • banks involved in manual transfers.

Shipping and logistics providers

Including:

  • postal operators;
  • couriers;
  • specialist art carriers;
  • customs brokers;
  • warehousing or fulfilment providers; and
  • transport insurers.

We provide only the information reasonably necessary to arrange and administer delivery.

Professional advisers

Including:

  • lawyers;
  • accountants;
  • auditors;
  • tax advisers;
  • insurers;
  • conservators;
  • art-market specialists; and
  • other professional advisers subject to appropriate duties of confidentiality.

Estate representatives and specialists

Where relevant to an artwork, provenance, authentication or consignment enquiry, information may be shared with:

  • authorised Estate representatives;
  • the artist’s heirs;
  • researchers;
  • archivists;
  • conservators;
  • provenance specialists; and
  • other persons reasonably required to assess the enquiry.

Information will be shared only where there is a lawful basis and it is reasonably necessary.

Public authorities and courts

We may disclose personal data where required or permitted by law to:

  • tax authorities;
  • customs authorities;
  • courts;
  • law-enforcement agencies;
  • regulators;
  • consumer authorities; and
  • other competent public bodies.

Business transfers

If all or part of our business is reorganised, sold or transferred, personal data may be disclosed to professional advisers and prospective or actual purchasers, subject to appropriate safeguards.

We do not disclose personal data merely in exchange for monetary payment.

9. INTERNATIONAL DATA TRANSFERS

Some recipients, including Shopify and certain technology, payment or logistics providers, may process personal data outside Portugal, the European Economic Area or the United Kingdom.

Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, the transfer will rely on an appropriate lawful safeguard where required, such as:

  • European Commission standard contractual clauses;
  • a legally recognised adequacy decision;
  • binding corporate rules;
  • an applicable certification or contractual framework; or
  • another transfer mechanism permitted by law.

Additional safeguards may be applied where appropriate.

Shopify states that international transfers of European customer data may be made under mechanisms including contractual safeguards adopted for European data-protection purposes.

You may contact us for further information about safeguards relevant to a particular transfer, subject to confidentiality and legal restrictions.

10. HOW LONG WE RETAIN PERSONAL DATA

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, tax, consumer-protection, evidential and dispute-resolution purposes.

Indicative retention criteria include the following.

Orders, invoices and accounting records

Order, invoice, payment and accounting information will normally be retained for the period required under Portuguese tax, accounting and commercial law.

Customer-service and complaint records

These may be retained for the period reasonably necessary to resolve the matter and for the applicable limitation or legal-claims period.

Account information

Account data may be retained while the account remains active and for a reasonable period after closure, subject to legal obligations and security requirements.

Marketing data

Marketing contact information will normally be retained until:

  • you unsubscribe;
  • you withdraw consent;
  • the contact information becomes invalid; or
  • we determine that continued retention is no longer justified.

We may retain limited suppression information to ensure that an unsubscribe request continues to be respected.

Artwork, provenance and consignment enquiries

Information relating to an artwork, attribution, provenance, consignment or Estate enquiry may be retained for an extended period where reasonably necessary for:

  • archival continuity;
  • provenance research;
  • detecting conflicting claims;
  • protecting the integrity of Estate records;
  • preventing fraud;
  • evidential purposes; or
  • establishing, exercising or defending legal claims.

Because provenance and authorship information may remain relevant over long periods, some records may need to be retained longer than ordinary customer-service correspondence. We will take account of necessity, proportionality, accuracy and the rights of affected individuals.

Website and security logs

Technical logs are retained for periods determined by security, troubleshooting, platform and legal requirements.

When personal data is no longer required, it will be deleted, anonymised or securely restricted, unless continued retention is required or permitted by law.

11. SECURITY

We use reasonable technical and organisational measures intended to protect personal data against:

  • unauthorised access;
  • unlawful use;
  • alteration;
  • accidental loss;
  • destruction; and
  • unauthorised disclosure.

These measures may include:

  • access controls;
  • account authentication;
  • secure platform infrastructure;
  • payment-provider security;
  • encrypted communications where supported;
  • limited staff or contractor access;
  • backups;
  • fraud monitoring; and
  • contractual confidentiality and data-protection obligations.

No online system or method of transmission is completely secure. You should not send payment-card details, identity documents or other highly sensitive information through ordinary unsecured email unless specifically requested and an appropriate method has been agreed.

