Privacy policy
1. Identity of the controller
1.1 This Privacy Policy applies to the Académica app (iOS and Android) and the app.academica.pt website, of the Associação Académica de Coimbra (AAC), tax number 500032173, with registered office at Rua Padre António Vieira, s/n, 3000-315 Coimbra, Portugal, which is the controller of personal data. The Portuguese version prevails.
1.2 This policy explains what personal data we process, for what purpose, for how long, who we share it with and what your rights are.
1.3 For any question about your data, or to exercise your rights, use the form on the Support page (in the app or on the website) or write to the support email shown there, with the subject "Data protection".
2. Use without identifying yourself
2.1 You can read news, see events, browse the structures and the shop without signing in and without giving us any personal data. There is no account to create.
2.2 The app does not ask for your location and does not access your contacts, photos or files.
2.3 The website uses no cookies for visitors; in the browser it keeps only the cart and access to the orders placed in it (point 4.2). Neither the app nor the website uses advertising, third-party analytics or tracking across apps and websites.
3. Personal data processed and purposes
3.1 Member area
a) Data: those in AAC's member register (point 3.7). When you sign in, we also store the session date and the device name reported by the system (for example, "…'s iPhone"), so you can see and end your sessions and, if the person signing in is the responsible person of an underage member, which responsible person it is (point 3.13);
b) Purpose: confirm that you are a member (number and date of birth, plus a 6-digit code sent to your registered email), show your member card and the fees of the sections you belong to, issue the membership declaration and let you see and update your details in My details. Your stored tax number is used to prefill the invoice when you pay fees. The data in "My details" is only requested from the server when you open that screen and is not stored on the phone;
c) Updating your details: phone and address are updated at once. Your email only changes after you confirm a code sent to the new address; the old address is notified and your other sessions end. Name, date of birth, tax number, sex, nationality, identity document and student number change by request, which the AAC Secretariat validates before changing the record; you receive the decision by email. While processing is restricted (point 7.1(d)), your details cannot be changed;
d) Membership declaration: the PDF declaration certifies your membership status on the date of issue. It always shows your name, number and AAC membership and, depending on what you choose, the sections you belong to and other details from your record (for example, date of birth, tax number or address). It is generated on the spot, digitally signed by AAC and valid for 30 days, and is not stored on our servers: we only log that it was issued, with its reference and date. It only reaches third parties if you share it. The Secretariat and the Board can also issue it in the dashboard;
e) Legal basis: performance of the membership relationship (Article 6(1)(b) GDPR).
3.2 Sections and membership requests
a) Data: the section's join form. We always ask for name, email and date of birth (your membership number and date of birth are what you later use to sign in). Each section may also ask for phone, tax number, address, student number, course and answers to its own questions, and ask you to accept its conditions (we store when you accepted). Non-members confirm their email with a code. Applicants under 18 also name a responsible person (name, relationship, email and, optionally, phone): the code goes to the responsible person's email, who thereby authorises the request (point 3.13);
b) Who sees it: only the section you applied to and the AAC services that manage members. The section sees the form you filled in (with the responsible person named, for a minor) and, once it approves you, your email and whether your fees for that section are up to date. It does not see other sections' fees or your invoicing tax number, and every access is logged;
c) Purpose: decide the request and manage the section's members. If approved and you are not yet an AAC member, your record is created in AAC's member register (point 3.7) and you receive your number by email;
d) Health data: some sports sections only ask whether you have a health condition the coaching staff should know about (yes or no). Your answer is processed with your explicit consent (Article 9(2)(a) GDPR), only for your safety during the activity; details are discussed directly with the coaching staff and are not stored in the app;
e) Legal basis: pre-contractual steps and performance of the section membership (Article 6(1)(b) GDPR).
3.3 Section membership fees
a) Data: fee periods, amounts, status (due, paid, waived), payment date and method and, if you ask for an invoice with your tax number, that number;
b) Purpose: collect each section's fees, issue a receipt and an invoice, and send a reminder before the due date (if fee notifications are on);
c) Legal basis: performance of the membership (Article 6(1)(b) GDPR) and legal tax obligations (point (c)).
