The Portuguese text of this Policy is the binding one. This English version is provided for convenience. Where the two differ, the Portuguese text prevails.

Fundação Terra Agora, a Portuguese private law foundation with NIPC 516946269, respects the personal data of everyone who deals with us. This Policy explains what data we collect, why, how long we keep it, who we share it with, and what rights you have, under the General Data Protection Regulation, Regulation (EU) 2016/679.

It applies to anyone who visits our website, subscribes to our communications, makes a donation, takes part in our activities, works with us, or appears in photographs, video or audio recordings that we produce.

1. Who the data controller is

Entity	Fundação Terra Agora, NIPC 516946269
Registered office	Rua da Escola 46, Carril, Junceira, 2300-013 Tomar, Portugal
Privacy email	privacidade@terra-agora.org
General email	info@terra-agora.org
Telephone	+351 935 069 537
Data Protection Officer	The Foundation is not required to appoint a Data Protection Officer under Article 37 GDPR and has not appointed one. Privacy matters are handled by the Comissão Executiva through the address above.

2. What data we collect

2.1 Identification and contact

Name, email address, telephone, postal address, organisation, profession or role.

2.2 Donor verification

Date of birth, nationality, country of residence, tax identification number, and a copy of an identity document, namely a Cartão de Cidadão, passport or residence permit. For a legal person, a registry certificate, tax number, the identity of the person acting for the entity and of its beneficial owners. Section 4 explains why we are required to collect this.

2.3 Donations and transactions

Amount, currency, date, channel, purpose of the donation, the payer name as it appears on the transfer or payment, and supporting records.

2.4 Participation

Information about participation in events, educational activities, projects, volunteering and other initiatives organised by the Foundation or by entities working for it.

2.5 Communications

Messages sent by email, website forms and social media, and, where applicable and with prior notice, recordings of meetings or calls.

2.6 Technical and browsing data

IP address, cookies, analytics data and website usage logs. Cookies are covered in section 11.

2.7 Image, video and audio

Photographs, video, audio recordings, footage taken at events, testimonials and material given to us voluntarily, with or without identification, including material that has been edited, cropped, adapted or transformed, for example into illustration, animation or montage.

3. What we use data for, on what basis, and for how long

Purpose	Data	Legal basis	Retention
Communications and newsletter	2.1	Consent, Art. 6(1)(a)	Until consent is withdrawn
Processing donations and issuing a receipt	2.1, 2.3	Contract and legal obligation, Art. 6(1)(b) and (c)	10 years
Donor verification	2.2	Legal obligation, Art. 6(1)(c) GDPR with Art. 146.º of Lei n.º 83/2017	10 years; 7 is the legal minimum
Accounting and tax obligations	2.3	Legal obligation, Art. 6(1)(c)	10 years
Managing participants, volunteers and partners	2.1, 2.4	Contract or legitimate interest, Art. 6(1)(b) and (f)	Duration of the relationship, plus 5 years
Communicating our work and institutional materials	2.7	Explicit consent	See section 5
Website security and operation	2.6	Legitimate interest, Art. 6(1)(f)	12 months
Establishing or defending legal claims	As necessary	Legitimate interest, Art. 6(1)(f)	Until the matter is finally decided

At the end of these periods the data is deleted or anonymised.

4. Donor verification: what the law requires of us

The Foundation is covered by Article 146.º of Lei n.º 83/2017, of 18 August, which sets out duties on the prevention of money laundering and terrorist financing. That article requires us to obtain and verify the identity of anyone who gives us funds gratuitously whenever the donation is €100.00 or more.

In practice this means:

• below €100.00 we do not ask you for an identity document;
• from €100.00 we ask for a copy of an identity document and the further details listed in section 2.2;
• a commitment to give regularly is taken at its total value, not at the value of each instalment;
• this is not our choice and not a judgement about you: it is a legal obligation on the Foundation;
• if you do not provide these details we cannot accept the donation. There is no other consequence.

These documents are held in a restricted file, used solely for this legal obligation, and are not shared for any other purpose.

5. Image, video and audio

We use image, video and audio only with explicit consent, for publication on digital channels, institutional materials, exhibitions, events and educational activities, the Foundation's archive, and adapted or edited content.

We keep this material for as long as it remains relevant to the Foundation's institutional archive, reviewing the need for it every ten years, or until consent is withdrawn.

Withdrawing consent

You may do so at any time by email to privacidade@terra-agora.org, giving your name, the date and place of the event where applicable, and the link to or a description of the material. From that point we stop using it in new publications and remove it from our platforms wherever technically possible.

There are limits worth knowing. Material already printed or distributed cannot be recalled; content already shared by third parties beyond our control cannot be fully removed; and the historical archive may be kept with restricted access.

6. Who we share data with

We use service providers who process data on our behalf under processor agreements concluded in accordance with Article 28 GDPR:

• website hosting and email;
• donation platforms and payment processing;
• contact management and communication tools;
• legal, tax, accounting and information technology advisers.

We also share data with public authorities where the law requires it, namely the Departamento Central de Investigação e Ação Penal, the Unidade de Informação Financeira, ASAE and the Autoridade Tributária e Aduaneira, and with institutional partners where image is involved and consent has been given.

We do not sell personal data and do not release it for third party advertising.

7. Transfers outside the European Economic Area

Some of the platforms we use are operated by entities established in the United States of America, including those supporting donation processing, email and document storage. Your data may therefore be processed outside the European Economic Area.

Those transfers rely on the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, where the provider is certified under it, under Article 45 GDPR. Where a provider is not certified, they rely on the standard contractual clauses approved by the European Commission under Article 46 GDPR, published by the Commission and reproduced by the providers in their own publicly available data transfer addenda.

8. Security

We apply technical and organisational measures appropriate to the risk: role-based access control, strong authentication on institutional accounts, encryption in transit, restricted access to donor verification files, internal security policies and periodic review.

No system is entirely secure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the Comissão Nacional de Proteção de Dados within 72 hours and inform you where the risk is high, under Articles 33 and 34 GDPR.

9. Your rights

You have the rights of access, rectification, erasure, restriction of processing, portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these, write to privacidade@terra-agora.org. We respond within one month, extendable by two months in complex cases, under Article 12(3) GDPR. We may ask you for details confirming your identity before responding.

These rights have limits. We cannot erase data the law requires us to keep, in particular donor verification records and accounting records, for as long as the legal period runs.

If you consider that the processing of your data breaches the law, you may complain to the Comissão Nacional de Proteção de Dados, Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or to the supervisory authority of your country of residence.

10. Automated decisions

We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

11. Cookies

Our website uses cookies and similar technologies that are strictly necessary for it to work, which do not require consent. It also uses Google Analytics and Google reCAPTCHA, which currently set cookies and collect data on every page and form before any consent choice is made. You can block or delete these cookies at any time through your browser settings.

12. Links to other sites

Our website may contain links to third party sites, which have their own policies for which we are not responsible.

13. Changes to this Policy

We may update this Policy. The version in force is the one published on our website, identified by version number and date. Significant changes are announced on the website and, where appropriate, by email.

14. Contact

Fundação Terra Agora, Rua da Escola 46, Carril, Junceira, 2300-013 Tomar, Portugal.
privacidade@terra-agora.org · +351 935 069 537.

Fundação Terra Agora · NIPC 516946269 · Version 2.0