You are responsible for keeping any customer-account credentials confidential.

12. YOUR DATA-PROTECTION RIGHTS

Subject to the conditions and limitations established by applicable law, you may have the right to:

Access

Request confirmation of whether we process your personal data and obtain access to that data and related information.

Rectification

Request correction of inaccurate personal data and completion of incomplete data.

Erasure

Request deletion of personal data in circumstances where there is no continuing lawful reason to retain it.

Restriction

Request that processing be restricted in certain circumstances.

Objection

Object to processing based on legitimate interests, including profiling based on those interests.

Where personal data is processed for direct marketing, you may object at any time.

Data portability

Receive certain personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, request transmission to another controller.

Withdraw consent

Withdraw consent at any time where processing is based on consent.

Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

Protection concerning automated decisions

Request protections relating to a decision based solely on automated processing that produces legal or similarly significant effects, where applicable.

We do not ordinarily make decisions concerning purchases solely through automated processing that produce such effects, although payment and fraud providers may use automated risk tools.

13. HOW TO EXERCISE YOUR RIGHTS

To exercise a data-protection right, contact:

Email: shop@espigapinto.com

or write to:

Bishop & Melo, Lda.
Edifício CULTIVA
Rua da Indústria, 13
3420-316 Tábua
Portugal

Please describe the right you wish to exercise and provide enough information for us to identify the relevant records.

We may request reasonable information to verify your identity and prevent unauthorised disclosure.

Where a request is made through an authorised representative, we may require evidence of the representative’s authority and may contact you directly to verify the request.

We will respond within the period required by applicable law. Under the GDPR, this will normally be within one month, although that period may be extended where legally permitted because of the complexity or number of requests.

Rights are not absolute. We may retain or continue processing information where required or permitted by law, including for tax records, fraud prevention, freedom of expression, legal claims or overriding legitimate grounds.

You will not be treated unfairly for exercising your data-protection rights.

14. MARKETING CHOICES

You may unsubscribe from promotional emails at any time by:

Unsubscribing from marketing does not prevent us from sending non-promotional communications relating to:

  • orders;
  • payment;
  • delivery;
  • returns;
  • security;
  • account administration;
  • legal notices; or
  • customer-service enquiries.

Cookie and advertising preferences may be managed through the website’s privacy-preferences interface, where available.

15. CHILDREN

The Estate Shop is not directed at children.

Purchases must be made by persons with legal capacity to enter into the relevant contract.

We do not knowingly collect personal data directly from children for marketing or customer-account purposes.

If you believe that a child has provided personal data to us without appropriate authority, please contact us so that we can investigate and take appropriate action.

16. THIRD-PARTY WEBSITES AND SERVICES

The website may link to external websites, social-media services, payment providers or other third-party platforms.

Those parties operate under their own privacy policies and are responsible for their own processing activities.

We are not responsible for the privacy or security practices of a third-party service that we do not control.

A link does not, by itself, mean that we endorse the third party or assume responsibility for its content or data practices.

17. COMPLAINTS

Please contact us first if you have a concern about our processing of personal data:

Email: shop@espigapinto.com
Telephone: +351 235 094 024

You also have the right to lodge a complaint with the Portuguese data-protection supervisory authority:

Comissão Nacional de Proteção de Dados — CNPD

Av. D. Carlos I, 134, 1.º
1200-651 Lisboa
Portugal

Telephone: +351 213 928 400
Email: geral@cnpd.pt

You may also have the right to complain to the data-protection authority in the EU or EEA country where you habitually reside, work or believe an infringement occurred.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect:

  • changes to our operations;
  • new Shopify or third-party features;
  • changes to the service providers we use;
  • legal or regulatory developments; or
  • changes to the way personal data is processed.

The revised version will be published on this website with an updated “Last updated” date.

Where required by law, we will provide additional notice or seek renewed consent.

19. CONTACT

For questions about this Privacy Policy, our privacy practices or your data-protection rights, contact:

Bishop & Melo, Lda.
Trading as ESPIGA Pinto Estate Shop

Edifício CULTIVA
Rua da Indústria, 13
3420-316 Tábua
Portugal

Email: shop@espigapinto.com
Telephone: +351 235 094 024

Commercial registration and legal person number: 518 227 022
VAT number: PT518227022