Privacy Policy

In force from 11 September 2026.

This page sets out which of your data reaches us through opengateportugal.com, why we hold it, on what legal basis, how long it stays with us, and what you can ask of us at any point. We are a non-profit association. People come to us to join, to share what they know, or to support the work with money, and each of those routes leaves a different trace. They are set out one by one below rather than swept into a single sentence.

1. Who is responsible for your data

opengateportugal.com is owned and run by Synthesis Open Gate Portugal Association.

Legal details: SYNTHESIS OPEN GATE PORTUGAL ASSOCIAÇÃO, NIPC 518248941, legal form associação (a non-profit association under Portuguese law), constituted on 27 June 2024, registered address: Rua Pedro Hispano, Número 11, 3º esq.º, 2790-250 Carnaxide, Oeiras, Portugal.

The Association is the data controller (responsável pelo tratamento) within the meaning of the General Data Protection Regulation (GDPR) and of Lei n.º 58/2019, the Portuguese act that implements it.

Anything about your data, withdrawal of consent, and any of the requests in section 16: info@opengateportugal.com. We read every message and we answer every message.

We have not appointed a data protection officer (encarregado de proteção de dados). Our assessment is that article 37 GDPR does not require one of us: we are not a public authority, we do not monitor people regularly and systematically on a large scale, and we do not process special categories of data on a large scale. Write to the address above.

2. This site and the rest of the ecosystem: whose data is whose

The Association sits inside the All Portugal ecosystem, alongside commercial projects: a media studio, a children's academy, an events venue, a festival, a business club. Those belong to a different legal entity, DESCOBRILANÇA UNIPESSOAL LDA, which runs its own sites under its own privacy policies.

This is not small print. Data you leave on opengateportugal.com is the Association's responsibility. Data you leave on the site of an event, the studio or the academy is the responsibility of whichever entity owns that site. We are related organisations with a founder in common and we say so openly, but we are not one legal person, and your rights are exercised against whoever actually holds your data.

If you are not sure where to write, write to us. We will point you to the right address rather than send you off to work it out.

3. What data reaches us, and by which route

We do not buy contact lists and we do not gather information about you elsewhere. Everything we hold, you gave us. Here is the full set of routes.

Membership application form. Name, email address, phone number, what you do and something about yourself, why you want to join, and the box confirming you have read this policy.

Expert application form. Name, contact details, professional field, experience, education, links to your work and profiles, a photograph if you attached one, and whatever you wrote about yourself.

"Submit material" form. Your name, your contact details, and the file or text itself. Note that material you send may contain other people's data, and that is your responsibility, see section 9.

Newsletter subscription. Email address, name if you gave one, the date you subscribed and the date you unsubscribed.

Contact form and contact index form. Name, email address, phone number if you gave one, and the text of your message.

Form Business, Form of integration, Form Education. Name, contact details, information about the organisation or the area you are writing about, and the content of your proposal or question.

Donations. Name, email address, amount, currency, date, transaction reference and payment status. The full details of your card or bank account never reach us and are never stored by us: the payment service connected to this site handles them on its own systems.

Event registration. Name, contact details, the name and date of the event. Where taking part involves a contribution, payment information is added on the same terms as for a donation.

Member profiles. If you created an account on the site, it holds your email address, the name you registered under, and whatever you added to your profile yourself. Section 8 covers how visible that is.

Blog comments and knowledge base entries. Everything you posted publicly, under the name you posted it with.

Site chat. Your messages and our replies, with the date and time.

Technical data. IP address, browser type, pages opened. Section 14 and the Cookie Policy cover this.

4. Why we hold your data, and on what legal basis

Each purpose has its own basis, and the basis is what decides what you can demand of us. Where we rely on consent, you can withdraw it. Where we rely on legitimate interest, you can object. Where the law obliges us, neither applies, and it is fairer to say so upfront than to discover it later.

To consider your membership application and to run your membership. Basis: article 6(1)(b) GDPR, steps taken at your request before entering into a relationship, and then the membership relationship itself. Additionally article 6(1)(c) GDPR, to the extent that keeping a register of members and convening the general assembly are required by our statutes and by articles 170 to 175 of the Portuguese Civil Code (Código Civil).

To receive and account for your donation. Basis: article 6(1)(c) GDPR, compliance with a legal obligation. We have to record what comes in and keep the supporting documents. There is no discretion here, so we do not ask for consent we could not act on.

To send you our newsletter. Basis: article 6(1)(a) GDPR, consent. Only if you subscribed, and only until you unsubscribe. For messages to individuals, article 22 of Decreto-Lei n.º 7/2004 (the Portuguese e-commerce decree-law) sets the rule of prior consent.

To answer you. Basis: article 6(1)(f) GDPR, our legitimate interest in replying to people who write to us and in following a matter through without asking you the same thing twice. You may object under article 21 GDPR, and we will stop unless we have overriding legitimate grounds.

