Privacy Policy
How we collect, use and protect your personal data.
Last updated: 24 September 2026. This page explains, in plain language, which personal data Prime Hay collects, why, how long we keep it and what your rights are under the EU General Data Protection Regulation (GDPR).
In short
- We use your data to deliver your orders, run your account and answer your questions.
- We only send newsletters if you agreed to it or if you are a customer, and you can unsubscribe in one click.
- We do not sell your data. There is no advertising pixel, no Google Analytics, no retargeting and no sharing with ad networks.
- Our website statistics work without cookies and without storing your IP address.
- Logged-in customers can download or delete their data themselves on the account page.
1. Who is responsible for your data
The controller is Prime Hay Portugal, Lda (NIF 517692473), Sítio da Pedragosa, Barreiras Brancas, 8100-229 Loulé, Portugal. Email: hello@primehayinternational.com. Phone and WhatsApp: +351 926 368 608.
We have not appointed a Data Protection Officer. All privacy questions and requests can go to hello@primehayinternational.com.
2. What we use your data for
The table below lists every purpose, the data involved, the legal basis under the GDPR and how long we keep it.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Orders, delivery and invoicing | Name, email, phone, delivery address, order contents, payment status. Card details are handled only by the payment provider in the Shopify checkout. We never see them. | Contract (art. 6(1)(b)). Invoices: legal obligation (art. 6(1)(c)). | Invoices and accounting records: 10 years (Portuguese tax law). Other order data: as long as needed for the order, warranty and complaints. |
| Customer account | Email, name, phone, addresses, profile photo if you upload one, horses, stable and feeding plans, favourites, preferences, company name and VAT number. | Contract (art. 6(1)(b)). | Until you delete your account. |
| Feeding calculator and nutritionist plan emails | Email, the horse details you enter, your plan. | Your request, steps before a contract (art. 6(1)(b)). | Plan submissions are deleted after 24 months. |
| Full-truck quotes, contact form and the WhatsApp widget email option | Name, email, phone, message, postcode. | Your request, steps before a contract (art. 6(1)(b)). | Quote requests: deleted after 24 months. Contact messages: as long as needed to handle your request. |
| Newsletter | Email, language, country, where you signed up, time of consent. Phone only if you ticked the separate box for SMS or WhatsApp offers. | Consent (art. 6(1)(a)). | Until you unsubscribe. |
| Emails to customers about similar products | Email, name, language. | Legitimate interest (art. 6(1)(f)) and Lei 41/2004, art. 13-A(3). | Until you opt out. |
| Free forage guide | Email, first name if given. | Your request (art. 6(1)(b)). Newsletter only with separate consent. | Guide-only contacts are not used for campaigns. |
| WhatsApp offers switched on in your account | Phone number, the moment you switched it on. | Consent (art. 6(1)(a)). | Until you switch it off. |
| Product reviews | Name, email, rating, review text. | Consent when you submit a review, and our legitimate interest in showing honest reviews (art. 6(1)(a) and (f)). | As long as the review is published. |
| 0% VAT declaration for livestock feed (Lei n.º 10-A/2022) | Company or farm details, NIF, holding number, name of the signer, email, phone. We also keep the IP address and browser user agent as evidence of the signature. | Legal obligation (art. 6(1)(c)). | 10 years. |
| Cookieless website statistics (section 4) | Page views, clicks, time on page, referring website, campaign tags, device type, screen width, country, random tab session id. | Legitimate interest (art. 6(1)(f)). | 13 months, then deleted automatically. |
| Security and abuse prevention | Technical server logs (such as IP address and time of request) at our hosting provider. | Legitimate interest (art. 6(1)(f)). | Short retention set by the hosting provider. |
3. Newsletter and marketing messages
- Newsletter. We only add you if you sign up and agree. You can withdraw your consent at any time with the unsubscribe link in every email or in your account.
- Customers. If you buy from us, we may email you about similar products. Portuguese law (Lei 41/2004, art. 13-A(3)) allows this for existing customers. If you told Shopify at checkout that you do not want marketing, we do not add you. You can also object free of charge in every email via the unsubscribe link.
- Forage guide. If you download the free guide at /guide, we send you the guide. You only receive the newsletter if you ticked the separate box.
- WhatsApp offers. This is off by default. You can switch it on and off in your account, and we record when you did so.
- Contact form. People who write to us through the contact form are kept in a separate service list. That list is never used for marketing.
4. Website statistics without cookies
We measure how the website is used with our own simple script. The data goes through our hosting provider to our own database. There is no Google Analytics and no third-party tracker.
We record page views, clicks on buttons, time on page, the website you came from (only its domain), campaign tags (UTM parameters), device type, screen width, your approximate country and a random session id that only lives in the open browser tab. We do not store your IP address, we do not set a cookie, we do not keep your full browser user agent and we do not keep advertising click ids.
When you click a WhatsApp button, the first message contains a short reference code (PH-XXXX). This lets us see which page led to your question. The data is pseudonymous and does not directly identify you.
Our legal basis is our legitimate interest in improving the website and knowing which pages help our customers. We keep this data for 13 months and then delete it automatically. You can object at any time by emailing hello@primehayinternational.com, or by blocking JavaScript in your browser.
