1. introduction

The protection of personal data is a priority for Ágora - Cultura e Desporto do Porto, EM, S.A. (hereinafter “Ágora”).

This Privacy and Personal Data Protection Policy clarifies what personal data it collects, for what purposes it is used, what principles guide the use of this data and the rights of data subjects.

Ágora is a local company of a municipal nature, endowed with statutory, administrative and financial autonomy, incorporated on September 29, 2006 (then as Porto Lazer E.M.) whose share capital is wholly owned by the Municipality of Porto, under the terms of the Legal Framework for Local Business Activity and Local Holdings.

Its corporate purpose consists of the promotion and development of culture, physical activity and sport, other city entertainment activities, as well as the promotion and development of brands associated with the city of Porto, in addition to the activities determined by the management of the spaces and equipment under its management.

2. Scope

This policy applies to all people who have any kind of relationship with Ágora.

3. Data controller

Ágora is responsible for processing the personal data entrusted to it:

- Ensures that the processing of personal data takes place exclusively within the purposes for which they were collected or for compatible purposes;

- Commits itself to a culture of data minimization, in which only the necessary personal data is collected, used and kept;

- Ensures that it does not disclose or share personal data for commercial or advertising purposes.

4. Use of personal data

Ágora uses personal data to ensure the pursuit of its activities and the fulfillment of its mission, including:

- Responding to requests, communications, complaints, suggestions and reports from users;

- Managing registrations and reservations at sports and cultural venues managed by Ágora, as well as participation in activities, events and initiatives promoted by Ágora;

- Carrying out surveys to assess the quality of the services provided and identify opportunities for improvement;

- Sending information related to or compatible with the purposes for which the data was collected, such as publicizing activities, events or changes in the services provided; Sending information related to or compatible with the purposes for which the data was collected;

- Ensuring the efficient operation of the spaces and activities under its management.

Ágora may use anonymized data generated within the scope of its activity to improve its services, develop new features and carry out statistical analyses.

5. Personal data collected

The data collected varies according to the interaction with Ágora and may include:

- Identification: Name, age, NIF, Citizen Card/Identity Card number, Social Security number.

- Financial data: Bank identification number.

- Institutional data: Institutional email.

- Contact details: Address, email address, telephone/mobile number.

- Image: Images captured by security cameras and photos/videos taken during events, used for the purposes of publicizing activities, in accordance with the good practices provided for under the GDPR.

6. Personal data of minors

The collection and processing of minors' personal data only takes place with the consent of those with parental responsibility, except in situations provided for by law. These guardians can exercise their rights over the personal data of minors under similar conditions to those of the data subjects.

7. Processing of special data

Data considered sensitive by the GDPR, such as health information, receives additional protection. Ágora only collects such data when strictly necessary and in accordance with specific safeguards.

8. Sharing personal data

Ágora will only share your personal data with third parties in the exercise of public interest/public authority functions, in strict compliance with legal obligations, or with the consent of the data subject.

9. Security of personal data

Ágora uses security technologies and measures to protect personal data from unauthorized access, use or disclosure.

10. Rights of data subjects

Data subjects have the right to:

- Be informed in a clear and transparent manner about the processing of their data;

- Access data concerning them;

- Request the rectification of incorrect, incomplete or inaccurate data;

- Oppose the processing of their data (with legal exceptions);

- Request the limitation of processing to specific categories;

- Request the erasure of data (“right to be forgotten”), except when there are legal grounds for its retention;

- Withdraw consent, without compromising the lawfulness of previous processing;

- Request the portability of your data to another entity, when technically feasible.

11. Retention of personal data

Personal data is kept for the period necessary for the purposes for which it was collected. Where justified, retention periods may be extended for archiving purposes of public, historical, scientific or statistical interest, always respecting appropriate security measures.

To determine the appropriate retention period, Ágora takes into account the various resolutions of the European data protection control authorities, namely the CNPD, and the Archival Regulation for Local Authorities (Ordinance no. 112/2023 of April 27).

Data will be deleted as soon as it is no longer needed for the purpose(s) defined or when consent is withdrawn.

12. Cookies and similar technologies

Ágora uses cookies (small text files that a website, when visited by the user, places on their computer or mobile device through the internet browser) to provide our websites and online services, help you collect data and save your settings, in order to improve our performance and your user experience.

13. Social networks

- Facebook: facebook.com/agoraporto2019

- Instagram: instagram.com/agoraporto

- YouTube: youtube.com/agoraporto

- LinkedIn: linkedin.com/company/agoraporto

14. Contact information

For more information on Ágora's privacy and personal data protection practices, as well as to exercise your rights as a data subject, you can contact the Data Protection Officer at dpo@agoraporto.pt.

15. Changes to the privacy policy

This privacy policy will be regularly updated whenever necessary.

It is recommended that you periodically consult the privacy and personal data protection policy in order to stay informed about how Ágora is protecting your personal data and to keep up to date with the information and rights you have.

Suggestions for improvement can be made by e-mailing dpo@agoraporto.pt.

Updated on the 18th of february of 2025.