To review an expert application, a partnership proposal or submitted material. Basis: article 6(1)(f) GDPR, the same legitimate interest.

To publish an expert's profile card on the site. Basis: article 6(1)(a) GDPR, consent, withdrawable at any moment. See section 7.

To load non-essential cookies. Basis: article 6(1)(a) GDPR, consent given through the banner.

To keep a record of the choice you made in the banner. Basis: article 6(1)(c) GDPR. The duty to be able to demonstrate consent follows from article 7(1) GDPR and article 5 of Lei n.º 41/2004.

To protect the site and the people on it. Filtering spam, intrusion attempts and abuse. Basis: article 6(1)(f) GDPR.

We ask for consent exactly where consent is genuinely the basis, and we do not stage it where it is not.

5. Membership: what happens to your data

Filling in the form is an application, not an admission. The Association's governing body decides, and until it does, your form sits with us as an application.

If you are admitted, your details move into the register of members: name, contact details, date of admission, status, and a record of membership fees where those apply. The register exists so that the general assembly can be convened and the membership relationship can be run. Our statutes and the Portuguese Civil Code require it.

If you are not admitted, or no decision is taken, the application is kept for three years from the date you sent it and is then deleted.

If you leave the Association, the register entry is kept for a further three years after your membership ends, so that decisions of the general assembly you took part in can still be shown to have been properly taken. Accounting records of any fees are kept longer, see section 11. You come off the mailing list immediately unless you ask otherwise.

Only members of the Association's governing body have access to applications and to the register.

6. Donations

A donation is a voluntary contribution to the Association's work, given freely and with nothing given in return. The Terms and Conditions explain that it is not payment for goods or services and, as a general rule, is not refundable.

What we keep about a donor: name, email address, amount, currency, date, transaction reference and payment status. That is enough to account for the money, to confirm the payment if you ask, and to thank you.

What we do not keep: card number, expiry date, security code, bank account details. Those never reach us at all; the payment service handles them on its own systems.

We keep the accounting side and the communication side apart. The amount and the transaction reference live in our accounts for as long as tax law requires. The address we could write to lives under the ordinary three-year rule, or until you tell us to stop writing.

We do not publish donors' names and we do not pass them to anyone for their own mailings.

7. Expert profile cards

The site carries profile cards for specialists who take part in our work: name, professional field, a short description, sometimes a photograph and links.

Every card is published with the knowledge of the person concerned, from information that person sent us, and to the extent that person decided. We do not assemble profiles of experts from public sources, and we do not publish anything a person did not send us.

Publication rests on your consent, article 6(1)(a) GDPR. You can withdraw it at any moment, with no reason given, by writing to info@opengateportugal.com, and we take the card down. Withdrawal works forwards: it does not undo the fact that publication was lawful while the consent stood.

Correcting or changing a card works the same way, in one message. We do not think a form should stand between you and your own entry.

8. Member profiles and the public parts of the site

If you created an account, you have a member profile. As things stand today, member profiles on this site are open to view by default: the name you registered under and whatever you added to your profile can be seen by other visitors.

We say this plainly, because a default setting is the thing people find out about last, and finding out here is better than finding out by accident.

What you can do about it. Write to info@opengateportugal.com at any time and ask us to close your profile to outsiders or to delete it altogether. You can also strip the profile back yourself: the only compulsory part is what the account needs in order to work.

Separately, some things are public by their nature. Comments on the blog, posts in shared sections and material you publish in the knowledge base are visible to everyone and indexed by search engines. That is a property of the section, not a setting. Do not write there what you would not show a stranger.

9. Material you send us

Texts, images, presentations and recordings reach us through the "Submit material" form and through other forms.

We ask one thing of you: send only what you hold the rights to, and do not send other people's personal data without their knowledge. A photograph with faces in it, a participant list, a scanned document, someone else's correspondence: all of that is other people's data, and inside your file it arrives without any legal basis, because those people gave us nothing.

If you have already sent something like that, tell us. We would rather take it out before publication than after.

10. Newsletter

We write only to people who subscribed themselves. The consent box is not pre-ticked and is not folded into some other action.

Every message carries an unsubscribe link at the bottom. It works on one click and asks for no explanation. Afterwards your address stays on a short suppression list so that we do not write to you again by mistake. That list holds nothing but the address and the date.

A message confirming your donation or your event registration is not marketing and reaches you whether or not you subscribed.

11. How long we keep things

Data received through forms on the site, including contact details and the content of your message, is kept for three years from your last contact with us. Chat conversations follow the same rule.

Applications that were refused, or on which no decision was taken, are kept for three years from the date they were sent.

A published expert card is kept for as long as the consent to publish it stands.

The address our newsletter goes to is kept until you unsubscribe.

