This page explains what data is collected on adap.pt, why, for how long it is kept, and how to exercise your rights.

If you are a registered member of the private area, a second document — “Processing of your personal data as an ADAP member” — supplements this one with details specific to account data and the private area (social network, AdapGuide, AdapRetex). It is presented to you and signed when you register. The two documents complement each other: this one covers the entire site, including its public sections; the other specifically covers your status as a member.

1. Who is responsible for processing your data?

François Wilman, a private individual established in Portugal, publisher of the adap.pt site. As ADAP is not a formally declared association in the strict sense, this identification matches what appears in the site’s Legal Notice. As adap.pt does not currently offer any paid service, no address or tax number (NIF) is published (see the Legal Notice for details on this principle).

Data Protection Officer (DPO) contact: dpo@adap.pt

This role is currently performed by François Wilman himself. The dedicated address is designed to allow, if necessary, a handover to a separate DPO without this changing anything for users.

2. What data we collect, why, and for how long

2.1 General browsing of the site

• Technical cookies strictly necessary for the site to function (login session, remembering the language chosen via Polylang, etc.) — legal basis: exemption for strictly necessary technical cookies, no consent required.
• Audience measurement — The site uses Matomo, a self-hosted audience measurement tool — data never leaves ADAP’s infrastructure, with no transfer to third parties or outside the European Union. Matomo is configured in cookie-free mode, with IP address anonymisation (the last two octets are masked). This configuration is intended to qualify for the consent exemption applicable to strictly necessary audience measurement tools, without individual tracking or cross-referencing with other processing. Legal basis: legitimate interest. Raw browsing data is automatically deleted after 6 months; aggregated reports, which do not allow an individual visitor to be identified, are kept beyond that period to track the site’s evolution.
• Retention period for technical server logs: Technical server logs (connection logs, including IP address) are managed directly by our hosting provider, Hostinger, and are not configurable by us. They are kept for the period strictly necessary for the security, maintenance and proper functioning of the service, in accordance with standard hosting practices, and are not used for any other purpose.

2.2 Contact forms (BitForm Pro)

• Data collected: name, email address, message, and any additional field specific to the form used.
• Purpose: responding to your request.
• Legal basis: legitimate interest in responding to enquiries addressed to us.
• Retention period: 3 years from the last contact.
• Recipient: ADAP only. See section 2.10 for the sending of the related transactional emails.

2.3 Registration request, account and profile (BuddyPress) — private area

Joining the private area starts with a registration request, reviewed manually. Data collected at this stage: first name, last name, email address, phone number and WhatsApp contact preference if you provide them, stated reasons for joining, and the IP address used for the request. Purpose: reviewing the request and verifying that there is a real person behind every account. Legal basis: pre-contractual steps taken at your request. An incomplete request (unconfirmed email, request still awaiting validation, or documents not signed) is automatically deleted after 7 days; a minimal record (email address, stage reached, IP address, date) is kept for 90 days to prevent abuse, including for a rejected request. Internal emails generated by these requests are automatically deleted no later than 90 days after they are received.

The registration request form is protected by Cloudflare Turnstile, an anti-bot verification service provided by Cloudflare, Inc., a company established in the United States. When you fill in this form, Cloudflare receives your IP address, technical characteristics of your browser and connection, and the address of the page. Purpose: distinguishing people from bots and keeping out automated registrations. Legal basis: legitimate interest in protecting the site. Cloudflare acts as a processor to provide this service, and as a controller to improve its own bot detection. The transfer to the United States is covered by the EU–US Data Privacy Framework and, failing that, by the European Commission’s standard contractual clauses. To find out more: Turnstile privacy policy.

Access to adap.pt’s community social network requires an account. Full details of the data collected upon registration and throughout your membership (identity, contact details, published content, retention period, mutual commitments between members) are set out in the document “Processing of your personal data as an ADAP member”, presented to you and signed when you register.

In summary: registration under your real identity, known only to ADAP; on the site, you appear under a pseudonym chosen when you first log in, and your first and last name are not displayed; exchanges between members via the internal messaging (your email is never disclosed to another member); legal basis: performance of the terms of use accepted upon registration.

2.4 AdapGuide (AI conversational assistant) — members only

Accessible exclusively to registered members (login required).

