Privacy policy

Controller and contact

The identity of the entity responsible for the project has not yet been defined. This information will be updated when the entity is identified.

Contact for privacy matters: geral@planifesta.pt.

Data we receive

Access requests include the entity type (band or committee), contact name, organisation name, email, optional phone number and message. The platform also uses session information and technical logs needed for security. Authorised accounts process information entered to organise festivals and bands.

Purposes and legal basis

We use the data to review and answer access requests and prepare a possible service at your request. The legal basis is taking pre-contractual steps and, where you represent an organisation, the legitimate interest in managing that contact. Security relies on the legitimate interest in protecting the service. Optional analytics relies on consent, which can be withdrawn. This form does not subscribe you to marketing lists.

Recipients and service providers

Requests are emailed to the team responsible for review. Hosting and email providers may process information as needed to operate the service. We do not sell personal data. If analytics is configured and accepted, Google receives usage data from public pages; we do not send form fields or private-area data to Google.

Retention

Requests are handled in the team’s mailbox. They are kept only as long as needed to review, respond and resolve related questions, or as required to meet legal obligations or defend rights. If an account is created, the necessary data is then processed within the service relationship. Cookie preferences expire after 180 days. Other records are retained according to their purpose and applicable obligations.

Your rights

You may request access, rectification, erasure, restriction, objection or portability where legally applicable, using the contact above. You can withdraw analytics consent in “Cookie settings” without affecting prior processing. You may lodge a complaint with the CNPD or the competent supervisory authority. Access requests are reviewed by people, without solely automated decisions.

Transfers and external services

Some providers, including Google when used with consent, may process data outside the European Economic Area. The controller must verify destinations and applicable safeguards, including adequacy decisions or standard contractual clauses, before activating those services. You may request information about providers actually used through the privacy contact.

Support and suggestions

When you report an issue or suggest a feature, we store the type, subject, description, date, portal and your account identity. The administration team uses this information to respond and improve the service. Do not include passwords or sensitive data. Records are retained as needed to handle and follow up the request or meet applicable obligations.