3.4 Shop
a) Data: name, email, phone (optional), tax number (only if you ask for an invoice with it), delivery address (only if you choose shipping), notes you write, items, amounts and order status;
b) Purpose: process the order, confirm payment, prepare pickup or shipping, issue the invoice and give you access to the order, including recovering it on another phone or browser (with the order number, email and a code sent by email). If the email belongs to a member who has already confirmed it (by signing in to the app with the code sent to it), the paid order also appears in their Member area, unless you untick that option when buying on the website or in the app (purchases at the counter where you give your email always appear there);
c) Legal basis: performance of the purchase contract (Article 6(1)(b) GDPR) and legal tax obligations (point (c)).
3.5 Payments and refunds
a) Payments are processed by our payment provider, ifthenpay (or, if AAC uses it instead, Stripe), by MB WAY (confirmed in the MB WAY app), card (on the provider's secure page) or Multibanco reference (shown in the app);
b) Card details are entered on the provider's secure page and never pass through the app or our servers. For MB WAY, the mobile number you enter in the app is sent to ifthenpay, which sends the request to your MB WAY app; we do not store it (only the last three digits, to show you where the request went);
c) We send the provider the description and amount of what you are paying and your email (and, for MB WAY, the mobile number you enter);
d) The provider sends us the payment confirmation, the method used (for example, "MB WAY" or "Multibanco") and the transaction references, which we also use for refunds. We do not store card numbers or your full MB WAY number;
e) Refunds: when we refund a payment, we store the amount, the reason, which AAC staff member asked for it, its status (requested, done or declined) and the dates, and we let you know by email. MB WAY and card refunds go through the provider; Multibanco reference payments are returned by bank transfer, to the IBAN you give us;
f) Legal basis: performance of the contract or membership (Article 6(1)(b) GDPR) and legal tax obligations (point (c)).
3.6 Invoicing
a) We issue an invoice for every payment, with your name and, if you provide it, your tax number; without it, the invoice is issued to "Final consumer";
b) The invoice (or the invoice-receipt, which also serves as proof of payment) is sent by email and is available in the app.
3.7 AAC member register
a) What it is: AAC's member register is kept in this platform and managed by the AAC Secretariat in the management dashboard. The data of existing members was imported from AAC's previous system, and the Secretariat may make bulk updates by import; there is no automatic synchronisation with other systems;
b) Data: membership number, name, email (and whether it is confirmed), date of birth, status (active, suspended or left), date of admission to AAC and to each section, registration process status (and validation date), whether you are a full member and, where you provided them, tax number, phone (with country code), address, sex, nationality, identity document type and number and student number, plus the sections you belong to, your fee status and, for underage members, the responsible persons (point 3.13);
c) Purpose: manage the membership under AAC's Statutes (joining, updates and leaving), issue the registration form and the membership declaration, check who may vote in section votes (point 3.14), contact you about your membership and fees, and answer your requests about your data;
d) Who has access: the Secretariat (manages the register, validates change requests and responsible persons, and handles data protection requests), the Treasury (read only, for fees, payments and invoicing, without contacts, address or identification details), the elections team (as described in point 3.14), the Board and the technical team (maintenance). Each section only sees its own members, as described in point 3.2. Access, changes and exports are logged; exporting requires the staff member to confirm their password, and you are notified by email when a copy of your data is prepared or when the email on your record is changed;
e) Legal basis: performance of the membership (Article 6(1)(b) GDPR) and legal obligations (point (c));
f) Invoicing: invoice data (name and, if you provide it, tax number) is sent over a secure connection to AAC's own invoicing system, AAC remaining the controller.
3.8 Messages, reports and deletion requests
a) Contact: subject, name, email and message, to reply to you (Article 6(1)(b) or (f) GDPR);
b) Content reports: reason, details and, if you wish, your email. We do not ask for your name but, as with all requests, we store the originating IP address to prevent abuse;
c) Data deletion requests: your name, membership number, email and what you write, to handle the request and prove we did (point (c)).
3.9 Newsletter
a) Data: email, language, source (app or website) and confirmation and unsubscribe dates;
b) Purpose: send the newsletter, only after you confirm your email. Every email has an unsubscribe link;
c) Legal basis: consent (Article 6(1)(a) GDPR).
3.10 Notifications
a) Data: the phone's notification identifier, system (iOS or Android), language, app version, the topics you chose (news, events, shop, fees), the events you saved and the structures you follow;
b) Purpose: send you what you asked for and reminders. If you are signed in as a member (or as the responsible person of an underage member), the phone is linked to your record so you get notices about your orders and fees;
c) Legal basis: consent (Article 6(1)(a) GDPR). You can turn topics off in the app or in the phone's settings.
