Privacy Policy
Last updated: April 2025 — Subject to legal review before publication.
Ler em Português1. Who we are
Milvoz — Associação Ambientalista da Região Centro (hereafter "Milvoz") is the data controller for personal data collected through this site (milvoz.pt).
Controller contact: geral@milvoz.pt
2. What data we collect and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Responding to contact messages | Name, email, message | Legitimate interest (Art. 6(1)(f) GDPR) | 2 years |
| Volunteer applications | Name, email, phone, areas, motivation | Pre-contractual (Art. 6(1)(b)) | 3 years |
| Newsletter | Email, language preference | Consent (Art. 6(1)(a)) — double opt-in | Until unsubscribed |
| Member management | Name, email, phone, payment data (Stripe) | Contract (Art. 6(1)(b)) | Membership duration + 5 years |
| Donation processing | Email, amount (Stripe) | Legitimate interest / contract | 10 years (tax obligations) |
3. Cookies
This site uses only strictly necessary cookies for technical operation (language preference, cookie notice acceptance). We do not use tracking, advertising, or behavioural analytics cookies.
4. Sub-processors and transfers
We share data only with the following sub-processors, all operating within or with EU-compliant infrastructure:
- Supabase (database) — EU region
- Cloudflare Pages (hosting) — data served from European PoPs
- Resend (email sending) — GDPR compliant
- Stripe (payments) — PCI DSS certified, DPA available
We do not transfer data to third countries without adequate safeguards.
5. Your rights
Under GDPR you have the right to:
- Access your personal data
- Rectify inaccurate data
- Request erasure ("right to be forgotten")
- Object to processing
- Data portability
- Withdraw consent at any time (newsletter: click "unsubscribe" in any email)
To exercise your rights, contact geral@milvoz.pt. You also have the right to lodge a complaint with the CNPD (Portuguese data protection authority).
6. Security
Data is stored with encryption at rest and in transit. Database access is restricted by Row Level Security policies.
7. Changes to this policy
Any changes will be published on this page with an updated date. Material changes will be communicated by email to newsletter subscribers.