Privacy
Privacy policy
How we handle the data of people who visit this site and ask us for a demo. What happens to data inside the Plenários platform, at the councils and assemblies that use it, is covered in Data protection.
In short
- We only ask for what we need to reply: name, email and organisation. Phone and message are optional.
- We do not use the data for advertising, we do not sell it and we do not send newsletters.
- We keep each request for up to 24 months after the last contact, unless a contract follows.
- You can ask for access, correction or deletion of your data at any time, at [email protected].
- There are no advertising or audience measurement cookies.
1. Who is responsible
The controller of the data collected on this site is Olhar Panorâmico - Unipessoal, Lda., the company that develops and operates the Plenários platform under the Loading brand.
- Company name
- Olhar Panorâmico - Unipessoal, Lda.
- Company type
- Single-member private limited company
- Registered office
- Rua Diogo Dias, n.º 96, 2870-272 Montijo, Portugal
- Tax and registration number
- 517 075 105 (single commercial registration and corporate tax number)
- [email protected]
- Brands
- Plenários and Loading
For any question about your data, including exercising the rights described below, write to [email protected].
2. What this policy covers
It applies to the plenarios.pt site, in Portuguese and English, to the demo request form and to the messages exchanged following a request.
It does not apply to the data that councils, assemblies and parish boards process on the Plenários platform and their public portals. There, each entity is the controller and Olhar Panorâmico - Unipessoal, Lda. acts as a processor. That processing is described in Data protection (GDPR).
3. What data we process
When you request a demo
Name, email and organisation, which are required, and, if you provide them, phone, type of entity and the message you write. The request also records the date and time, the form language, the version of this policy in force at the time, your browser identification (user agent) and an encrypted digest of your IP address (HMAC). That digest is used to limit abuse of the form and cannot be turned back into the address without the secret key kept on the server.
When you visit the site
As with any website, the hosting server and the delivery network receive the IP address, the date and time, the page requested, the referring page and the browser identification. These technical logs are used to deliver pages, protect the site against attacks and diagnose faults. We do not use them to identify you or to measure audiences.
When you write to us
Your address, the content of the message and any attachments you send.
What we do not ask for
We do not ask for, and do not want to receive, special categories of data, such as health data or political, religious or philosophical beliefs. Please do not write that kind of information in the message field.
4. Why we use the data and on what legal basis
| Purpose | Data | Legal basis (GDPR, Art. 6) | Retention |
|---|---|---|---|
| Replying to your request, booking and running the demo and preparing a proposal | Form data and messages exchanged | Steps taken at your request prior to a contract (Art. 6(1)(b)). When you act on behalf of an organisation, our legitimate interest in replying to you and following up the relationship with that organisation (Art. 6(1)(f)) | Up to 24 months after the last contact |
| Sending the confirmation that your request was received | Name, email, organisation and request reference | As in the row above | As in the row above |
| Protecting the form and the site against abuse and attacks | Encrypted IP digest, browser identification, submission counts and technical logs | Legitimate interest in network and information security (Art. 6(1)(f); Recital 49) | Submission counts: 24 hours. Site logs: 6 months. Hosting and delivery network logs: those providers' security retention periods |
| Meeting legal obligations if the contact leads to a contract | Contact details in proposals, contracts and invoices | Legal obligation (Art. 6(1)(c)) | The statutory period, as a rule 10 years for accounting records |
| Defending legal claims in the event of a dispute | The data needed for that defence | Legitimate interest (Art. 6(1)(f)) | Until the relevant limitation periods expire |
We do not use your data for advertising, we do not sell it and we do not build profiles. There are no automated decisions with effects on you (GDPR, Art. 22), and form data does not go through artificial intelligence systems. We do not send newsletters: if we ever want to, we will ask for your consent separately.
5. What happens if you do not provide the data
Name, email and organisation are needed for us to reply: without them, the request cannot be sent. The other fields are optional and only help us prepare the conversation better.
6. Who receives the data
Requests are read by the sales and technical team of Olhar Panorâmico - Unipessoal, Lda., with access limited to what is needed to reply. For the site to work, we use the following providers, who process data on our behalf and on our instructions (GDPR, Art. 28):
| Provider | What it does | Where it processes data |
|---|---|---|
| PTisp (Almouroltec - Serviços de Informática e Internet, Lda.) | Hosting of the site and of the mail server that sends the form messages | Portugal |
| Cloudflare, Inc. | Delivery network and protection of the traffic between your browser and the server | Global network, with points of presence in the European Union |
| Google Ireland Limited (Google Workspace) | The [email protected] mailbox, where requests and replies arrive | European Union and other countries where Google has data centres |
We do not share the data with anyone else unless the law requires it, for instance at the request of a judicial authority.
7. Transfers outside the European Economic Area
Cloudflare and Google may process data outside the European Economic Area, in particular in the United States. Those transfers rely on the European Commission adequacy decision on the EU-US Data Privacy Framework, under which both companies are certified, and on the standard contractual clauses approved by the Commission, which form part of their data processing agreements (GDPR, Arts. 45 and 46). You can ask us for information about these safeguards at [email protected].
8. How long we keep the data
- Demo requests: up to 24 months after the last contact. The site itself deletes request records older than 24 months, and messages in the mailbox follow the same rule.
- If a contract follows: the contact persons' data is then processed under that contract, for as long as the law requires.
- Site technical logs: 6 months. Form submission counts: 24 hours.
- Session cookie: until you close the browser. Cookie choice: 180 days.
If you ask for erasure before these periods end, we delete the data without delay, except what the law requires us to keep.
9. Your rights
- Access (Art. 15): know what data we hold about you and get a copy.
- Rectification (Art. 16): correct inaccurate data or complete incomplete data.
- Erasure (Art. 17, the "right to be forgotten"): ask us to delete data that is no longer needed.
- Restriction (Art. 18): ask us to suspend the use of the data while a question is resolved.
- Portability (Art. 20): receive the data you gave us in a structured, machine-readable format.
- Objection (Art. 21): object to processing based on legitimate interest, on grounds relating to your situation.
To exercise any of these rights, write to [email protected]. It is free of charge and we reply within one month, which may be extended by two further months for complex requests (GDPR, Art. 12). If there is reasonable doubt about your identity, we may ask for additional information to confirm it.
You also have the right to lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt.
10. How we protect the data
- Always-encrypted connections (HTTPS with HSTS) and a content security policy that prevents the site from loading third-party code.
- Requests stored in a server folder that cannot be reached from the internet, with restricted access.
- A form protected against forged and automated submissions, with a limit on submissions per connection.
- Emails sent through an authenticated mail server, with SPF, DKIM and DMARC.
- Access to requests limited to the team that answers them.
11. Cookies
This site stores only what is essential: a session cookie on the form pages and another cookie that stores your cookie choice. There are no advertising or audience measurement cookies, and the fonts and every page resource are served by our own server, with no requests to third parties. The details are in the Cookie policy.
12. Changes to this policy
We may update this policy when providers, retention periods or the law change. The date of the version in force is at the top of the page and is recorded with each demo request. If a change matters to people who have already contacted us, we will let them know by email.