A carregar…
Legal information
Last updated 17 September 2026
The controller is the Associação Académica de Coimbra (AAC), legal person no. 500032173, which organises Festa das Latas e Imposição de Insígnias, with its registered office at Rua Padre António Vieira, S/N, 3000-315 Coimbra (Edifício Sede da AAC), Portugal.
For any question about your data, or to exercise your rights, write to geral@festadaslatas.pt.
We only ask for what we need to reply to you and to hand over orders. We do not sell or share your data, there is no advertising, there are no embedded social networks and we use no analytics or profiling tools. Typefaces are served from this site and not from third-party servers. The only exception is the anti-bot check on the forms, explained below.
Contact form: name, email, subject and message, with the date sent and the language of the page you wrote it on (the reply comes back in that language). If the Committee answers from the panel, the reply is kept with the message, with the name of whoever wrote it, so the team knows it has been answered. They are used to reply to you. Basis: our legitimate interest in answering those who write to us and, when the message is about a purchase, pre-contractual steps (article 6(1)(f) and (b) GDPR). A message is deleted after 12 months, and the site keeps at most the 500 most recent: whichever comes first. When you send a message, you get a notice at the email you gave that it arrived. That notice does not repeat the name or the message you wrote.
Shop orders: name, email, phone (if you give it), tax number (if you give it), items ordered with colour, size and personalisation, value, where and on which day you chose to collect, the collection code and QR code, the date the order was handed over, the order status and the payment status (the method used and the identifiers Stripe returns to us). They are used to prepare and hand over the order and for accounting records. Basis: performance of the contract and compliance with legal obligations (article 6(1)(b) and (c)). Retention, in two stages. A paid order is two things at once: it is your contact details and it is the record of a sale, and the law treats them differently. After 24 months the order is anonymised: we delete the name, the email, the phone, the tax number, the name you asked to have printed, the logo file and the QR code, and from then on the line points to nobody. What remains is the sale: the code, the date, the items with colour, size and prices, the totals and the VAT. The record of a sale has a ten-year retention period, set by tax and commercial law (article 52 of the VAT Code, article 123 of the Corporate Income Tax Code and article 40 of the Commercial Code), and it is after those 10 years that the line disappears for good. The site keeps at most the 2000 most recent orders. Invoicing documents are a different matter: they are the AAC's, they live elsewhere and they meet the tax deadline on their own. Your card details never pass through this site: they are collected directly by Stripe, in Stripe's own form. An order that is never paid is deleted 30 days later.
Images for printing: when you choose an item with a logo of your choice, the file you upload is stored, with its original name, so the Committee knows what to print. The metadata is stripped on arrival: a photo taken on a phone carries the coordinates of where it was taken, the device model and the time, and none of that is needed to print anything. The image itself is left untouched. Basis: performance of the contract. Images that never become part of an order are deleted after 48 hours; those belonging to an order are deleted with the order, or at 24 months when it is anonymised, whichever comes first. They are not public: they open only with an administrator session.
IP address: the endpoints that receive forms count submissions per address to stop abuse. That count lives only in the server's memory and disappears when it restarts: it is not written to disk and is not linked to your messages. The exception is signing in to the management area, which goes into the activity log described below. Basis: legitimate interest in keeping the site secure.
Hosting logs: the server running the site may log accesses (address, date and page requested) for operation and security.
Management area activity log: the site records what members of the Organising Committee do in the management area (who, when, what, and the IP address they did it from), and also refused sign-in attempts, with the email that was typed. It is a log about who administers the site, not about who visits it: the data of people who write or buy does not go into it. An order is identified by its code (ENC-001) and a message by its subject, with no name and no address. The exception is deleting a newsletter subscriber at their request: there the log keeps the address that left the list, because that line is the proof the request was carried out. Basis: legitimate interest in keeping the site secure and the duty to be able to demonstrate how we handle data (article 5(2) and article 6(1)(f) GDPR). The IP address is deleted after 30 days and each log line after 180 days.
Anti-bot check: the contact, newsletter, shop logo upload and management sign-in forms use Turnstile, from Cloudflare, Inc. (USA), to tell people apart from automated programs. On pages with one of those forms in sight, your browser loads Turnstile from Cloudflare's servers as the page opens. The newsletter form sits in the footer of every page, but there Turnstile is only loaded once you start using that form: on a page you scroll through without touching it, Cloudflare never learns you were here. Once it loads, Cloudflare receives your IP address, along with technical information about your browser and device, to run that check. It is not used for advertising or to follow you across sites. Basis: legitimate interest in protecting the forms against abuse (article 6(1)(f)). Cloudflare handles this data under its own privacy policy: cloudflare.com/privacypolicy.
Newsletter: the email you give, the language you subscribed in, the subscription status and the dates of the request, confirmation and cancellation. They are used to send you the festival's news. You only start receiving it after clicking the confirmation link we send you, and a request not confirmed within 48 hours is discarded. Basis: your consent (article 6(1)(a)), which you can withdraw at any time through the unsubscribe link in every email. After you unsubscribe, the address is marked as removed and receives nothing more; if you want it deleted, ask us.
Only members of the Organising Committee with an administrator session. We do not sell, rent or hand over data for marketing purposes. We may have to disclose data to public authorities where the law requires it.
Four companies process data on our behalf, and these are they:
Google translates the site's texts into the other languages, at the Committee's request. Those are texts written by us (news, item descriptions), never data about anyone who visits.
The site is hosted in Germany and the payment is handled by an Irish company: in those two, the data does not leave the European Union.
Cloudflare and Microsoft are headquartered in the United States, and so is Google: what is sent to them may be processed there or in other countries outside the EU. Those transfers are made under the European Commission's adequacy decision for the United States (the Data Privacy Framework) and, where that does not reach, under the standard contractual clauses approved by the Commission, in accordance with articles 45 and 46 GDPR.
You may ask us at any time for access to your data, correction of anything wrong, erasure, restriction of processing, objection to processing based on legitimate interest, and portability: receiving the data you gave us in an open format. Write to geral@festadaslatas.pt; we reply within one month.
If you believe we have not handled your data properly you may complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (cnpd.pt).
The site uses very few and none of them track you. They are all explained in the Cookie Policy.
If you are under 13, do not use the forms on this site without permission from whoever holds parental responsibility (article 16 of Portuguese Law no. 58/2019).
Access to the management area requires a password and the session lives in a signed cookie that scripts cannot read. Requests that change data are only accepted when they come from the site itself, and public forms have submission limits. Even so, no system is infallible: should there be a breach that puts your data at risk, we comply with the notification duties set out in the GDPR.
This policy may be updated. The date above says when it last changed.