Last updated: [DATE TO BE FILLED IN]
1. Data Controller
The data controller for your personal data is the Portuguese Council of the European Movement (CPME), with its registered office at Largo Jean Monnet no. 1, 6th floor, 1269-070 Lisbon, which can be contacted via the email address geral@movimento-europeu.eu.
No Data Protection Officer (DPO) has been appointed, as the CPME does not meet the mandatory criteria set out in Article 37 of the GDPR. For any queries regarding data protection, please contact the data controller at the address given above.
2. Data Collected and Purposes of Processing
2.1 Membership Application Form
Data collected: full name, address, date of birth, email address, mobile/telephone number, tax identification number, profession or area of interest, consent to receive communications, authorisation for use of image.
Purpose: management of the membership relationship, communication with members, issuing receipts and compliance with statutory obligations.
Legal basis: performance of a contract (association’s articles of association) — Article 6(1)(b) of the GDPR; and consent — Article 6(1)(a) of the GDPR (for marketing communications and use of images).
Retention period: [PERIOD TO BE DETERMINED] from the date of termination of membership, or for as long as necessary to comply with legal obligations.
2.2 Contact Form
Data collected: name, email address, subject and message.
Purpose: to respond to questions and requests submitted.
Legal basis: legitimate interests of the CPME and the data subject — Article 6(1)(f) of the GDPR.
Retention period: 365 days from the date of submission, after which the data is automatically deleted.
2.3 Newsletter (Mailchimp)
Data collected: email address.
Purpose: to send a newsletter containing news, events and initiatives from the CPME.
Legal basis: consent — Article 6(1)(a) and Article 7 of the GDPR. Consent is obtained via double opt-in and may be withdrawn at any time by using the unsubscribe link included in each communication or by contacting us at the address provided in section 1.
Retention period: until the subscription is cancelled or [PERIOD TO BE DETERMINED] following inactivity.
2.4 Website Analytics (Matomo)
Data collected: IP address (anonymised prior to storage), device and browser type, pages visited, duration of visit, source of visit.
Purpose: statistical analysis of website usage, with a view to improving the site.
Legal basis: consent — Article 6(1)(a) of the GDPR and Article 13-A of Law No. 41/2004. The Matomo tool is self-hosted and tracking is only activated once your consent has been obtained via our cookie banner.
Retention period: [PERIOD TO BE DETERMINED].
3. Recipients and Processors
Your data may be transferred to the following data processors and recipients:
- Hostinger (web hosting): the website data, including submitted forms, is hosted on servers belonging to Hostinger, UAB, based in Lithuania (EU). Processing takes place within the European Economic Area.
- Google (Google Apps Script / Google Sheets): membership application data is automatically sent to a Google Sheets spreadsheet, managed by the CPME, for association management purposes. Google LLC is headquartered in the USA. The transfer is carried out under the EU-US Data Privacy Framework (DPF), approved by the European Commission’s Adequacy Decision of 10 July 2023, and/or Standard Contractual Clauses (SCCs). [REQUIRES LEGAL VALIDATION — confirm transfer mechanism and existence of a DPA]
- Mailchimp (The Rocket Science Group, LLC): email addresses subscribed to the newsletter are transferred to Mailchimp for the purpose of sending communications. Mailchimp is headquartered in the USA and the transfer is carried out under the EU-US Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs). [REQUIRES LEGAL VALIDATION — confirm transfer mechanism and existence of DPA]
- Matomo: a self-hosted statistical analysis tool. The data is processed exclusively on CPME’s hosting servers (Hostinger, EU).
Data is not sold, disclosed or transferred to third parties for commercial purposes.
4. International Data Transfers
As described in the previous section, some processing operations involve transfers of personal data to the United States of America (Google, Mailchimp). These transfers are carried out using appropriate legal mechanisms, namely the EU-US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission, in accordance with Chapter V of the GDPR.
5. Data Subjects’ Rights
Under the GDPR, you have the right to:
- Access (Article 15): to obtain confirmation as to whether your personal data are being processed and, if so, to access them;
- Rectification (Article 16.): to request the correction of inaccurate or incomplete data;
- Erasure (Article 17): to request the erasure of your data when it is no longer necessary for the purposes for which it was collected, or when you withdraw your consent;
- Restriction of processing (Article 18): to request the suspension of processing in certain circumstances;
- Data portability (Article 20): to receive your data in a structured, machine-readable format;
- Objection (Article 21): to object to the processing of your data, in particular for direct marketing purposes;
- Withdraw consent at any time, without this affecting the lawfulness of processing carried out on the basis of consent previously given.
To exercise any of these rights, please send a written request to geral@movimento-europeu.eu, identifying yourself and specifying the right you wish to exercise. We will respond within a maximum of 30 days.
You also have the right to lodge a complaint with the national supervisory authority, the National Data Protection Commission (CNPD), via the website www.cnpd.pt.
6. Data Security
CPME adopts appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss or destruction, namely: secure HTTPS connection, access control, limitation of authentication attempts and hosting on secure infrastructure.
7. Changes to This Policy
This Privacy Policy may be updated from time to time. The date of the last update is indicated at the top of the document. In the event of significant changes, we will inform data subjects via the available contact details.
For any further enquiries, please contact us at geral@movimento-europeu.eu.