• Data collected: content of exchanges with the assistant.
• Purpose: answering practical questions about life in Portugal.
• Processors involved:
  • Recall, which performs the search in AdapGuide’s documentation: the text of each question is sent to it in real time to find the relevant information. Recall’s privacy policy applies to this data: https://www.recall.it/legal/privacy-policy.
  • Anthropic, the provider of the language model used, a company based in the United States.

Data transfer outside the European Union: Anthropic (the language-model provider) is a company based in the United States. The transfer of data outside the European Union to Anthropic is governed by the Standard Contractual Clauses (SCCs) approved by the European Commission, automatically incorporated into Anthropic’s commercial terms accepted when subscribing to the API. Exchanges sent to Anthropic as part of AdapGuide are never used to train the models, and are kept for 7 days by default before deletion.

Questions asked to AdapGuide are recorded anonymously in the site’s database: with no link to your account and no precise time. This log is used to improve the service. Legal basis: legitimate interest. Retention period: 90 days, with automatic daily deletion beyond this period.

2.5 AdapSorties (community outings)

The list of outings (title, date and time) is publicly visible, with a teaser on the public blog; the exact location and registration are reserved for logged-in members.

• Data collected (members registered for an outing): the account of the registered person (displayed under their pseudonym), the number of any companions (no information is requested about them), registration status (registered or on a waiting list), comments posted on the outing’s page, and the outing’s management history (cancelled registrations, cancellation of the outing and its reason, messages sent by the organiser to registered members).
• Purpose: managing available spots, the waiting list and the exchanges related to each outing.
• Legal basis: performance of the terms of use linked to registering for an event.
• Retention period: 6 months after the end of the outing. After this period, the list of participants, the waiting list, the comments and the management history are automatically deleted. The outing’s page (title, date, location, description, organiser) remains available as an archive, showing only the total number of participants.
• Reporting an outing: a logged-in member can report an outing to ADAP. Their account and the reason given are sent to ADAP, which keeps them for up to 6 months after the end of the outing.
• Request to create a group: the information entered in the form (requester’s account, name and purpose of the proposed group) is kept for up to 6 months after ADAP’s reply.
• Deletion of your account: your registrations and your comments on outings are deleted. In the outings’ history, the reference to your account is removed and the texts you had written (cancellation reason, message to registered members) are erased.

2.6 AdapVeille (civic monitoring)

This module publicly documents exchanges between citizens and elected officials or administrations, for the purposes of public accountability and the general interest.

• The individuals concerned (elected officials, administrations) act within the scope of their public or professional duties.
• Legal basis: legitimate interest linked to informing the public on matters of general interest.
• Any sensitive personal information found in source documents is redacted by the site administrator prior to publication.
• As a matter of principle, no limited retention period applies to this content: a documented matter remains relevant for as long as it concerns the exercise of a public function, since an administration may reverse a decision at any time.

2.7 AdapRetex (feedback on service providers)

• Access reserved for members who have joined the dedicated private group via a double opt-in mechanism (membership request, followed by acceptance of group-specific terms of use).
• Data collected: narrative testimonial written by the member, concerning a third-party service provider.
• Legal basis: explicit consent given when joining the group.
• Rights of the service provider concerned: any person or business mentioned in a piece of feedback may request the correction or removal of content concerning them, even if they are not a user of the site, by writing to dpo@adap.pt.
• Retention period: this module is not yet open to members; retention arrangements will be specified before its launch.

2.8 Crisp (live chat)

A live chat widget (Crisp) is available across the whole site. It only loads after you consent to preference cookies, either in the cookie banner or through the “Live chat” link in the footer. Without this consent, no data is sent to Crisp, and you can still email us.

• Data collected: content of the conversation; identity (name, email) if you provide it; technical session data (IP address, browser, page viewed) needed for the service to function.
• If you are logged in to your member account, your email address and your pseudonym are automatically sent to Crisp each time a page loads, so that our replies can be linked to your account. They are not sent when you browse without being logged in.
• Purpose: answering questions about how the adap.pt site works and how to use it — to be distinguished from AdapGuide, which is dedicated to practical questions about life in Portugal.
• Processor: Crisp IM SAS, a French company (Nantes). Data hosted in the European Union (Amsterdam, Frankfurt) — no transfer outside the EU.
• Legal basis: your consent for loading the widget and its cookies; legitimate interest in responding to enquiries addressed to us, for processing your messages.
• Retention period: the content of conversations is kept for a maximum of 3 years after the last exchange, then deleted. Crisp’s own technical logs are governed by its privacy policy.
• Publisher’s privacy policy: https://crisp.chat/en/privacy/

2.9 Messaging apps and social networks

ADAP can be contacted via WhatsApp Business and Telegram, using the links in the footer. These links open the relevant app: nothing is loaded from these services until you click.