3.11 Calendar, camera and biometrics
a) Calendar: "Add to calendar" opens the system form and you confirm it; the app does not read your events or send them anywhere;
b) Camera: only in the AAC staff area, to scan order pickup QR codes. It is not used by members and stores no images;
c) Face ID, fingerprint or phone passcode: protect the member area and, for AAC staff, the management area, which only opens on phones with a screen lock. Staff can also sign in to the management area with a passkey. The check is done by the phone; the app has no access to your biometric data.
3.12 Security and logs
a) Data: sign-ins and relevant actions (such as requests, payments, changes to details and access to member data), with date and IP address. When the person acting is the responsible person of an underage member, the log shows the responsible person's name. Technical server logs do not store IP addresses or request contents;
b) Purpose: protect accounts and demonstrate who did what (Article 5(2) GDPR);
c) Legal basis: legitimate interest in the security of the service (Article 6(1)(f) GDPR) and legal obligations (point (c)).
3.13 Responsible persons of underage members
a) Data: name, relationship to the member (parent, legal guardian, relative or other), email, phone (optional, with country code), status (pending, active or removed), source (registration form, request in the app or registration by the Secretariat) and confirmation date;
b) Source: the responsible person, on a minor's section registration form; the underage member or the responsible person, by request in the app; or the AAC Secretariat, in the dashboard. Each underage member may have up to two responsible persons. Requests made in the app, and those on the registration form when the minor was already a member, stay pending until the Secretariat validates them;
c) Purpose: authorise a minor's request to join a section and let the responsible person sign in to the minor's member area (with the minor's membership number and date of birth and their own email, where the code is sent) and handle fees, details, sessions and requests on the minor's behalf. The responsible person sees the same as the member in the app, receives the sign-in codes by email and a notice when the Secretariat registers or confirms them, and their actions are logged in their name;
d) Who sees it: the member and their responsible persons, in "My details"; the Secretariat and the Board, in the dashboard; and the section, only the responsible person named on the registration form made to it;
e) Legal basis: performance of the minor's membership, which requires the authorisation of the person representing them (Article 6(1)(b) GDPR), and legitimate interest in confirming who acts on the minor's behalf (point (f));
f) End of access: when the member turns 18, the responsible persons' access ends automatically (including open sessions) and their data is deleted. The Secretariat can remove a responsible person at any time, who then loses access at once.
3.14 Section votes
a) What it is: some section votes are held on AAC's voting platform (eleicoes.academica.pt). For each vote, AAC checks who may vote under the rules set for it, in accordance with the applicable Statutes and regulations (for example, seniority in AAC or in the section, section fees up to date and minimum age), and prepares the electoral roll on the reference date;
b) Data: to check the rules, membership status, admission dates, date of birth and the section fees due on the reference date. The electoral roll contains the membership number and, depending on the vote, name, email, phone, date of birth, tax number and dates of admission to AAC and to the section. Anyone whose processing is restricted is left off the roll;
c) Who sees it: the AAC staff responsible for votes and the Board. While the vote is published, the voting platform reads the roll, only with the data chosen for that vote, over a secure connection and with its own key; every read is logged;
d) Legal basis: performance of the membership relationship under the Statutes and the electoral regulations (Article 6(1)(b) GDPR).
4. Cookies and storage in your browser and on your phone
4.1 The website uses no cookies for visitors. The exception is Cloudflare's technical cookie ("cf_clearance"), stored only when it asks for a security check, so it isn't repeated (point 5.2).
4.2 For the shop to work, the website keeps in the browser's local storage (these are not cookies and are not sent to third parties) only what is strictly necessary:
a) the cart: the items you chose, with size, colour and quantity;
b) the orders placed or found in this browser: the order number and an access code, so you can open them again without an account.
4.3 You can remove an order from this browser on the order page ("Remove from this browser"), or erase everything by clearing the site's data in your browser settings. The order still exists and you can open it again with the order number and the email used for the purchase (point 3.4).
4.4 The management dashboard, used only by AAC staff, uses a strictly necessary session cookie and keeps a few of its users' preferences in the browser (for example, the active section and notifications).
