Privacy policy

Last updated: 10 September 2026.

This policy explains what personal data Figalli handles, why, who we share it with, and what you can require of us. Figalli is a Brazilian company, so Brazil’s data protection law (LGPD, Law 13.709/2018) applies to our processing. If you live in the European Union or the United Kingdom, the rights the GDPR gives you are set out at the end.

1. Who the controller is

Figalli Tapetes Ltda. — Brazilian company registry (CNPJ) 52.699.460/0001-53
Rua Dr. Alberto da Silveira, 442 — Cidade Jardim — São Paulo/SP — 05671-000 — Brazil
Contact for data matters: contato@figalli.com. This is where you exercise the rights described in section 7.

2. What data we handle

• You give us: name, e-mail, telephone or WhatsApp number, delivery and billing address, a tax identification number where an invoice requires one, and the content of the messages you send us.
• The purchase creates: items, amounts, date, payment method and a record of our correspondence. We never receive or hold your card number — that stays with the payment processors.
• Browsing creates: IP address, cookie identifiers, device and browser type, pages visited, where the visit came from, and — through Microsoft Clarity — an anonymised recording of how you interact with the pages (mouse movement, scrolling and clicks).

3. What we use it for, and on what legal basis

• Fulfilling your order — account, payment, shipping, returns and support. Basis: performance of a contract.
• Meeting legal duties — invoicing, tax and accounting records, export documentation. Basis: legal obligation.
• Answering you — e-mail, contact form and WhatsApp. Basis: steps prior to a contract, or legitimate interest.
• Security and fraud prevention — checking mismatches between order and payment details. Basis: legitimate interest.
• Measuring and improving the site — usage statistics and anonymised session recording. Basis: legitimate interest.
• Advertising and remarketing — the Meta Pixel and the Pinterest Tag. Basis: your consent, which you may withdraw at any time.

4. Cookies and similar technologies

Necessary cookies make the site work: session, cart, language preference and caching. Without them the site does not operate.

Beyond those we use, and you should know this: Google Analytics 4 and Google Tag Manager (audience measurement), Microsoft Clarity (heatmaps and session recording), the Meta/Facebook Pixel and the Pinterest Tag (advertising and remarketing).

These use identifiers which, alone or combined, are personal data. You can block them in your browser settings, use the opt-out tools Google and Meta provide, or ask us to withdraw your consent at contato@figalli.com.

5. Who we share it with

• Payment processors — to authorise and settle the purchase.
• The carrier (DHL Express) — name, address, telephone and consignment details, including what customs requires.
• Hosting and infrastructure — Hostinger, which stores the site and its database.
• Google, Meta, Microsoft and Pinterest — browsing data, as described in section 4.
• Accountants and authorities — where the law requires it, or to defend our rights in proceedings.

We do not sell personal data, and we do not pass it to third parties for their own commercial use.

6. International transfers

Your data is processed in Brazil, and Google, Meta, Microsoft, Pinterest and part of our hosting infrastructure process data on servers outside Brazil. On international orders your data is also transmitted to the carrier and to the customs authorities of the destination country, because that country’s law requires it. These transfers rely on the contractual clauses and safeguards those suppliers provide.

7. Your rights

You may ask us to: confirm whether we hold data about you; give you access to it; correct anything incomplete or out of date; anonymise, block or delete data that is unnecessary or handled unlawfully; port your data to another provider; tell you who we share it with; explain the consequence of refusing consent; and withdraw consent you have given.

Write to contato@figalli.com. We answer within 15 days. We may ask you to confirm your identity first — that is to protect you. If something has to be kept for a legal reason, we tell you what and for how long.

If you are in the EU or the UK, the GDPR gives you those same rights plus the right to object to processing based on legitimate interest and the right to complain to your national supervisory authority.

8. How long we keep it

• Order and invoice records: 5 years, under Brazilian tax and consumer law.
• Website access logs: 6 months, under Brazil’s Internet Civil Framework.
• Enquiries that did not lead to a purchase: 2 years.
• Advertising and measurement data: the period each tool sets — currently up to 14 months in Google Analytics.

After that the data is deleted or anonymised.

9. Security

The site runs over HTTPS, administrative access is restricted and logged, and payment details never pass through our systems. No measure removes risk entirely; if an incident occurs that poses a real risk to your rights, we will tell you and notify the Brazilian data protection authority.

10. Children

The site is not intended for anyone under 18 and we do not knowingly collect children’s data. If it happens, write to contato@figalli.com and we will delete it.

11. Changes

We may update this policy. The date of the last update is at the top. Material changes will be announced on the site.

12. Complaints

If our answer does not satisfy you, you may complain to Brazil’s Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd, or to the supervisory authority in your own country.