Privacy and personal data protection policy

1. Introduction

The protection of personal data is a priority for Ágora – Cultura e Desporto do Porto, EM, S.A. (hereinafter referred to as “Ágora”). This Privacy and Personal Data Protection Policy explains what personal data is collected, the purposes for which it is used, the principles governing the use of such data, and the rights of data subjects.

Ágora is a local municipal company endowed with statutory, administrative, and financial autonomy. It was established on September 29, 2006 (then as Porto Lazer E.M.), and its share capital is fully owned by the Municipality of Porto, under the terms of the Legal Framework for Local Business Activity and Local Holdings.

Its corporate purpose is to promote and develop culture, physical activity, and sports, as well as other entertainment activities for the city and the promotion and development of brands associated with the city of Porto, in addition to activities determined by the management of the spaces and equipment under its administration.

2. Scope

This policy applies to all persons who have any connection whatsoever with Ágora.

3. Data controller

As the data controller responsible for the personal data entrusted to it, Ágora:

• Ensures that personal data is processed solely for the purposes for which it was collected or for compatible purposes;
• Is committed to a culture of data minimisation, whereby only the necessary personal data is collected, used and retained;
• Ensures that it does not disclose or share personal data for commercial or advertising purposes.

4. Personal data collected and purposes

Ágora collects and processes only the personal data strictly necessary for the conduct of its activities and the provision of the services entrusted to it.

Categories of Personal Data and Purposes of Processing

The personal data processed varies depending on the nature of the relationship established with Ágora and may include, in particular, identification details, contact details, professional details, bank and billing details, images, voice recordings and other data necessary to fulfil the specific purposes of each activity or service.

Depending on the context, Ágora may process personal data for the following purposes:

• Management of registrations, applications, bookings, participation and use of services, programmes, activities and equipment;
• Management of contractual, administrative, financial and billing relationships;
• Human resources management, recruitment and selection;
• Compliance with legal, regulatory and public interest obligations;
• Institutional communication and the promotion of activities, initiatives and events organised by Ágora;
• Customer service, and the management of requests, complaints, suggestions and enquiries;
• Ensuring the safety of people and property;
• Management and maintenance of information systems, digital platforms and communication channels;
• Exercising and defending Ágora’s rights in legal, administrative or similar proceedings.

The personal data collected is adequate, relevant and limited to what is necessary for each specific purpose, in accordance with the principle of data minimisation set out in the General Data Protection Regulation.

Ágora may also use previously anonymised information, generated in the course of its activities, for statistical purposes, evaluation, the improvement of its services and the development of new features.

Images and Videos

As part of its activities, events and initiatives, Ágora may capture and use images and videos for the purposes of communication, institutional publicity and the promotion of its activities through its communication channels.

These images will be used in a manner that respects the rights of data subjects and complies with applicable legislation.

CCTV

Ágora operates CCTV systems at some of its premises and facilities, in accordance with applicable legislation.

The purpose of recording images is to protect people and property and to ensure the security of the premises; the data is processed solely for these purposes and retained for the periods prescribed by law.

5. Legal basis for processing

The processing of personal data carried out by Ágora is based, depending on the circumstances, on the following legal bases:

• The performance of tasks carried out in the public interest;
• The performance of a contract or pre-contractual measures;
• Compliance with legal obligations to which Ágora is subject;
• Consent of the data subject, where required or applicable;
• Legitimate interests pursued by Ágora or by third parties, provided that the fundamental rights and freedoms of the data subjects do not take precedence.

Where processing is based on consent, the data subject may withdraw their consent at any time, without affecting the lawfulness of the processing carried out up to that point.

6. Personal data of minors

The collection and processing of personal data relating to minors shall only take place with the consent of those with parental responsibility, except in situations provided for by law. These responsible persons may exercise rights in relation to the minors’ personal data under conditions similar to those applicable to data subjects.

7. Processing of special categories of data

Data considered sensitive under the GDPR, such as health information, is afforded additional protection. Ágora only collects such data where strictly necessary and in accordance with specific safeguards.

8. Sharing of personal data

Ágora will only share your personal data with third parties in the performance of public interest functions or in the exercise of public authority, in strict compliance with legal obligations, or with the data subject’s consent.

9. Security of personal data

Ágora uses technologies and security measures to protect personal data against unauthorized access, use, or disclosure.

10. Rights of data subjects

Data subjects have the right to:

• Be informed clearly and transparently about the processing of their data;
• Access the data relating to them;
• Request the rectification of incorrect, incomplete or inaccurate data;
• Object to the processing of their data (subject to legal exceptions);
• Request the restriction of processing to specific categories;
• Request the erasure of data (‘right to be forgotten’), except where there are legal grounds for its retention;
• Withdraw consent, without affecting the lawfulness of previous processing;
• Request the portability of their data to another organisation, where technically feasible;
• Lodge a complaint with the National Data Protection Commission (CNPD).

11. Retention of personal data

Personal data is retained for the period necessary to fulfil the purposes for which it was collected. Where justified, retention periods may be extended for archiving purposes in the public interest, or for historical, scientific or statistical purposes, whilst always complying with appropriate security measures.

In determining the appropriate retention period, Ágora takes into account the various rulings of European data protection supervisory authorities, in particular the CNPD, and the Archival Regulation for Local Authorities (Ministerial Order No. 112/2023 of 27 April).

Data will be deleted as soon as it is no longer necessary for the specified purpose(s) or when consent is withdrawn.

12. Cookies and similar technologies

Ágora uses cookies (small text files that a website places on your computer or mobile device via your web browser when you visit it) to provide our websites and online services, to help collect data and save your settings, in order to improve our performance and your user experience.

13. Social media

• Facebook: facebook.com/agoraporto2019
• Instagram: instagram.com/agoraporto
• YouTube: youtube.com/agoraporto
• LinkedIn: linkedin.com/company/agoraporto

14. Contact details

For further information on Ágora’s privacy and personal data protection practices, as well as to exercise your rights as a data subject, please contact the Data Protection Officer by email at dpo@agoraporto.pt.

15. Changes to the privacy policy

This privacy policy will be updated regularly, whenever necessary.

We recommend that you consult the privacy and personal data protection policy from time to time to stay informed about how Ágora is protecting your personal data and to keep up to date with the information and rights to which you are entitled.

Suggestions for improvement may be sent via email to dpo@agoraporto.pt.