Privacy policy
1. Data controller
1.1. The controller of personal data collected through www.hugorosa.pt is Hugo Rosa, who may be contacted on all data protection matters at contacto@hugorosa.pt.
1.2. Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, «GDPR») and Portuguese Law no. 58/2019 of 8 August.
2. Categories of data processed
2.1. Contact form: name, email address, telephone number, the content of the message sent by the data subject and the text of the replies exchanged.
2.2. Client Area: name, email address and the date it was confirmed, password stored as a cryptographic hash, the date of the last sign-in, a profile picture where the data subject uploads one, the two-step verification key and its recovery codes where the data subject switches it on (the codes stored as a cryptographic hash), the confirmation codes sent by email (stored as a cryptographic hash and deleted shortly after they expire), and — when a session is requested or prints are ordered — the telephone number and the delivery address or handover point given for that purpose.
2.3. Browsing data: IP address, date and time of the request and equivalent technical information, logged automatically by the hosting server for security and diagnostic purposes.
2.4. No analytics, behavioural advertising or third-party tracking tools are used.
2.5. Identification in photographs: to give each family only the photographs their child appears in, I record who appears in each photograph, by means of a label (for example, a shirt number) and, only where necessary, a name. This identification is done by me, by hand. No automatic facial recognition is used, and no template, measurement or characteristic of anyone’s face is computed or stored. These records are erased when the person is removed or when the data subject, or their legal representative, asks. On some albums, chosen by me, whoever sees the album can see only the photographs of one person, choosing them by a crop of a photograph I picked by hand as a reference. That crop is only shown when the photograph it comes from is already visible to whoever sees the album, and it is cut from the same version of that photograph (without the watermarks): on the public page, with faces blurred where they were blurred. Neither the name nor the label is shown.
2.6. Claim cards: when I hand out a card with a code, I keep only a cryptographic hash of that code (never the code itself), the person it is meant for, its expiry and, once used, the account that used it and the date.
3. Purposes and lawful bases
3.1. Responding to enquiries and preparing quotations: steps taken at the request of the data subject prior to entering into a contract (article 6(1)(b) GDPR) and, where applicable, consent (article 6(1)(a)).
3.2. Managing the Client Area and delivering contracted content: performance of a contract (article 6(1)(b) GDPR).
3.3. Ensuring the security of the Website and preventing unauthorised access: legitimate interests of the controller (article 6(1)(f) GDPR).
3.4. Compliance with legal obligations to which the controller is subject (article 6(1)(c) GDPR).
4. Retention periods
4.1. Messages received through the contact form: up to 12 months after the last communication, unless a contractual relationship arises. Conversations in the Client Area are deleted 12 months after the last message, or with the account they belong to. This period applies only to the text of the conversations: photographs, albums and other files are not deleted by it. Replies to a message from the form are sent by email to the address given, with their text, and with a private address to carry on the conversation, valid until 90 days after the last message.
4.2. Client account data: for the duration of the contractual relationship and thereafter for the applicable statutory retention periods, or until the right to erasure is exercised.
4.3. Server logs: for the period determined by the hosting provider, typically no longer than six months.
5. Recipients and processors
5.1. Data is not sold, assigned or otherwise disclosed to third parties for marketing purposes.
5.2. Data is hosted on the infrastructure of the web hosting provider, acting as processor within the meaning of article 28 GDPR, with servers located in the European Union.
5.3. Fonts and other graphical resources are served from the Website's own infrastructure, so no data is communicated to external providers by reason of a mere visit.
5.4. Should the data subject choose to play embedded audiovisual content, data may be communicated to the hosting platform, subject to that platform's privacy policy.
6. International transfers
6.1. No transfers of personal data to third countries or international organisations outside the European Economic Area are envisaged.
7. Rights of the data subject
7.1. Under articles 15 to 22 GDPR, the data subject has the rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
7.2. These rights are exercised by written request to contacto@hugorosa.pt and will be answered within one month, extendable under article 12(3) GDPR.
7.3. The data subject also has the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt), or with the supervisory authority of their place of residence.
8. Security measures
8.1. The controller implements technical and organisational measures appropriate to the risk, pursuant to article 32 GDPR, including storage of passwords as cryptographic hashes, protection of private areas by authentication with temporary lockout after repeated failed attempts, optional two-step verification, account recovery only to confirmed email addresses or, for an account that does not yet hold any content, to the address it was registered with, encrypted transmission of data, and storage of original files outside the publicly accessible directory, access to which is mediated by a permission check.
9. Automated decision-making
9.1. No decisions based solely on automated processing, including profiling, producing legal effects concerning the data subject are taken.
10. Minors
10.1. Where services involve photographing minors, this is preceded by authorisation from the holder of parental responsibility, who likewise authorises any public disclosure of the images.
11. Amendments
11.1. This policy may be updated; the version in force is the one published on the Website, indicating the date of the latest update.