Privacy Policy

This page explains what data is collected on adap.pt, why, for how long it is kept, and how to exercise your rights.

If you are a registered member of the private area, a second document — “Processing of your personal data as an ADAP member” — supplements this one with details specific to account data and the private area (social network, AdapGuide, AdapRetex). It is presented to you and signed when you register. The two documents complement each other: this one covers the entire site, including its public sections; the other specifically covers your status as a member.

1. Who is responsible for processing your data?

François Wilman, a private individual established in Portugal, publisher of the adap.pt site. As ADAP is not a formally declared association in the strict sense, this identification matches what appears in the site’s Legal Notice. As adap.pt does not currently offer any paid service, no address or tax number (NIF) is published (see the Legal Notice for details on this principle).

Data Protection Officer (DPO) contact: dpo@adap.pt

This role is currently performed by François Wilman himself. The dedicated address is designed to allow, if necessary, a handover to a separate DPO without this changing anything for users.

2. What data we collect, why, and for how long

2.1 General browsing of the site

• Technical cookies strictly necessary for the site to function (login session, remembering the language chosen via Polylang, etc.) — legal basis: exemption for strictly necessary technical cookies, no consent required.
• Audience measurement — The site uses Matomo, a self-hosted audience measurement tool — data never leaves ADAP’s infrastructure, with no transfer to third parties or outside the European Union. Matomo is configured in cookie-free mode, with IP address anonymisation (the last two octets are masked). This configuration is intended to qualify for the consent exemption applicable to strictly necessary audience measurement tools, without individual tracking or cross-referencing with other processing. Legal basis: legitimate interest. Raw browsing data is automatically deleted after 6 months; aggregated reports, which do not allow an individual visitor to be identified, are kept beyond that period to track the site’s evolution.
• Retention period for technical server logs: Technical server logs (connection logs, including IP address) are managed directly by our hosting provider, Hostinger, and are not configurable by us. They are kept for the period strictly necessary for the security, maintenance and proper functioning of the service, in accordance with standard hosting practices, and are not used for any other purpose.

2.2 Contact forms (BitForm Pro)

• Data collected: name, email address, message, and any additional field specific to the form used.
• Purpose: responding to your request.
• Legal basis: legitimate interest in responding to enquiries addressed to us.
• Retention period: 3 years from the last contact.
• Recipient: the adap.pt team only. See section 2.9 for the sending of the related transactional emails.

2.3 Account creation and profile (BuddyPress) — private area

Access to adap.pt’s community social network requires an account. Full details of the data collected upon registration and throughout your membership (identity, contact details, published content, retention period, mutual commitments between members) are set out in the document “Processing of your personal data as an ADAP member”, presented to you and signed when you register.

In summary: registration under your real identity (no pseudonyms), exchanges between members exclusively via the platform’s internal messaging (your email is never disclosed to another member), legal basis: performance of the terms of use accepted upon registration.

2.4 AdapGuide (AI conversational assistant) — members only

Accessible exclusively to registered members (login required).

• Data collected: content of exchanges with the assistant.
• Purpose: answering practical questions about life in Portugal.
• Processors involved:
  • Recall, for indexing and searching within exchanges;
  • Anthropic, the provider of the language model used, a company based in the United States.

Data transfer outside the European Union: Anthropic (the language-model provider) is a company based in the United States. The transfer of data outside the European Union to Anthropic is governed by the Standard Contractual Clauses (SCCs) approved by the European Commission, automatically incorporated into Anthropic’s commercial terms accepted when subscribing to the API. Exchanges sent to Anthropic as part of AdapGuide are never used to train the models, and are kept for 7 days by default before deletion.

Search queries sent to Recall (the text of the question asked to AdapGuide) are not stored in its application databases. This text may nonetheless appear briefly, for a maximum of 30 days, in Recall’s technical infrastructure logs, for the purposes of operating and monitoring the service — without extended retention or use for analysis, history, or commercial purposes.

Questions asked to AdapGuide are also logged in the site’s database, linked to your account — since AdapGuide is reserved for members registered under their real identity, these exchanges are not anonymous. This logging is used to improve the service. Legal basis: legitimate interest. Retention period: 90 days, with automatic daily purging beyond this period.

2.5 AdapSorties (community outings)

The list of outings (title, date and time) is publicly visible, with a teaser on the public blog; the exact location and registration are reserved for logged-in members.

• Data collected (members registered for an outing): identity of the registered person, any declared companions, registration status (registered or on a waiting list).
• Purpose: managing available spots and the waiting list for each outing.
• Legal basis: performance of the terms of use linked to registering for an event.
• Retention period: duration of the event + 6 months.

