1. Data controller

The entity responsible for processing the data is Museus e Monumentos de Portugal, E.P.E. (MMP), which ensures that processing is carried out in strict compliance with the General Data Protection Regulation (GDPR) and other applicable national legislation.

2. Purposes and retention periods

The DIM Platform adopts auditable and differentiated retention periods to ensure compliance with the principle of storage limitation.

• Contact management and information requests: data collected through contact forms is retained for a period of 12 months.
• Newsletter subscriptions: data is kept until the user withdraws their consent.
• Technical logs: to ensure platform security, technical logs are retained for 12 months.
• Entity and event records: data required to manage the participation of entities in DIM is retained for the legally required period to safeguard MMP's tax and accounting obligations.

3. Processors and third parties

Transparency in the subcontracting chain is essential. For newsletter management and delivery, the DIM Platform uses the Closum platform, ensuring security and predictability in data processing. Other service providers within the MMP ecosystem may access data strictly for hosting and technical support purposes.

4. International data transfers

The use of tools such as Google Analytics 4 involves data flows outside the European Economic Area (EEA). These transfers are legitimised through the EU Standard Contractual Clauses (SCCs), adherence to the EU-US Data Privacy Framework, and the performance of Transfer Impact Assessments (TIAs), ensuring a level of protection equivalent to that of the European Union.

5. Protection of minors

The DIM Platform sets the age limit of 13 for direct consent in information society services, such as newsletter subscriptions. For children under 13, prior parental consent is required.

6. Cookies policy

The DIM Platform uses cookies to improve the user experience and analyse traffic. The technical transparency of each technology used is detailed below:

Users may manage their cookie preferences at any time through their browser settings or through the platform configuration panel.

7. Data subject rights

Under the GDPR, the data subject has the right to request access, rectification, erasure, restriction, objection, and portability of their data. To exercise these rights or contact the Data Protection Officer (DPO), the official channels made available by MMP should be used.

8. Data Protection Officer contact

To exercise your rights, clarify questions, or submit complaints about the processing of your personal data, contact:

Filipe N. B. Mascarenhas Serra
Legal Advisor to the MMP Board of Directors
Data Protection Officer
Phone: 213 650 875
Email: filipe.serra@museusemonumentos.pt

9. Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD)
Website: www.cnpd.pt
Email: geral@cnpd.pt
Phone: +351 213 928 400