Privacy Policy

This Privacy Policy explains how personal data collected through the institutional website of the Grand Lodge of Portugal — Early Grand Scottish Rite are processed.

Personal data are processed in accordance with Regulation (EU) 2016/679 of 27 April — the General Data Protection Regulation (GDPR) — and the applicable national legislation.

1. Data controller

For the purposes of data protection legislation, the data controller is Associação do Cardo Escocês.

For any matter concerning privacy, data protection or the exercise of data-subject rights, the following contact should be used exclusively: rgpd@a-cardoescoces.pt.

2. Personal data collected

The website seeks to limit the collection of personal data to what is strictly necessary.

The contact form may collect the sender's name, email address, message subject and message content.

During normal use of the website, certain technical data necessary for its operation and security may also be processed, such as IP address, date and time of access, browser type, device used and technical access logs.

The contact form is not intended to collect special categories of personal data. Visitors are therefore advised not to include sensitive information that is not necessary for the intended contact.

3. Purposes and lawful basis

Data provided through the contact form are processed to receive and reply to communications addressed to the Grand Lodge of Portugal, respond to requests for information, maintain the correspondence necessary to deal with the matter raised, ensure the security, integrity and technical operation of the website and comply with applicable legal obligations where necessary.

Processing necessary for managing communications received and operating the website is generally based on the data controller's legitimate interest in replying to requests addressed to it and ensuring the secure operation of its electronic communication channels.

Where another lawful basis applies, including compliance with a legal obligation or the data subject's consent, processing will be carried out on that basis.

4. Papers and publications

The website may make available papers, studies and reflections whose authors have authorised their publication.

Where a pseudonym, initials or another form of signature is used, the author's personal identity will not be publicly disclosed through the website. The published form of attribution follows the choice made by the relevant author.

5. Data retention

Data received through the contact form will be kept only for the period necessary to deal with the communication and, as a rule, for no longer than 12 months after the last interaction, unless a legitimate reason or legal obligation requires a longer retention period.

Technical logs necessary for service security and operation are retained for the periods required for those purposes and in accordance with the terms applicable to the technology services used.

Information associated with the attribution of published papers may be retained while the relevant paper remains available on the website, without prejudice to the rights recognised to the data subject.

6. Service providers and recipients

Access to personal data is limited to persons who need to process them in the performance of their functions.

Specialist service providers are used for the technical availability and operation of the website, including hosting, form processing and other technology services.

The website's technical infrastructure currently uses services provided by Netlify, including the technical processing of submissions made through the contact form.

Personal data are not sold, transferred for advertising purposes or used for third-party marketing.

7. International data transfers

Some technology providers may carry out processing operations outside the European Economic Area.

Where international transfers of personal data take place, they must be carried out under the mechanisms and safeguards provided for by the GDPR, including, where applicable, adequacy decisions or standard contractual clauses approved by the European Commission.

8. Cookies, analytics and advertising

The public website of the Grand Lodge of Portugal does not use behavioural advertising, visitor profiling or tracking systems for commercial purposes.

No services are used to identify or individually track visitors for marketing purposes. Technical mechanisms strictly necessary for the operation, security or administration of the website may nevertheless be present.

9. Automated decision-making

Personal data collected through this website are not used for decisions based solely on automated processing or for profiling capable of producing legal effects or a significant impact on data subjects.

10. Data-subject rights

Subject to the applicable legal conditions, data subjects may exercise their rights of access, rectification, erasure, restriction of processing, objection, data portability where applicable, and withdrawal of consent where processing is based on consent.

Exercising these rights is generally free of charge and may be requested through rgpd@a-cardoescoces.pt.

Additional information may be requested where necessary to confirm the identity of the person exercising a right, with such verification limited to what is strictly necessary.

11. Complaint to the supervisory authority

Without prejudice to any other administrative or judicial remedy, data subjects have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados — CNPD if they consider that the processing of their personal data infringes applicable data-protection law.

12. Security

Technical and organisational measures are adopted to protect personal data against unauthorised access, loss, alteration, disclosure or improper destruction.

The website uses encrypted HTTPS/TLS communications and is hosted on technology infrastructure that incorporates mechanisms intended to protect service availability and integrity.

No electronic transmission or storage system can, however, guarantee absolute security.

13. External links

The website may contain links to external pages or services. This Privacy Policy applies solely to processing carried out within this website and does not cover privacy practices or policies adopted by third parties.

14. Changes to this Privacy Policy

This Privacy Policy may be updated whenever relevant changes occur in the website's operation, the services used or the applicable legislation. The current version will be made available on this page together with its date of update.