Latest update: 22 October 2026
1. Introduction
Casa-Museu Jaime Umbelino · CEF - Centro de Experimentação da Fotografia (CMJU-CEF) respects the privacy of its visitors, users and other people who contact the project, committing to protect their personal data and ensure their treatment in accordance with the applicable legislation.
This Privacy Policy explains how personal data is collected, used, stored and protected in connection with the use of the website and the contacts established with the project, including requests for information, registrations for activities, applications and other cultural initiatives, where applicable.
The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation – GDPR), Law No 58/2019 of 8 August 2019 and other applicable Portuguese and European legislation.
2. Controller of the processing of personal data
The controller of the personal data collected through this website is, in principle, the entity that determines the purposes and means of such processing.
Responsible entity: F/SOS Association – Photography, Solidarity and Social Works
Project: Jaime Umbelino House-Museum · CEF – Photography Experimentation Centre
Headquarters: Rua da Pedra de Aia, 1 Swimming Pool
2500-592 Caldas da Rainha Portugal
NIPC: 519 169 441
E-mail: info@f-sos.org
Website: https://www.f-sos.org/
The F/SOS Association carries out its cultural activity within the framework of the Jaime Umbelino House-Museum · CEF – Photography Experimentation Centre, in Foz do Arelho, under the applicable institutional frameworks and agreements.
Where certain processing operations are the responsibility of another entity, or are carried out jointly with another entity, such responsibility shall be defined and communicated in accordance with legally applicable terms.
For any question related to the protection of personal data or to exercise the rights provided for in this Policy, you may contact the responsible entity through the email address indicated above.
3. What personal data can be collected?
The personal data collected depends on how you use the website and the services actually provided.
They may include:
Identification and contact details: name, email address, telephone number and other identifying information you decide to provide.
Data sent through forms: content of messages, requests for information, proposals for collaboration, registrations, applications and other information you voluntarily submit.
Enrolment and activity data: information necessary for the management of registrations for exhibitions, visits, workshops, educational activities, events or other cultural initiatives.
Subscription data for communications: email address and communication preferences if you subscribe to a newsletter or other information service.
Technical and navigation data: IP address, device type, browser, pages visited, technical records and information about the use of the website, when collected by the tools used.
Data relating to cookies: information collected through cookies or similar technologies, according to the features installed and the consent preferences expressed by the user.
The responsible entity seeks to collect only data that is adequate, relevant and necessary for the purposes for which it is intended.
You must not send sensitive personal data through the forms on the website, unless expressly requested, there is a legal basis for the processing and the legally required guarantees are ensured.
4. Purposes of processing
Personal data may be processed for the following purposes, depending on the services and functionalities actually provided:
Respond to requests for information and messages sent through the website.
Managing institutional, cultural and educational contacts and relationships.
Process registrations for activities, workshops, visits, events and other initiatives.
Receive and review applications, collaboration proposals and submissions, where applicable.
Manage the subscription and sending of newsletters or other communications expressly requested.
Ensure the operation, maintenance and security of the website.
Analyze the use of the website, when properly configured statistical analysis tools are used.
Comply with legal obligations and respond to legitimate requests from the competent authorities.
Exercise, defend or enforce rights in judicial or extrajudicial proceedings, when necessary.
Personal data will not be processed for purposes incompatible with those for which they were collected.
5. Legal grounds for the processing
The processing of personal data will have as a legal basis one of the bases provided for in Article 6 of the GDPR, depending on the specific purpose:
Consent: when the user consents to the processing for a specific purpose, such as the subscription to certain communications or the use of non-essential cookies.
Pre-contractual arrangements or performance of the contract: processing is necessary to respond to a request from the data subject or to perform a contract to which the data subject is a party.
Compliance with legal obligations: where the processing is necessary to comply with a legal obligation applicable to the entity in charge.
Legitimate interests: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the fundamental rights and freedoms of the data subject.
Mission in the public interest or exercise of official authority: where applicable and duly justified, in accordance with the relevant legislation.
The legal basis will be determined on the basis of each processing operation. Not all purposes depend on consent.
Where the processing is based on consent, consent may be withdrawn at any time, without compromising the lawfulness of the processing carried out prior to its withdrawal.
6. Data retention period
Personal data will be kept only for the period necessary to fulfil the purposes for which they were collected, respecting the applicable legal retention periods.
The specific period will depend on the nature of the data, the purpose of the processing, the relationship established with the data subject and the existence of legal obligations or the need to retain information for the exercise or defense of rights.
Data relating to communications and requests for information shall be kept for the period necessary for their management and for compliance with any applicable obligations.
The data used for sending newsletters will be kept as long as the subscription remains active, without prejudice to the limited retention of information necessary to prove compliance with legal obligations.
Data relating to registrations, applications or activities will be kept for the period necessary for the management of the respective initiatives and compliance with the applicable legal deadlines.
When the data are no longer needed, they will be deleted or anonymized in an appropriate manner, unless there is a legal basis for their retention.
