Privacy Policy

1. Data controller

The controller of your data is Junta de Freguesia de Paul, at Rua de Cima, n.º 17, 6215-380 Paul.

Contact: geral@jf-paul.pt · +351 275 961 660.

As a public authority, the Junta designates a Data Protection Officer (DPO). For data protection matters, write to the address above marking your message "Data Protection".

2. What we collect

We only collect data you actively give us. Depending on what you do on the site:

• Reporting an issue: description, location, any photos you attach and, if you choose to identify yourself, name, email and phone.
• Subscribing to communications: name, email and the topics you choose.
• Answering the satisfaction survey: score, comment and the service rated. Name, email and phone only if you choose to identify yourself and give explicit permission.
• Contacting us by email or phone: whatever you include in your message.
• Admin area (staff only): name, email and access credentials.

3. Data collected automatically

We use no tracking, advertising or analytics cookies. We do not profile you and make no automated decisions with legal effect.

One strictly necessary cookie (jf_session) keeps staff signed in to the admin area. It is not used during ordinary visits.

Pages carry a Facebook block that is loaded only if you press the "Load Facebook posts" button. Until you do, no request is made to Facebook. Once loaded, the content comes from the servers of Meta Platforms Ireland Ltd., which may record your IP address and set its own cookies under Facebook's privacy policy.

In the satisfaction survey we store an irreversible hash of your IP address, solely to prevent repeated responses. The address itself is never stored, and the hash is deleted after 12 months.

4. Purposes and legal bases

• Handling reported issues — performance of a task carried out in the public interest (Art. 6(1)(e) GDPR).
• Answering enquiries — public interest, and pre-contractual steps where applicable.
• Sending communications and the newsletter — consent (Art. 6(1)(a)), which you may withdraw at any time.
• Satisfaction survey — consent. You may answer entirely anonymously.
• Website security and operation — legitimate interest in protecting our systems.

5. Who we share with

We never sell or trade your data. We use service providers acting as processors, bound by contract and required to keep your data secure:

• Vercel Inc. — website hosting and storage of uploaded files.
• Neon Inc. — database (servers in the European Union).
• Resend (Plus Five Five, Inc.) — automated emails and newsletter delivery.
• Google Ireland Ltd. — web fonts loaded by your browser.
• OpenStreetMap Foundation and unpkg — maps and technical components loaded by your browser.

6. Transfers outside the European Union

Some providers above are established in the United States. Where international transfers occur, they rely on Standard Contractual Clauses approved by the European Commission and/or the EU-US Data Privacy Framework.

When you visit pages with external maps or fonts, your browser discloses your IP address to those providers. You can prevent this with blocking extensions or by disabling external content.

7. Retention

• Reported issues: kept while needed for follow-up and thereafter for administrative archiving.
• Satisfaction survey: name, email, phone and IP hash are erased 12 months after the response. Score and comment are kept anonymously for statistics.
• Communication subscriptions: until you unsubscribe.
• Admin sessions and credentials: deleted once expired.

8. Your rights

Under the GDPR you have the right to:

• Access your data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Request erasure, where applicable.
• Restrict or object to certain processing.
• Data portability for data provided on the basis of consent.
• Withdraw consent at any time, without affecting prior lawful processing.

9. Exercising your rights

Email geral@jf-paul.pt or write to Rua de Cima, n.º 17, 6215-380 Paul. We reply within one month at the latest.

If you believe your data is not being handled properly, you may complain to the Portuguese supervisory authority, CNPD — www.cnpd.pt.

10. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), irreversibly hashed passwords, admin access restricted to authorised staff, and minimisation of the data we collect.

11. Children

This website is not directed at children under 16. If we learn we have collected a child’s data without parental authorisation, we will erase it.

12. Changes

This policy may be updated. The date of the last update appears at the top of this page. Material changes will be announced on the website.