2.6 AdapVeille (civic monitoring)

This module publicly documents exchanges between citizens and elected officials or administrations, for the purposes of public accountability and the general interest.

• The individuals concerned (elected officials, administrations) act within the scope of their public or professional duties.
• Legal basis: legitimate interest linked to informing the public on matters of general interest.
• Any sensitive personal information found in source documents is redacted by the site administrator prior to publication.
• As a matter of principle, no limited retention period applies to this content: a documented matter remains relevant for as long as it concerns the exercise of a public function, since an administration may reverse a decision at any time.

2.7 AdapRetex (feedback on service providers)

• Access reserved for members who have joined the dedicated private group via a double opt-in mechanism (membership request, followed by acceptance of group-specific terms of use).
• Data collected: narrative testimonial written by the member, concerning a third-party service provider.
• Legal basis: explicit consent given when joining the group.
• Rights of the service provider concerned: any person or business mentioned in a piece of feedback may request the correction or removal of content concerning them, even if they are not a user of the site, by writing to dpo@adap.pt.
• Retention period: this module is not yet open to members; retention arrangements will be specified before its launch.

2.8 Crisp (live chat)

A live chat widget (Crisp) is present across the whole site, accessible to any visitor.

• Data collected: content of the conversation; identity (name, email) if you provide it; technical session data (IP address, browser, page viewed) needed for the service to function.
• Purpose: answering questions about how the adap.pt site works and how to use it — to be distinguished from AdapGuide, which is dedicated to practical questions about life in Portugal.
• Processor: Crisp IM SAS, a French company (Nantes). Data hosted in the European Union (Amsterdam, Frankfurt) — no transfer outside the EU.
• Legal basis: legitimate interest in responding to enquiries addressed to us.
• Retention period: Crisp keeps technical connection logs (IP address, browser, timestamp) for a maximum of one year, for debugging and security purposes. The content of the conversations themselves is kept in ADAP’s Crisp inbox until manually deleted.
• Publisher’s privacy policy: https://crisp.chat/en/privacy/

2.9 Mailjet (sending emails and newsletter)

The site uses Mailjet to send all transactional emails (registration confirmation, password reset, various notifications) as well as, for admitted members, managing two dedicated contact lists: a list of active members and a newsletter list, which you join by an explicit choice (a “Yes, subscribe me” button in an email sent after your admission).

• Data collected: email address, first name, last name, role on the site.
• Purpose: delivery of the site’s transactional emails; for members who wish, occasional sending of ADAP news (new articles, outings, announcements).
• Processor: Mailjet (Sinch group). Data hosted in the European Union (Frankfurt, Germany, and Saint-Ghislain, Belgium). Certain internal management data (billing, administration of the ADAP account) may be transferred between Sinch group entities, governed where applicable by Standard Contractual Clauses — this mechanism does not concern the content of your communications.
• Legal basis: performance of the terms of use accepted at registration (transactional emails and member list); consent, collected via an explicit click (newsletter list).
• Retention period: 30 days after deletion of your member account.
• You can unsubscribe from the newsletter at any time via the link in each email sent.
• Publisher’s privacy policy: https://www.mailjet.com/legal/privacy-policy/

2.10 Future modules

This policy will be supplemented as new modules are rolled out (in particular AdapMarket). In particular, should a payment system be introduced, banking data will pass exclusively through a specialised third-party payment provider and will never be stored directly on adap.pt.

3. Who has access to your data?

• The adap.pt administration team.
• The host Hostinger, as technical processor.
• The processors mentioned above, depending on the module concerned (Recall, Anthropic, Crisp, Mailjet).
• No data is sold or transferred to third parties for commercial purposes.

4. Your rights

In accordance with the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, restrict, object to, and port your personal data.

To exercise these rights, contact our DPO at dpo@adap.pt.

We undertake to respond within one month of receiving your request; this period may be extended by two months for complex requests, in accordance with Article 12 of the GDPR — you would then be informed of this.

Each request is subject to documented internal tracking (nature of the request, date received, exchanges, date of reply), to provide evidence of our compliance. This record is strictly internal and can only be consulted by the DPO.

As the data controller is established in Portugal, you also have the right to lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados — www.cnpd.pt), the competent Portuguese data-protection supervisory authority.

5. Security

The site implements the following technical measures: encrypted connection (HTTPS) across the entire site; account passwords stored in encrypted form, never in plain text; protection against fraudulent registrations (limiting the number of attempts per hour, Cloudflare Turnstile verification, blocking of disposable email domains); regular updates of the content management system and its extensions. These measures are reviewed and adjusted as the site evolves.

6. Changes to this policy

This policy may be updated, in particular as new modules are rolled out on adap.pt. Members will be informed of any substantial change.