Privacy Policy

This notice explains how personal data is processed when you visit the public Amigo.Click website or contact us. Amigo.Click is a brand of ESTRELA BRANDS. The controller is Maria Angela Navarro Alascio, Niederalteicher Straße 4b, 80995 München, Germany. Contact: hello@estrelabrands.com. This notice does not describe data processing inside a merchant’s Shopify store or the installed referral app; those services require their own notices reflecting their actual operation.

The site is hosted through Lovable. Opening a page or requesting an asset transmits technical information such as your IP address, request time, requested URL, browser and operating-system information, HTTP headers, referrer where supplied, and response or error information to the hosting infrastructure. These data enable page delivery, troubleshooting and protection against abuse. Our legal basis is Article 6(1)(f) GDPR: our legitimate interests in operating an accessible, reliable and secure website, balanced against visitors’ rights. Technical data are not used by us to decide whether you qualify for a service.

Our mailbox is hosted by Hostinger. If you contact us, we process your email address, any name you provide, message content, attachments and communication metadata to answer your enquiry and manage follow-up. Please send only information needed for your request and avoid sending passwords, payment-card details or sensitive personal documents. For enquiries about a potential contract, the basis is Article 6(1)(b) GDPR where processing is necessary for pre-contractual steps requested by you. For other enquiries, the basis is Article 6(1)(f) GDPR and our legitimate interest in responding to correspondence. Information that must be retained to comply with applicable law is processed under Article 6(1)(c) GDPR. Sending an enquiry does not subscribe you to marketing.

When you actively select a language, the site stores a first-party cookie named lang containing only the language code. It applies to the website path / and expires after one year unless deleted earlier or replaced by a subsequent choice. It remembers the language you requested; it is not a referral or advertising identifier. The application also uses session storage for page scroll restoration where supported by the browser. The language and scroll functions rely on Article 6(1)(f) GDPR and our interest in providing requested navigation; storage strictly necessary for an expressly requested function falls within Section 25(2) TDDDG. You can delete or block this storage in your browser; language persistence or restoration may then stop working. Browser language headers may be used to choose an initial locale. Merely viewing this notice does not constitute consent to optional tracking.

Lovable’s publishing platform provides aggregate visitor analytics, enabled by default, concerning visits, page views, duration, traffic sources, device type and approximate country. The country breakdown is derived from browser time-zone information according to Lovable’s documentation. The provider states that this measurement does not build individual visitor profiles or follow people across separate visits. Technical request information is nevertheless processed to deliver and measure the website; aggregate output is not a claim that no personal data are involved. Our purpose is understanding overall use and identifying reliability issues. For limited measurement that does not require consent, the basis is Article 6(1)(f) GDPR, subject to a balancing assessment. This basis does not replace consent where Section 25 TDDDG or other applicable rules require it. Required consent must be obtained before such processing; optional measurement must otherwise be disabled. The site’s error-handling code can send diagnostic error information, route information and stack traces to available Lovable reporting interfaces. We use diagnostics to investigate faults under Article 6(1)(f) GDPR. No Google Analytics, Meta advertising pixel or session-replay integration is configured in the reviewed application code. This statement concerns this website, not third-party destinations.

The website uses locally served font files and other presentation assets. Font requests use the same hosting infrastructure as the page. There is no separate request from your browser to Google Fonts for rendering these fonts. Ordinary asset delivery is covered by the hosting section above.

The relevant provider categories are website hosting and delivery, security and diagnostics, visitor measurement, and email hosting and transmission. Lovable provides website infrastructure and Hostinger provides the contact mailbox; their infrastructure suppliers may also process technical data. Data may additionally be disclosed to professional advisers, courts or authorities where necessary to meet a legal obligation or establish, exercise or defend legal claims. Access is limited to the purpose concerned; providers’ own activities are governed by their applicable notices. We do not sell enquiry content to advertisers. Links to Shopify, Lovable or other external websites lead to services governed by their own terms and privacy information. Clicking an email link opens your email application; transmission occurs when you send the message.

Use of international infrastructure can involve processing outside the European Economic Area, including in the United States. A provider’s European establishment is not a guarantee that all processing stays in Europe. Restricted transfers require an applicable GDPR Chapter V mechanism, such as an adequacy decision covering the recipient or standard contractual clauses with any necessary supplementary measures. Lovable describes using EU standard contractual clauses for relevant transfers in its privacy information. Contact us for information about safeguards applicable to our processing and copies where available, with confidential details redacted. Provider documentation supplements this notice; it does not remove our responsibilities as controller.

We retain data only while needed for the purpose concerned or an applicable legal obligation. Technical delivery, security and diagnostic data follow the hosting provider’s operational retention and incident-handling requirements; incident evidence may be retained longer while an investigation or legal claim requires it. Enquiry correspondence is retained while handling the request and any necessary follow-up, then deleted when no longer needed unless record-retention duties or a legal claim require continued storage. Records that qualify as business or tax records follow the applicable statutory periods rather than a blanket period for all messages. Analytics data follow the platform’s retention and reporting lifecycle; truly anonymised statistics may be kept separately because they no longer identify individuals. The language-cookie period is stated above. Backup copies may expire through the provider’s ordinary rotation rather than immediately upon deletion from active systems. You may ask us about the retention applicable to your particular data.

Subject to the conditions of the GDPR, you may request access and a copy of your personal data, correction, erasure, restriction of processing, and portability for eligible data processed automatically on the basis of consent or contract. You may withdraw consent at any time where processing relies on consent, without affecting its lawfulness before withdrawal. You may object under Article 21 GDPR to processing based on legitimate interests for reasons relating to your particular situation. For direct marketing, you may object at any time without giving reasons. Send requests to hello@estrelabrands.com. We may request proportionate information to verify identity where reasonable doubt exists; we will not routinely require an identity document. We normally respond within one month of receipt. Where the GDPR permits an extension for a complex or numerous request, we will inform you within that month and explain why. Requests are generally free of charge, subject to the statutory exceptions.

You may complain to a supervisory authority, especially in the EU Member State of your habitual residence, work or the alleged infringement. For a private business in Bavaria, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) provides a complaint procedure at https://www.lda.bayern.de/de/beschwerde.html. You do not have to contact us first. Providing enquiry information is voluntary; without an email address and enough information we may be unable to respond. Technical request information is necessary to deliver pages. The reviewed landing-page application does not make decisions with legal or similarly significant effects solely by automated processing, and does not operate an individual referral-profiling service.

The website uses HTTPS for transmission. No internet transmission or email service can guarantee absolute security; please use an appropriate channel for confidential material. We update this notice when the website’s processing changes. Materially new purposes or optional technologies require the relevant information and legal basis before activation. The version date identifies the current notice; updates do not retroactively create consent. Last updated: 1 October 2026.