The record of your choice in the cookie banner is kept for three years.

Accounting and tax records, including information about donations and membership fees, must be kept for longer: Portuguese tax law requires this, under article 123(4) of the Corporate Income Tax Code (Código do IRC) and article 52 of the VAT Code (Código do IVA). Once the applicable period ends, the data is deleted or anonymised.

We deliberately do not state that period as a number. It has changed before, and a policy that names a figure goes quietly out of date. We prefer wording that stays true.

12. Who your data goes to

We do not sell your data and we do not rent it out. The circle of people who see it is short and explainable.

Wix.com Ltd., the platform the site runs on. It processes data on our instructions: form submissions, accounts, the pages themselves.

Usercentrics GmbH (Germany) operates the cookie consent banner on this site. On our instructions it collects and stores a record of your choice: which categories you accepted, which you declined, and when. We need those records to demonstrate the consent we received, as article 7(1) GDPR requires, and we keep them for three years. More detail in our Cookie Policy.

The payment service connected to this site, for donations and for event contributions. Your payment details go there; they do not come to us.

The certified accountant (contabilista certificado) who keeps the Association's books. Accounting documents on donations and fees go to them, not your correspondence with us.

Autoridade Tributária e Aduaneira, the Portuguese tax and customs authority, as part of mandatory reporting and to the extent it requires.

Google, when the map loads, and only after you have accepted analytical cookies.

Certified Code, the developer of the quick-chat button, and WhatsApp Ireland Limited (part of Meta Platforms, Inc.), if you accepted functional cookies and used that button.

Other visitors see what you published yourself: a comment, a post in a shared section, an open profile.

Beyond that, data may be disclosed on a binding demand from a court or another competent authority. We check such a demand rather than complying automatically.

13. Transfers outside the European Economic Area

Some of the companies above may process data outside the EEA.

Those transfers rely on the grounds in Chapter V GDPR: European Commission adequacy decisions for the country of the recipient (article 45 GDPR), or standard contractual clauses adopted by the European Commission (article 46(2)(c) GDPR).

We watch what happens to those mechanisms. If an adequacy decision we rely on is struck down, we will either move the transfer onto another ground or drop the service, and we will update this page before anything changes rather than after.

14. Cookies

Essential cookies load straight away, because the site would not open without them. Everything else waits until you say yes.

Which components actually run here, how each is categorised, and what stops working if you decline, is set out in our Cookie Policy. You can change your mind at any time using the "Cookie settings" button at the bottom of the screen.

15. How we protect your data

The connection to the site is encrypted on every page. Access to the data is limited to a small group of people, through accounts in the site's management console. In our forms we try not to ask for what we can do without: data we never collected cannot be lost.

If a breach happens anyway and it puts your rights at risk, we will notify the Portuguese supervisory authority within the period set by article 33 GDPR and, where the risk is high, tell you directly, as article 34 GDPR requires.

16. Your rights

You have the right to:

know what data about you we hold, and get a copy of it;
correct anything inaccurate;
ask for erasure;
restrict processing;
receive your data in a portable format;
object to processing based on our legitimate interest;
withdraw consent where the processing rests on it. Withdrawal works forwards and does not undo what was done while the consent stood.

These are articles 15 to 22 GDPR. Write to info@opengateportugal.com and we will answer within the period set by article 12(3) GDPR, which is one month. A complex request can extend that, but we have to tell you about the extension within that first month and explain why.

None of this costs you anything, and we will not ask you what you want it for.

17. Complaining to the supervisory authority

If you think we handled your data badly, write to us: that is usually faster than any formal route.

If it does not settle the matter, you can complain to the Portuguese supervisory authority: Comissão Nacional de Proteção de Dados, www.cnpd.pt. Writing to us first is not a precondition. You may go straight to the CNPD.

18. Children

The site is not meant to be used by children under 13 on their own. We do not invite a child to fill in a form, subscribe, or create an account.

A child's data can reach us only from a parent or other legal guardian, for instance when an adult registers a child for an event or names them in a form. We ask you to keep to what is needed: a name and an age, not everything there is to tell.

Health data is not collected through this site at all. Allergies, developmental particularities, diagnoses and medical instructions are special categories of data under article 9 GDPR. If something like that matters for taking part, tell us separately rather than in a notes field: we do not want to receive this kind of data by a route that was not built for it.

If you believe we received a child's data without a parent's agreement, write to info@opengateportugal.com immediately. We will delete it and confirm to you that it is gone.

19. Links to other sites

The site links to outside resources, including the sites of ecosystem projects belonging to another legal entity. Following such a link puts you under someone else's privacy policy, which we are not responsible for. It is worth a minute to see what it says.

20. Changes to this page

We update this page when what it describes changes: a new form, a new processor, a new purpose. The date at the top shows when that last happened.

If a change is significant, we will say so directly rather than hope you come back to reread.