1. Data Controller
Museus e Monumentos de Portugal, E.P.E. (MMP) is committed to processing your personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016), its national implementing legislation (Law No. 58/2019 of 8 August) and other applicable legislation, ensuring privacy, data protection and information security.
Committed to protecting and respecting your privacy, this Privacy Policy explains when and why we collect personal information about people who visit our website, how we use it, the conditions under which we may disclose it to others, and how we keep it secure.
2. Personal Data Collected
MMP retains only the data necessary for justified purposes and contacts, namely:
- Name (when voluntarily provided)
- Email address (for newsletter subscription or contact)
Browsing data (technical cookies essential to the website's operation)
3. Newsletter and Email Communications
3.1. Purpose and Legal Basis
By subscribing to our newsletter, your personal data (name and email address) are processed based on your express and free consent, pursuant to Article 6(1)(a) of the GDPR, for the following purposes:
- Sending information about cultural events, exhibitions and activities of the museums and monuments managed by MMP
- Sharing educational and cultural content
- Relevant institutional communications
3.2. Sub-processor
Data collected through the newsletter subscription form is stored and managed through the Closum platform (https://closum.com), MMP's sub-processor for managing and sending email communications.
Closum acts as a sub-processor under Article 28 of the GDPR and is contractually bound to ensure the security and confidentiality of personal data, not using it for any purposes other than those defined by MMP.
3.3. Withdrawal of Consent
You may withdraw your consent at any time, at no cost and without providing justification, by:
- Unsubscribe link present in the footer of every email received
- Direct contact with the Data Protection Officer (contacts below)
Withdrawal of consent does not affect the lawfulness of processing carried out prior to that date.
4. Sharing Data with Third Parties
Personal data is used exclusively for the purposes for which it was collected and is not, under any circumstances, provided to other entities, except for:
- Legal obligations or requirements from competent authorities
- Technical sub-processors necessary for the provision of services (such as the Closum platform), always contractually bound to ensure data protection
MMP does not sell, rent or trade your personal data.
5. Data Retention
Personal data is retained in a database only:
- For the duration of the newsletter subscription or the relationship with data subjects
- Until the right to erasure or objection to processing is exercised
- Except where retention is permitted under Article 9(2)(j) and Article 89 of the GDPR (for archiving in the public interest, scientific or historical research purposes)
For as long as MMP is required to do so by legal or tax obligations
6. Rights of Data Subjects
In accordance with the GDPR, data subjects have the following rights:
- Right of access: obtain confirmation of which personal data is being processed
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure ("right to be forgotten"): request the deletion of data
- Right to restriction of processing: restrict processing in certain circumstances
- Right to data portability: receive personal data in a structured format
- Right to object: object to the processing of personal data
- Right to withdraw consent: at any time, without affecting the lawfulness of prior processing
To exercise any of these rights, please contact our Data Protection Officer using the contact details below.
7. Information Security
MMP implements appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure or access, including:
- Data encryption in transit (HTTPS)
- Access control and authentication
- System monitoring and auditing
- Staff training and awareness
8. Cookies
The MMP website uses cookies that are essential to the website's operation. For more information about our cookie policy, please refer to the cookie consent banner on the website.
9. Changes to the Privacy Policy
MMP reserves the right to update this Privacy Policy. Any changes will be published on this page, with an indication of the date of the last update.
10. Data Protection Officer Contact
To exercise your rights, clarify doubts or submit complaints about the processing of your personal data, please contact:
Filipe N. B. Mascarenhas Serra
Legal Adviser to the Board of Directors of MMP
Data Protection Officer
Phone: 213 650 875
Email: filipe.serra@museusemonumentos.pt
11. Right to Lodge a Complaint
You have the right to lodge a complaint with the competent supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD)
Website: www.cnpd.pt
Email: geral@cnpd.pt
Phone: +351 213 928 400