5. Cookies and storage on your device
The website sets no tracking or advertising cookies. That is why there is no cookie banner. We only use a few functional cookies and browser storage items that make the site work, listed below.
| Name | Type | Purpose | How long |
|---|---|---|---|
ph_lang | Cookie | Remembers the language you chose. | 1 year |
phs_cart | Cookie and local storage | Your shopping cart. | Cookie 7 days. Local storage until you empty the cart or clear your browser. |
phs_ca_session | Local storage | Keeps you logged in. | Until you log out |
phs_profile, phs_stal, phs_acct_lang, phs_avatar, phs_fav, phs_horse_tab, phs_month, phs_cart_for | Local storage | Account and stable preferences, and a copy of your account data on your device so pages load faster. | Until you log out or clear your browser |
phs_promo, phs_prime10_used, phs_news_popup_v1 | Local storage | Remembers whether you already saw a promotion or popup. | Until you clear your browser |
ph_vat, phs_vat_decl | Local storage | Your choice to show prices with or without VAT, and the reference of your VAT declaration. | Until you clear your browser |
phs_truck_leads, phs_truck_contact, phs_calc_prefill | Local storage | Form drafts, so you do not have to type everything again. | Until you clear your browser |
ph_wa_auto | Local storage | State of the WhatsApp chat widget. | Until you clear your browser |
ph_sid, ph_landing, ph_attr, ph_ref | Session storage | Cookieless statistics for the current visit (section 4). | Deleted when you close the tab |
We do not keep any lasting marker that shows whether you visited before. Embedded YouTube videos use youtube-nocookie.com and only load when they are shown. The Shopify checkout is run by Shopify and uses its own necessary cookies.
6. Who we share your data with
We only share data with service providers that help us run the shop. They work on our instructions under a data processing agreement, or they act as independent controllers for their own service (for example payment providers and Google Sign-In). We do not sell your data and we do not share it with advertisers.
| Service | What for | Where |
|---|---|---|
| Shopify | Online shop, checkout and orders. | Shopify International Ltd, Ireland. Data may be transferred to Canada and the US. |
| Payment providers in the Shopify checkout | Payments by card, MB WAY, Multibanco and the other methods shown at checkout. | Depends on the method you choose. |
| Supabase | Database and login for customer accounts. | EU region. |
| Netlify | Website hosting and server functions. | US company. |
| Brevo | Sending emails and managing mailing lists. | France, EU. |
| Moloni | Invoicing software. | Portugal. |
| Judge.me | Product reviews. | Judge.me. |
| Only if you choose "Sign in with Google". Also Google Maps address suggestions on the delivery page, and Google Fonts loaded from Google servers. | US company. | |
| YouTube | Embedded videos via youtube-nocookie.com, loaded only when shown. | US company. |
| WhatsApp (Meta) | Only for messages you send us on WhatsApp. | Meta Platforms Ireland, with transfers to the US. |
| OpenStreetMap Nominatim and OSRM | Calculating delivery distance. Only the delivery postcode or place is sent, from our server. | OpenStreetMap Foundation (nominatim.openstreetmap.org) and the public OSRM server (router.project-osrm.org). |
| EU VIES | Checking a VAT number you enter. | European Commission, EU. |
We may also share data with authorities when the law requires it, for example the Portuguese Tax Authority for invoices.
7. Transfers outside the EU
Some providers (Shopify, Netlify, Google and Meta/WhatsApp) may process data in the US or elsewhere outside the European Economic Area. These transfers are protected by the EU-US Data Privacy Framework where the company is certified, and/or by the European Commission's Standard Contractual Clauses. You can ask for a copy of these safeguards at hello@primehayinternational.com.
8. Your rights
You have the right to:
- access your data and get a copy;
- have incorrect data corrected;
- have your data deleted;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing based on legitimate interest. You can always object to direct marketing, without giving a reason;
- withdraw your consent at any time. This does not affect what we did before you withdrew it.
Do it yourself. If you have an account, go to the account page, tab Personal, section "Your data". There you can use "Download my data" (a JSON file) and "Delete my account". Deleting your account removes your profile, addresses, horses and feeding plans, recurring orders, referrals, properties you listed and your newsletter contact. Invoices and 0% VAT declarations are kept where the law requires it (10 years).
Or email us at hello@primehayinternational.com. We reply within one month. We may ask you to confirm your identity first.
9. Security
We protect your data with encrypted connections (HTTPS), access controls and a limited number of trusted providers. No system is completely secure. Please do not send sensitive information such as passwords or card numbers by email or WhatsApp.
10. Children and automated decisions
Our shop is not aimed at children under 16 and we do not knowingly collect their data. We do not make automated decisions that have legal or similarly significant effects on you.
11. Complaints
You can complain at any time to the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados), at www.cnpd.pt. You do not need to contact us first. Of course we are happy to help if you do.
12. Changes to this policy
If we change how we use your data, we update this page and the date at the top.
← Back to contactFeeding tips & first access to new batches
Join 600+ stables across Portugal & Spain getting expert forage advice, early delivery slots and member-only offers.
No spam, just hay. Unsubscribe anytime. Prefer WhatsApp updates? Message us.