Privacy and Data Protection Policy

The iPorto, Agenda Metropolitana da Cultura (iPorto, Metropolitan Culture Calendar) is an initiative of the Porto Metropolitan Area (AMP), created within the framework of a territorial development and cooperation strategy.

As responsible for the processing and protection of personal data, the Porto Metropolitan Area (AMP) complies with the legislation in force on data protection, namely with the General Data Protection Regulation (GDPR) approved by the Regulation (EU) 2016/679 of 27 April 2016.

Therefore, the AMP commits to guarantee the protection of all personal data received. The AMP adopted several safety technical and organisational measures to protect your personal data against any illicit processing.

Each time you use this website or whenever you otherwise interact with the AMP, the personal data transmitted will be processed in accordance with the Privacy and Data Protection Policy in force at that time.

  1. Responsibility for the Treatment of Your Personal Data

The Porto Metropolitan Area, hereinafter AMP, NIPC 502 823 305, headquartered at Palácio dos Correios – Rua do Estêvão, 21, 4000-200 Porto, is responsible for processing your personal data.

The AMP processes several categories of personal data according to the different purposes, particularly collecting the following:

a) Personal identifiable information.

b) Contact date.

c) Data arising from claims/requests for the exercise of one’s rights.

d) Demographic data.

  1. Purpose of Data Processing

The AMP may process your personal data for the following purposes:

a) Spread of information about and registration for cultural activities, conferences, colloquiums, seminars, workshops and other events taking place within the Porto metropolitan area or related to the AMP.

b) Distribution of newsletters on cultural activities taking place within the Porto metropolitan area or related to the AMP. Users may cancel their email newsletter subscription by clicking on the newsletter’s unsubscribe link.

c) Surveys conducted within the scope of AMP’sduties.

d) Answer to contact requests.

  1. Lawful Data Processing

The AMP will process your personal data only when there is a legal basis that legitimises its processing, namely:

a) Pre-contractual matters and execution of a contract: the AMP may process your personal data if it is found necessary for the execution of a contract to which you are a party.

b) Legal obligation: the AMP may process your data if it proves necessary for the fulfilment of legal obligations to which it is bound.

c) Public interest or public authority: AMP may process your data while holding public interest or public authority functions with which it may be vested.

d) Legitimate interest: your data may be processed based on AMP’s legitimate interest, provided that such interests do not override your fundamental rights and freedoms.

e) Consent: AMP may process your data upon obtaining your consent.

f) Defence of vital interests: AMP may also process your personal data whenever this proves necessary and essential for the protection of your life.

  1. Sharing Personal Data

The AMP ensures that, whenever third parties are involved, these entities will comply with their obligations regarding privacy and protection of personal data.

The AMP may also communicate your personal data when obliged by law, in the context of judicial proceedings or as part of investigations carried out by competent authorities.

The AMP will not make international transfers of your data to a third country or international organisation outside the European Union.

  1. Data Storage

Your personal data may be stored for hosting and back-up in servers located in Portugal that are in a secure environment, protected from unauthorised access.

  1. Rights of Data Subjects

The AMP shall respect the confidentiality of your personal information and guarantee the exercise of your rights in accordance with applicable legislation, namely:

a) Right to information: you have the right to obtain clear, transparent and understandable information on the way the AMP handles your personal data.

b) Right of access: in addition to the right to information, you can access your personal data and confirm whether they are being processed, as well as request a copy of them.

c) Right to rectification: you have the right to rectify your personal data if they are inaccurate, outdated or incomplete.

d) Right to erasure: you can ask us to delete your data. However, you should bear in mind that this is not an absolute right, as the AMP may have legal grounds or other legitimate interests to keep your personal data.

e) Right to object: on grounds relating to your situation, you may object to certain processing operations based on a legitimate interest or public interest of the AMP or third parties, at any time of their processing. It should be borne in mind that the AMP may continue to process such data if it can demonstrate “compelling legitimate grounds for the processing which override your interests, rights and freedoms” or if such data are necessary for the establishment, exercise or defence of legal claims. You can delete the subscription to the AMP newsletter or choose to be removed from its direct communications at any time. The easiest way to do this is by clicking on the link that allows you to remove any email or communication sent, but you can also email the AMP on this subject at dpo@amp.pt.

f) Right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority: if you consider that the processing of your personal data violates the applicable data protection legislation, you can file a complaint with the CNPD.

g) Right to data portability: you have the right to move, copy or transfer your personal data from the AMP database to another, in a commonly used structured format, provided that the processing is based on your consent or on a contract to which you are a party and is carried out by automated means.

h) Right to restriction of processing: you have the right to request the restriction of the processing of your data in the following situations:

  • If you contest the accuracy of the data.
  • If the processing is unlawful and you do not want to erase your data, but only restrict their use.
  • If the data is no longer required by the AMP, but it is needed by the user.
  • If you have exercised your right to object, during the period in which the AMP examines whether your legitimate interests for processing prevail over that right.

To request the exercise of any of the rights listed above, you may:

  • Address a written communication to the AMP with the following data:
    • Subject: Exercise of Rights – Protection of Personal Data
    • Att.: DPO Área Metropolitana do Porto
    • Address: Palácio dos Correios – Rua do Estêvão, 21 – 4000-200 Porto.
  • Send an email to dpo@amp.pt.
  1. Storage Period

The AMP will keep your personal data only for the time necessary to achieve the purpose for which they were collected.

The AMP may also retain some of your personal data to the necessary extent to comply with its legal obligations, as well as to manage or enforce your rights, namely for legal proceedings.

Upon expiry of the above-mentioned storage periods, personal data will be deleted from the AMP databases in a secure manner, regardless of any support.

  1. Data Protection Officer

As a public entity and to comply with the applicable legislation on privacy and data protection, the AMP has appointed a Personal Data Protection Officer, whose functions are:

a) To control the compliance of personal data processing operations with the applicable legislation in force.

b) To provide advice to the AMP on privacy and protection of personal data.

c) To cooperate with the Comissão Nacional de Proteção de Dados– CNPD.

d) To establish a contact point with the CNPD, the Supervisory Authorities of the other Member States, and the personal data subjects. 

You can email the AMP’s Data Protection Officer at dpo@amp.pt.

  1. Security Measures

The AMP ensures the implementation of appropriate and effective organisational technical measures to comply with data protection principles to guarantee the continued confidentiality, integrity, availability and resilience of its processing services.

The AMP adopts the necessary and appropriate technical, electronic and organisational procedures to certify the security of your Personal Data and to prevent its loss, misuse or access.

However, it is up to all users to make sure that the equipment they use is protected from harmful software, computer viruses and worms, as well as to confirm the secure configuration of their browser.

  1. Cookies

Cookies are used while browsing the iPorto, Agenda Metropolitana da Cultura’s website. For further information on how cookies are used, please refer to the Cookies Policy.

  1. Final provisions

The AMP reserves the right to modify this Policy at any time due to new legal or procedural requirements, as well as to ensure that it only treats the information indispensable to the provision or improvement of its services.

Whenever any change is made to this Privacy Policy, the user will be informed of the changes through this website.

The AMP adopts the appropriate procedures to ensure that users’ information is correct, complete and up to date, but it is up to the user to update or correct his personal information when necessary.