Payments and security

What we accept

We accept major credit and debit cards. The card types available to you are shown at the payment step, because availability depends on the country your card was issued in.

We do not accept cash, cheques, bank transfer, cryptocurrency, or instalment credit. There is no account balance, no store credit and no stored value on this site.

There is nothing recurring on this site. Every purchase is a single charge for a single order. We do not store a card for later use and we do not create a subscription of any kind.

The currency you are charged in

Every price on this site is shown, and every payment is taken, in USD (United States dollars). There is no currency switcher and no other currency is offered.

If your account is held in another currency, your card issuer converts the amount at its own rate and may add its own fee. That conversion is between you and your issuer; we neither set it nor receive any part of it.

When you are charged

Your card is charged when you complete payment, at the end of checkout. Before that point nothing is taken — entering delivery details on the checkout page does not authorise anything.

If we cannot fulfil an order after payment, we refund it in full without deduction and without you having to ask.

How card data is handled

• The card form is served by our payment service provider on their own infrastructure, over an encrypted connection.
• Card numbers, expiry dates and security codes are entered there. They are never transmitted to this site and never reach our servers, our database or our logs.
• What comes back to us is the outcome of the payment and a reference, nothing more.
• What we store is your name, contact and delivery details, what you ordered and what you paid. That is what we need to ship the order and to honour the guarantee, and it is described in our privacy notice.

PCI DSS and encryption

Card payments on this site are processed under the Payment Card Industry Data Security Standard (PCI DSS). Because card data is captured entirely on the payment service provider’s own encrypted page and never enters our systems, our own environment is out of scope for card data storage — there is no card data here to protect.

The provider is responsible for the security of the card capture page and of the card data itself, and holds the certification that goes with that responsibility.

How this site is secured

• The whole site is served over HTTPS, with HTTP Strict Transport Security enabled so a browser will not fall back to an unencrypted connection.
• Security response headers are set on every response: content type sniffing is disabled, framing is restricted to this origin, and the referrer policy limits what is passed to other sites.
• Camera, microphone and geolocation are switched off for this site at the browser permission level. We never ask for any of them.
• Form endpoints are rate limited and every submission is validated against a strict schema on the server before anything is stored.
• We do not run third-party advertising or tracking scripts. See cookies.

What appears on your statement

The descriptor on your card statement identifies CALJOFRE - FABRICA DE CALÇADO LDA, the company that operates this store under the Lofra name. If you were expecting the trading name alone, that is why the two differ.

An unrecognised charge

Contact us before contacting your bank. Email support@caljofrecalcado.baby or call +351 255331566 with the date and amount. We can normally identify a charge the same day and refund it immediately if it should not have been taken.

A dispute raised with the bank first takes weeks to unwind and costs both sides more than a two-minute conversation would have.

Fraud checks

Payments are screened for fraud by our payment service provider before they are accepted. A payment may be declined by that screening or by your own issuer; when that happens no money moves and no order is created.

Where an order is flagged, we may ask you to confirm your details before we ship. We will never ask you for your full card number, your security code, or your online banking credentials — by email, by phone, or in any other way. If anyone claiming to be us asks for those, it is not us.

Refunds and reversals

Refunds go back to the card used for the original payment. We release them within 14 days of a withdrawal being notified, and immediately where we cancelled the order ourselves.

How long the money then takes to appear is your issuer’s timing, usually three to ten working days. Details and calculation of refunds are on shipping and returns.