Privacy Policy

This Privacy Policy is prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and Law No. 58/2019 of 8 August, which ensures the implementation of the GDPR in Portugal. It explains how Associação Anastomosis ("we", "us", "the association") collects, uses, and protects your personal data when you visit our website, contact us, or take part in our activities.

Where processing depends on your consent, you may withdraw it at any time, free of charge, by contacting us at the e-mail address indicated in section 1. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Who we are

Data controller: Associação Anastomosis

Registered office: Rua Doutor Freitas Ribeiro 28, 2665-015 Livramento, Portugal

Taxpayer number (NIF): 518089347

Data Protection Officer: having assessed the nature, scale, and context of its processing activities against the criteria in Article 37 GDPR, the association has concluded that it is not required to appoint a formal Data Protection Officer. This assessment is documented internally and reviewed periodically. The contact address above is our designated point of contact for all data protection matters.

2. What personal data we collect

Depending on how you interact with us, we may collect:

Identification and contact data: first and last name, e-mail address, landline and/or mobile phone number;
Information you provide voluntarily through contact forms, visit requests, admissions, or volunteering enquiries;
Technical data: browser type, IP address, approximate location and time zone, collected when you visit our website;
Cookie and similar-technology identifiers, as described in section 5 and in our separate Cookie Policy;
Images and/or video/audio recordings taken during activities, workshops, visits, or community events;
Where applicable, data relating to minors, provided by a parent or legal guardian, or collected with the appropriate consent required by law.

We do not knowingly collect special categories of data (Article 9 GDPR) unless voluntarily shared by you and necessary for a specific purpose (for example, health information relevant to a visit or activity), in which case we will seek your explicit consent or rely on another applicable legal basis.

3. Why we process your data and on what legal basis

The table below summarises our main processing purposes, the categories of data involved, and the legal basis relied upon under Article 6(1) GDPR.

Where we rely on our legitimate interest (Article 6(1)(f)), we have carried out a balancing assessment to confirm that this interest is not overridden by your rights and freedoms; you may request further information about this assessment or object to this processing at any time (see section 6).

Providing certain data is necessary for us to respond to your request or provide a service; where this is the case, we will indicate it at the point of collection. Failure to provide such data may prevent us from responding to your request.

4. Minors, images, and video

Where activities, visits, workshops, or volunteering opportunities involve minors, personal data relating to children is provided only by a parent or legal guardian or is otherwise processed only where a valid legal basis (such as guardian consent) applies.

Photographs, videos, or audio recordings may be taken during our activities for communication and dissemination purposes, including publication on our website or social media. Before any such recording is published, we obtain specific, informed consent from the data subject (or their parent/guardian, for minors), clearly explaining the channels of publication and how consent can later be withdrawn. Consent can be withdrawn at any time by contacting us; we will remove the content from channels under our direct control within a reasonable period, though we cannot guarantee removal from content already shared or cached by third parties (e.g. social media platforms, screenshots).

5. Cookies and similar technologies

Our website uses cookies and similar technologies to enable core functionality and, where you consent, to measure audience and improve navigation. Cookies that are not strictly necessary for the website to function are only placed after you have given your consent through our cookie banner.

a. The banner presents "Accept all" and "Reject all" options with equal visual prominence - rejecting is exactly as easy as accepting;

b. You can change or withdraw your cookie choices at any time through the cookie settings link available on every page;

c. We keep a record of consent choices to be able to demonstrate compliance if requested by the data subject or the supervisory authority.

Full details of each cookie used, its purpose, provider, and duration are set out in our separate Cookie Policy, available on our website.

6. Your rights

As a data subject, you have the right, at any time and free of charge (save for manifestly unfounded or excessive requests), to:

Request access to your personal data;
Request rectification of inaccurate or incomplete data;
Request erasure of your data, where applicable;
Request restriction of processing;
Object to processing based on legitimate interest, including profiling, and to direct marketing at any time;
Request portability of data you have provided to us, where processing is based on consent or contract and carried out by automated means;
Withdraw consent at any time, without affecting the lawfulness of prior processing;
Not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects (we confirm we do not currently carry out such automated decision-making);
Lodge a complaint with a supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt) — or with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement, without prejudice to any other administrative or judicial remedy.

You may exercise these rights by contacting us at the data protection e-mail address indicated in section 1. We will respond within one month of receiving your request, extendable by two further months for complex requests, in which case we will inform you of the extension and the reasons for it.

7. Recipients and international transfers

Your data may be shared with collaborators and service providers who act on our behalf for the purposes described in this policy — for example, website hosting, e-mail/communication tools, or administrative support services — under a data processing agreement compliant with Article 28 GDPR. We do not sell or transfer your personal data to third parties for their own commercial purposes.

8.How long we keep your data

We retain personal data only for as long as necessary for the purposes described in this policy, taking into account the following general periods:

Retention may be extended where necessary to comply with a legal obligation, or to establish, exercise, or defend legal claims. At the end of the applicable period, data is securely deleted or anonymised.

9. Security measures

We apply technical and organisational measures appropriate to the risk, including access controls, encryption in transit, staff confidentiality commitments, and hosting on servers located in Portugal maintained in accordance with applicable national and European security standards. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours and, where required, inform the affected data subjects without undue delay.

10. Changes to this policy

We may update this Privacy Policy periodically to reflect legal, regulatory, or operational changes. The version in force is always the one published on our website, together with its date of last revision.

This Privacy Policy was last reviewed on 06.07.2026.