Privacy Policy
Last updated: 13 October 2026 · Draft version, subject to legal review
This is an information website. It does not ask you to register, does not use cookies, does not use analytics or advertising tools and has no forms. This page explains which personal data may still be processed when you visit or contact us, and what your rights are.
This policy follows the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR), and Portuguese Law 58/2019 of 8 August, which implements it in Portugal. The Portuguese version of this policy prevails in case of discrepancy.
1. Data controller
- Organisation: managing body of the Local Natural Monument (name, tax number and address)
- General contact: geral@canhaocarsico.pt
- Data Protection Officer (DPO): name or role and email address
2. What data we process, why and for how long
| Situation | Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|---|
| Visiting the website | IP address, date and time, page requested, browser and operating system, referring page | Technical operation and security of the website (server logs) | Art. 6(1)(e), performance of a task in the public interest, or Art. 6(1)(f), legitimate interests, depending on the nature of the managing body | Up to 30 days, unless there is a security incident |
| Contact by email | Name, email address and whatever you choose to include in your message | Answering enquiries | Art. 6(1)(e), or Art. 6(1)(b) where steps are taken at your request | As long as needed to handle your request and up to 1 year afterwards |
| Booking school visits | Name and contact details of the person responsible, school, number of participants and preferred date | Organising and confirming the visit | Art. 6(1)(b), steps taken at your request | Until the end of the school year of the visit (to be confirmed) |
| Reporting incidents (damage, litter, hazards) | Email address and, if you send them, photographs and location | Protecting and managing the Local Natural Monument | Art. 6(1)(e), performance of a task in the public interest | Until the incident is resolved and up to 2 years for record-keeping |
We do not ask for or process special categories of data (such as health data). Please do not include them in your messages.
3. Cookies
This website does not set cookies for visitors, or use similar technologies (such as browser local storage) to identify or track them, which is why it shows no cookie banner. The restricted management area (backoffice), used only by staff, uses strictly necessary session cookies for sign-in. If this changes, for example if visitor statistics are introduced, this policy will be updated and your consent will be requested wherever the law requires it.
4. Third-party services used by the website
The typefaces and the interactive map library are served by the website itself, without external services. Only in the cases below does your browser connect directly to another service; when it does, the provider technically receives your IP address and browser details and processes them under its own privacy policy.
- OpenStreetMap (OpenStreetMap Foundation, United Kingdom): map background images, only on pages with a map. The United Kingdom benefits from a European Commission adequacy decision. OSMF policy.
- Google Maps: only if you click "Open in Google Maps". From then on you are on Google's website and Google's policy applies.
Email links open your own email program; nothing is sent unless you send it yourself.
5. Who we share data with
We do not sell or hand over personal data for commercial purposes. Data may be processed on our behalf, under contractual safeguards (Art. 28 GDPR), by:
- the website hosting provider: name and country;
- the storage provider for the website's images and documents (Wasabi Technologies): storage region;
- the email service provider: name and country.
The website's texts (editorial content) may be machine-translated into English using OpenAI. That service only receives published content, never personal data about visitors or people who contact us.
Data may also be disclosed to public authorities where required by law.
6. Your rights
Under Articles 15 to 22 of the GDPR, you may at any time:
- find out whether we process your data and obtain a copy (right of access);
- have inaccurate or incomplete data corrected (rectification);
- ask us to delete it where there is no reason to keep it (erasure);
- ask us to temporarily suspend its processing (restriction);
- receive the data you gave us in a commonly used format (portability, where applicable);
- object to processing based on public or legitimate interests (objection).
To exercise these rights, write to the DPO's email address or to geral@canhaocarsico.pt. We will reply within one month, which may be extended by two further months for complex requests, as provided in Article 12 of the GDPR. Exercising your rights is free of charge. We may ask you to confirm your identity.
7. Complaints
If you believe your data has not been processed lawfully, you may lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or with the supervisory authority of your country of residence. We would appreciate the chance to resolve the matter first.
8. Security
The website is served over an encrypted connection (HTTPS) (to be confirmed with the hosting provider). Access to server logs and to messages received is limited to the people who need them for the purposes above.
9. Children
The website is not intended to collect data from children. School visits should be booked by a teacher or responsible adult.
10. Changes to this policy
This policy may be updated, for example if the website starts using new services. The date of the last update is always shown at the top of this page.