Personal data
CHECK-IN / PRIVACY
Privacy Policy
How we collect, use, share, protect and retain personal data on the website and in CHECK-IN activities.
9 sections found
1. Data controller
The data controller is Associação Check-IN – Cooperação e Desenvolvimento, Portuguese legal person number 509392733, registered at Casa das Associações, Rua Professor Janeiro Acabado s/n, 7800-506 Beja, Portugal.
For questions or to exercise data protection rights, contact projects@checkin.org.pt and use “Privacy” as the subject. The same address receives safeguarding and PSEAH reports, which should use “PSEAH” as the subject.
2. Scope and principles
This policy applies to website visitors, people who contact us, project applicants, members, payers and participants in CHECK-IN activities.
We process only adequate and necessary information for defined purposes, for no longer than necessary, with measures designed to preserve confidentiality, integrity and restricted access.
3. What we process and why
| Activity | Data and purpose | Legal basis | Retention |
|---|---|---|---|
| Enquiries | Name, email, subject and message to answer the enquiry. | Steps requested by the person and legitimate interest in replying. | Up to 12 months after the matter is closed. |
| Applications | Identity, birth date, city, contact details, role, answers, assessments and files for selection and participation. | Steps requested by the person and legitimate interests in organisation and fair selection. | Unsuccessful applicants: up to 12 months after closure. |
| Children | Guardian name, relationship, contact details and authorisation. | Safeguarding, steps needed for participation and guardian authorisation. | During the process and for the project retention period. |
| Health and accessibility | Strictly necessary dietary, medical or accessibility information for safety and inclusion. | Separate explicit consent under Article 9 GDPR. | Up to 90 days after the project, unless an incident or obligation applies. |
| Selected participants | Logistics, travel, accommodation, insurance and programme documents. | Participation, legal obligations and funding rules. | Funder period; for Erasmus+, normally 5 years after final payment, or 3 years for grants up to €60,000, where applicable. |
| Members | Identity, contacts, status, validity and history needed to manage membership. | Membership request and relationship, legal obligations and legal claims. | During membership and up to 5 years after it ends. |
| Payments and receipts | Method, amounts, proof, banking and tax details required for payment and receipt. | Membership relationship and accounting/tax obligations. | 10 years for tax records and supporting documents. |
| Website security | IP, device, date and technical logs that may be processed by hosting providers. | Legitimate interest in security, availability and abuse prevention. | For the shortest configured period necessary for security. |
4. Storage and hosting
Applications, membership requests, administrative content and related files are stored in the database and private storage contracted by CHECK-IN. The browser only retains technical preferences such as cookie consent and interface state.
Access to organisational data requires authentication and an authorised role. We apply backups, audit records, retention periods and access controls proportionate to risk.
5. Recipients
Access is restricted to authorised CHECK-IN staff. Where needed for selected participation or legal compliance, relevant data may be shared with host partners, funders and national or EU agencies, travel, accommodation, insurance, accounting and audit providers, Stripe, technology providers and competent authorities.
Only information necessary for each purpose is shared. Processors acting for CHECK-IN must provide appropriate safeguards.
6. International transfers
Some projects, partners or providers may be outside the European Economic Area. Before sharing, CHECK-IN must identify an adequacy decision, standard contractual clauses or another valid safeguard and inform participants when the transfer depends on the project.
Stripe and Google providers may use international entities under their contracts and transfer mechanisms.
7. Your rights
You may request access, correction, deletion, restriction, portability or objection where applicable, and withdraw consent without affecting earlier processing. Contact projects@checkin.org.pt with “Privacy” as the subject. We normally reply within one month.
You may complain to the Portuguese Data Protection Authority at cnpd.pt. We may request only the information needed to verify your identity.
8. Automated decisions and marketing
We do not use solely automated decisions, profiling or behavioural advertising. Application scores support staff and decisions remain with authorised people. Newsletters are sent only after explicit subscription confirmation and can be cancelled at any time.
9. Security and changes
We apply restricted access, minimisation, file validation and organisational measures proportionate to risk. No transmission or storage is completely secure; incidents must be assessed and handled within legal time limits.
This policy will be updated before adding new services, purposes or recipients. The current version and review date appear at the top.
The Portuguese version is the primary legal version. The English version is provided to make the information easier to understand.
Version history
Auditable record of each revision of this document, showing what changed compared with the previous version.
| Version | Date | Status | What changed | Approved by |
|---|---|---|---|---|
| 2026-08-03 | 3 August 2026 | Initial version | First website publication covering privacy policy, local browser storage, GDPR rights and retention periods.
| Board of Directors |