7. Communication of data to third parties
Personal data may be made available to service providers that intervene in the operation of the website or in the development of project activities, namely hosting services, technical maintenance, form management, sending electronic communications or statistical analysis, when used.
When these providers process personal data on behalf of the responsible entity, the contractual conditions and guarantees required by the GDPR will be ensured.
The data may also be communicated to other entities when it is necessary to comply with legal obligations, respond to legitimate requests from the competent authorities or ensure the management of activities, provided that there is a legal basis for such communication.
The communication of data to the Foz do Arelho Parish Council, to institutional partners or to other entities will not be carried out indiscriminately, depending on the purpose, the need and the respective legal basis.
Personal data will not be sold to third parties.
8. International data transfers
If services are used that involve the transfer of personal data to countries outside the European Economic Area, such transfers will be carried out in compliance with the GDPR.
Where necessary, the legally required conditions, such as an adequacy decision by the European Commission, appropriate safeguards or other valid transfer mechanism provided for in the applicable legislation, will be ensured.
Transfers and concrete guarantees will depend on the services and suppliers actually used.
9. Cookies and similar technologies
The website may use cookies and similar technologies to ensure its operation, store preferences, improve the browsing experience and, where applicable, obtain usage statistics or integrate content and services from third parties.
Cookies strictly necessary for the operation of the website may be used in the legally permitted terms.
Cookies and non-essential technologies that rely on consent will only be used after obtaining valid consent, when legally required.
You can manage your preferences through the consent panel provided on the website and, in addition, through your browser settings.
Detailed information about the cookies used, their purposes, the suppliers and the storage periods should be consulted in the Cookies Policy or in the preferences panel provided on the website.
10. Security of personal data
The controller shall take appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the data, the purposes of the processing and the risks involved.
Despite the measures implemented, no electronic transmission or storage system can guarantee absolute security.
In case of violation of personal data, the legally required measures will be adopted, including notification to the National Data Protection Commission and communication to the affected holders, when applicable.
11. Rights of data subjects
Under the terms of the GDPR and the applicable legislation, the data subject may exercise, when the respective legal assumptions are met, the following rights:
Right of access: obtain confirmation of and access to the processing of your personal data.
Right to rectification: request the correction of inaccurate or incomplete data.
Right to erasure: request the deletion of personal data in the situations provided for by law.
Right to restriction of processing: request the restriction of processing in the cases provided for by law.
Right to object: object to certain processing, in the applicable terms, including processing based on legitimate interests.
Right to portability: receive the personal data you have provided, in a structured, commonly used and machine-readable format, and transmit them to another person responsible, when the legal requirements are met.
Right to withdraw consent: withdraw consent at any time when the processing is based on that condition.
Right to lodge a complaint: lodge a complaint with the competent supervisory authority if you consider that the processing of your personal data is in breach of applicable law.
Requests to exercise rights should be sent to info@f-sos.org.
The responsible entity will respond to requests within the time limits provided for in the GDPR, as a rule within one month, and that time limit may be extended in the cases provided for by law.
Additional information strictly necessary to confirm the identity of the applicant may be requested where there are reasonable doubts, while safeguarding the protection of personal data.
The exercise of the rights is not absolute and may be subject to the limitations and conditions provided for in the applicable legislation.
The data subject may lodge a complaint with the National Data Protection Commission (CNPD), the competent supervisory authority in Portugal.
Website: https://www.cnpd.pt/
12. Links to third party websites
The website may contain links to third-party websites, including cultural institutions, partners, sign-up platforms and social networks.
This Privacy Policy does not apply to data processing carried out through these websites, which are the responsibility of the respective entities.
It is recommended to consult the applicable privacy policies and conditions before providing personal data on these services.
13. Children and young people
The activities of the Jaime Umbelino House-Museum · CEF – Photography Experimentation Centre could involve children and young people, particularly in educational, cultural and community contexts.
The collection and processing of personal data of minors shall be carried out with particular care, respecting the principles of necessity, data minimisation and protection of the rights of data subjects.
Where applicable, authorisations will be obtained or the necessary legal conditions will be ensured, taking into account the age, purpose and context of the activity.
The capture and public dissemination of photographs, videos or testimonies that allow the identification of children or young people will be subject to specific evaluation and will be subject to the applicable legal rules, including those relating to image, privacy and the protection of personal data.
Permission to participate in an activity does not in itself imply permission for the public disclosure of images or other personal data.
14. Changes to the Privacy Policy
This Privacy Policy may be updated to reflect legislative, technical or organizational changes, as well as modifications to the services and functionalities provided by the website.
The current version will be published on this page, indicating the date of its update.
Where a change legally requires it, appropriate information or consent measures shall be adopted.
15. Contacts
For any question related to this Privacy Policy or the processing of your personal data, you may contact:
F/SOS Association – Photography, Solidarity and Social Works
Project: Jaime Umbelino House-Museum · CEF – Photography Experimentation Centre
E-mail: info@f-sos.org
Website: https://www.cmju-cef.org/
Address of the head office: Rua da Pedra de Aia, 1 Swimming Pool 2500-592 Caldas da Rainha Portugal
NIPC: 519 169 441