Museums and Monuments of Portugal, E.P.E. — ("MMP")
Last updated: 03/09/2025
Scope: This Policy explains how MMP processes personal data on its website and how it uses cookies and similar technologies.
1) Who we are and contacts
Controller: Museus e Monumentos de Portugal, E.P.E. (“MMP”).
Address: Palácio Nacional da Ajuda | Ala Sul 1349-021 Lisboa | Portugal.
General e-mail: info@museusemonumentos.pt
Data Protection Officer (DPO): Filipe N. B. Mascarenhas Serra – Assessor Jurídico do Conselho de Administração da MMP | filipe.serra@museusemonumentos.pt.
How to exercise your rights: see section 11.
2) Useful definitions
- Personal data: information relating to an identified or identifiable natural person.
- Cookies: small files stored on your device. Related technologies include localStorage, pixels and SDKs.
- GDPR: Regulation (EU) 2016/679.
- ePrivacy: rules on electronic communications applicable to cookies.
3) What data we process and why (purposes and legal bases)
MMP only collects the data necessary for each purpose.
- Website operation / security (session management, load balancing, fraud prevention)
- Data processed: technical identifiers (shortened/anonymous IP where possible), user agent, logs
- Legal basis: Legitimate interest / performance of the requested service
- Retention period: Up to 12 months (technical logs), unless a legal obligation requires otherwise
- Assistance/Contacts (forms)
- Data processed: identification, contact details, message content
- Legal basis: Pre-contractual steps / Legitimate interest
- Retention period: Up to 12 months after the request is closed
- Sending newsletters
- Data processed: e-mail, preferences
- Legal basis: Consent
- Retention period: Until consent is withdrawn or inactivity, according to internal policy
- Ticketing / events
- Data processed: identification, contact details, transactional data
- Legal basis: Performance of a contract / legal obligation
- Retention period: For the period legally required
- Audience analytics (Google Analytics)
- Data processed: cookie identifiers, browsing interactions
- Legal basis: Consent (see section 6)
- Retention period: According to the cookie duration or until consent is withdrawn
MMP does not carry out solely automated decisions producing legal effects. If any project requires otherwise, this section will be updated.
4) Recipients and processors
We may share data with providers that support us (hosting, maintenance, e-mail, ticketing, analytics). These third parties act as processors, under contracts imposing confidentiality and security measures. Where applicable, we identify third parties that place cookies in section 6.
5) International transfers
If any recipient is located outside the EEA, we ensure appropriate mechanisms (EU Standard Contractual Clauses, adequacy decisions such as the EU-US Data Privacy Framework, or other safeguards), as well as transfer impact assessments. Details can be requested via the DPO contact.
6) Cookies and similar technologies
This website uses cookies that are strictly necessary for its operation and, only with your consent, analytics cookies (Google Analytics) to measure audiences and improve the service.
6.1 Categories
- Strictly necessary (always active): ensure basic functionalities (navigation, security, session management, load balancing). Legal basis: legitimate interest/requested service.
- Analytics (optional): help understand website usage. Legal basis: consent.
6.2 How we manage your consent
- On first access, we display a banner with two equally prominent options: Accept (enable analytics) or Decline (do not enable).
- Analytics cookies are not loaded without your prior consent.
- You may change or withdraw consent at any time via the “Cookie preferences” link available in the footer of every page.
- Your choice is recorded for evidence and respected until the defined period expires or until you change it.
6.3 Cookies used (example — adapt to the actual inventory)
_ga- Provider: Google
- Purpose: Audience measurement (user distinction)
- Category: Analytics
- Duration: 24 months
- Legal basis: Consent
_ga_XXXXXX- Provider: Google
- Purpose: Session persistence/property-level statistics
- Category: Analytics
- Duration: 24 months
- Legal basis: Consent
_gid- Provider: Google
- Purpose: Audience measurement (24h)
- Category: Analytics
- Duration: 24 hours
- Legal basis: Consent
mmp_session- Provider: MMP
- Purpose: Session management/authentication
- Category: Strictly necessary
- Duration: Session
- Legal basis: Legitimate interest/service
6.4 Other user controls
You can also configure your browser to block/clear cookies and use opt-out tools provided by vendors. Blocking strictly necessary cookies may affect the operation of the website.
7) Security
We adopt appropriate technical and organisational measures (access control, encryption in transit, server hardening, access logging, backups), proportionate to the risk, to protect data against destruction, loss, alteration or unauthorised disclosure.
8) Retention
We keep data only for as long as necessary for each purpose or for the applicable legal period. The main retention periods are set out in the table in section 3 and in the cookie durations in section 6.3.
9) Children
Unless otherwise indicated in specific forms (e.g., educational activities), this website is not directed to children under 13. Where applicable, we obtain parental consents in accordance with the law.
10) Summary of legal bases
- Performance of a contract / requested service
- Legitimate interest (operating and protecting the website, responding to requests)
- Consent (analytics, marketing communications, where applicable)
- Compliance with a legal obligation (tax/accounting, where applicable)
11) Your rights
You have the right to access, rectification, erasure, restriction, portability and to object to processing, as well as to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
To exercise your rights, contact: Filipe N. B. Mascarenhas Serra – Assessor Jurídico do Conselho de Administração da MMP | filipe.serra@museusemonumentos.pt.
You also have the right to lodge a complaint with the CNPD — Portuguese Data Protection Authority (www.cnpd.pt).
12) Updates to this Policy
We may update this Policy to reflect legal or operational changes. Whenever changes are relevant, we will give notice on the website. Please check the date at the top of this document.