• Data processed: your phone number (WhatsApp) or your Telegram username, the name and profile picture you have set in the app, and the content of the messages exchanged.
• Purpose: answering your questions and requests.
• Legal basis: legitimate interest in responding to enquiries addressed to us.
• Retention period: 3 years from the last exchange. Older conversations are deleted manually, once a year.
• Providers: WhatsApp Ireland Limited (Meta group) for WhatsApp Business; Telegram, a company established outside the European Union, for Telegram. Their own terms and privacy policies apply to the messages you entrust to them. If you prefer not to use these services, email us.

ADAP also has pages on Facebook, LinkedIn, Instagram, YouTube, X, Threads, Bluesky, Pinterest and TikTok. The site does not embed any content from these platforms: the footer icons are simple links, and no cookies from these services are set when you browse adap.pt. If you follow or comment on an ADAP page on one of these platforms, the platform’s privacy policy applies. ADAP has access to the audience statistics the platform provides for its pages; for this processing, ADAP and the platform may be joint controllers.

2.10 Mailjet (sending emails and newsletter)

The site uses Mailjet to send all transactional emails (registration confirmation, password reset, various notifications) as well as, for admitted members, managing two dedicated contact lists: a list of active members and a newsletter list, which you join by an explicit choice (a “Yes, subscribe me” button in an email sent after your admission).

• Data collected: email address, first name, last name, role on the site.
• ADAP does not measure whether its emails are opened or whether their links are clicked. Mailjet only records whether an email was delivered, that is, accepted by the recipient’s mail service, and on what date.
• Purpose: delivery of the site’s transactional emails; for members who wish, occasional sending of ADAP news (new articles, outings, announcements).
• Processor: Mailjet (Sinch group). Data hosted in the European Union (Frankfurt, Germany, and Saint-Ghislain, Belgium). Certain internal management data (billing, administration of the ADAP account) may be transferred between Sinch group entities, governed where applicable by Standard Contractual Clauses — this mechanism does not concern the content of your communications.
• Legal basis: performance of the terms of use accepted at registration (transactional emails and member list); consent, collected via an explicit click (newsletter list).
• Retention period: 30 days after deletion of your member account.
• You can unsubscribe from the newsletter at any time via the link in each email sent.
• Publisher’s privacy policy: https://www.mailjet.com/legal/privacy-policy/

2.11 Future modules

This policy will be supplemented as new modules are rolled out (in particular AdapMarket). In particular, should a payment system be introduced, banking data will pass exclusively through a specialised third-party payment provider and will never be stored directly on adap.pt.

3. Who has access to your data?

• ADAP, publisher of the site.
• The host Hostinger, as technical processor: server located in France, backups in Lithuania. Hostinger also provides the site’s content delivery network (CDN), which receives visitors’ IP addresses in order to deliver pages to them.
• Cloudflare, for the anti-bot check on the registration form (section 2.3).
• The other processors mentioned above, depending on the module concerned (Recall, Anthropic, Crisp, Mailjet).
• WhatsApp and Telegram, for the messages you send us through these channels (section 2.9).
• No data is sold or transferred to third parties for commercial purposes.

4. Your rights

In accordance with the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, restrict, object to, and port your personal data.

To exercise these rights, contact our DPO at dpo@adap.pt.

We undertake to respond within one month of receiving your request; this period may be extended by two months for complex requests, in accordance with Article 12 of the GDPR — you would then be informed of this.

Each request is subject to documented internal tracking (nature of the request, date received, exchanges, date of reply), to provide evidence of our compliance. This record is strictly internal and can only be consulted by the DPO.

As the data controller is established in Portugal, you also have the right to lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados — www.cnpd.pt), the competent Portuguese data-protection supervisory authority.

5. Security

The site implements the following technical measures: encrypted connection (HTTPS) across the entire site; account passwords stored in encrypted form, never in plain text; protection against fraudulent registrations (limiting the number of attempts per hour, Cloudflare Turnstile verification, blocking of disposable email domains); regular updates of the content management system and its extensions. These measures are reviewed and adjusted as the site evolves.

6. Changes to this policy

This policy may be updated, in particular as new modules are rolled out on adap.pt. Members will be informed of any substantial change.