1. Who we are
This Privacy Policy explains how Go.LisbonGuide.org ("we", "us", "our"), operating the website go.lisbonguide.org (the "Site"), collects, uses and protects your personal data when you visit or interact with the Site.
We act as the data controller for the personal data described in this policy, in the sense of Article 4(7) of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Portuguese Data Protection Act (Lei n.º 58/2019).
2. What data we collect
- Usage data automatically collected when you browse the Site: IP address (truncated where possible), browser type and version, device type, operating system, referring URL, pages viewed, date/time of access and approximate location (country/region).
- Account data if you sign in to administrative areas: email address, hashed password and role.
- Communications if you contact us: your name, email and the contents of your message.
- Cookies and similar technologies: see our Cookie & GDPR Policy.
3. How we use your data and legal basis
- To operate and secure the Site — legitimate interest (Art. 6(1)(f) GDPR).
- To respond to your enquiries — performance of pre-contractual measures or legitimate interest (Art. 6(1)(b) / (f) GDPR).
- To produce aggregated analytics — consent for non-essential cookies (Art. 6(1)(a) GDPR).
- To comply with legal obligations — Art. 6(1)(c) GDPR.
4. Sharing your data
We do not sell your personal data. We share it only with:
- Hosting and infrastructure providers acting as data processors under written contracts.
- Analytics providers, where consent has been given.
- Authorities, where required by law or to protect our legal rights.
5. International transfers
Some of our processors are located outside the European Economic Area. Where this happens, we rely on Standard Contractual Clauses approved by the European Commission or other safeguards permitted under Chapter V GDPR.
6. How long we keep your data
We keep personal data only for as long as necessary for the purposes described above, or as required by law. Server logs are typically retained for up to 12 months. Account data is kept while the account is active and deleted on request.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Request rectification of inaccurate data;
- Request erasure ("right to be forgotten");
- Restrict or object to processing;
- Data portability;
- Withdraw consent at any time, without affecting prior lawful processing;
- Lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.
8. Security
We apply appropriate technical and organisational measures to protect personal data, including TLS encryption in transit, access controls, hashed credentials and regular review of our processors.
9. Children
The Site is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
10. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page reflects the latest revision.
11. Contact
For privacy questions or to exercise your rights, contact us at privacy@lisbonguide.org.