Cookie Policy

Last updated: March 2026

1. What are cookies?

Cookies are small text files stored on your device (computer, tablet, or smartphone) when you visit our website. They allow the website to recognize your device and remember certain preferences or actions over time.

2. Who is responsible for cookies?

The data controller is Work Play Lab, Lda., with headquarters at Rua Hermano Neves, 18, Piso 3, Esc. 7, V8001, 1600-477 Lisbon, Portugal (NIPC: 519179684), contactable via info@surprizy.pt.

3. What cookies do we use?

3.1 Strictly necessary cookies

These cookies are essential for the website to function and cannot be disabled. They do not require consent.

Cookie	Purpose	Duration
_shopify_session	User session management	Session
cart	Shopping cart maintenance	2 weeks
_shopify_y	Unique visitor identification	1 year
secure_customer_sig	Customer authentication	Persistent

3.2 Analytical cookies (require consent)

They allow us to understand how visitors interact with the website, helping us improve the user experience.

Cookie	Provider	Purpose	Duration
_ga	Google Analytics	User distinction	2 years
_ga_*	Google Analytics	Session state persistence	2 years

3.3 Marketing cookies (require consent)

Used to display relevant ads and measure the effectiveness of advertising campaigns.

Cookie	Provider	Purpose	Duration
_fbp	Meta (Facebook)	Tracking for ads	3 months
_fbc	Meta (Facebook)	Click tracking	3 months

4. Legal basis for processing

Under Regulation (EU) 2016/679 (GDPR):

Necessary cookies: legitimate interest (Art. 6(1)(f))
Analytical and marketing cookies: explicit consent of the data subject (Art. 6(1)(a))

5. How to manage or withdraw consent?

You can manage your cookie preferences at any time through:

The cookie banner displayed on the first visit to the website
The "Cookie preferences" link available in the website footer, in the Terms and Policies section
Your browser settings
Contacting us directly at info@surprizy.pt

Withdrawal of consent does not affect the lawfulness of processing carried out based on consent given before its withdrawal.

6. International transfers

Some of our cookie providers (such as Google and Meta) may transfer data outside the European Economic Area. These transfers are carried out based on appropriate safeguards, namely Standard Contractual Clauses approved by the European Commission.

7. Data subject rights

Under the GDPR, you have the right to:

Access, rectify, or erase your personal data
Object to processing or request its restriction
Lodge a complaint with the CNPD (National Data Protection Commission) at www.cnpd.pt
Consult our Privacy Policy for complete information on the processing of your personal data