4.5 The payment provider's page (ifthenpay or Stripe) may use its own cookies, needed for payment and fraud prevention, governed by that provider's policy.
4.6 The app stores on your phone:
a) your sessions and member card, in the system's secure storage, so it works offline;
b) the cart and orders placed on this phone;
c) the contact details of your last checkout, to prefill them next time;
d) preferences, saved events and followed structures;
e) a copy of public content, for up to 7 days, to work offline.
4.7 You can erase all of it in About the app › Request deletion of my data › Delete data from this phone.
5. Sharing of data
5.1 We do not sell data or use it for advertising. We only share what is necessary with:
a) The section you applied to, as described in point 3.2;
b) Service providers that process data on our behalf, under contract and only on our instructions, listed in point 5.2;
c) Authorities, when required by law (for example, the Tax Authority, through invoicing);
d) AAC's voting platform (eleicoes.academica.pt), only with the electoral rolls of section votes, as described in point 3.14.
5.2 The service providers are:
a) Hetzner Online (Germany): server hosting and backups, in the European Union;
b) IFTHENPAY, Lda. (Santa Maria da Feira, Portugal): payments and refunds (payment page, MB WAY, card and Multibanco references). If AAC uses Stripe Payments Europe (Ireland) instead of ifthenpay, Stripe handles payments;
c) Microsoft (Microsoft 365): sending emails;
d) Expo (650 Industries, USA), Apple Push Notification service and Google Firebase Cloud Messaging: delivering notifications (phone identifier and notification text);
e) Komoot (Photon, Germany): address suggestions when you type an address (only the typed text, sent by our servers, without your IP address);
f) Automatic translation (Google Cloud Translation or, without it, MyMemory): only texts AAC staff write to publish or send (news, events, join forms, newsletter, contact subjects) and ask to translate in the dashboard. No member data or messages are sent;
g) Maps: event and pickup location maps use Apple Maps (iOS), Google Maps (Android) or OpenStreetMap tiles served by our servers. The app does not send your location. "Open in maps" opens the maps app you choose, which is then governed by its own policy;
h) Hostinger International (Cyprus; servers in the Netherlands): hosting of AAC's voting platform, which receives the electoral rolls (point 3.14), in the European Union;
i) Cloudflare (USA, with data centres in the EU as well): protecting the website, the dashboard and the app from attacks and delivering pages faster. Every request goes through Cloudflare before reaching our servers, including your IP address. It also runs the anti-bot check on the public forms (Turnstile).
5.3 Some of these providers (Stripe, when used, Microsoft, Expo, Apple, Google, Cloudflare) may process data outside the European Economic Area, notably in the USA. In those cases the transfer relies on an adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission.
6. Data retention
6.1 Your personal data is kept for the following periods:
a) Sign-in and confirmation codes (including email change codes): valid for 10 minutes; deleted after 1 day;
b) Member sessions: up to 180 days after signing in (or until you end them); deleted 30 days after ending. A responsible person's sessions also end when they are removed or when the member turns 18;
c) Member data: while you are a member. When you leave, your app session ends at once and your record is deleted after 24 months (a period set by AAC), with payments kept anonymised for the period in point (g). You can ask for deletion earlier;
d) Requests to change your details: until the Secretariat decides (or you cancel them); once decided, 30 days;
e) Responsible persons of underage members: until the member turns 18; if removed earlier, 30 days after removal;
f) Section membership requests: until the section decides, at most 6 months (after that, the request is deleted). If declined, the request is deleted after 30 days; if approved, the form is kept while you are a member of that section and deleted when you leave;
g) Invoices, payments, refunds and orders: 10 years, the period required by tax and accounting law. If you ask for deletion earlier, contact details on orders and payments are anonymised and only what the law requires is kept;
h) Contact messages and reports: up to 24 months after the last change (a period set by AAC). Data deletion requests are kept for 3 years, to prove they were handled. Automatic staff alerts about new messages (without your name) are deleted after 90 days;
i) Newsletter: while you are subscribed. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe, we keep your email marked as unsubscribed so we do not send again; you can ask for it to be deleted;
j) Notifications: until you turn notifications off, erase the phone's data or go 13 months without using the app;
k) Electoral rolls: until the vote is closed plus 90 days (a period set by AAC); after that only the vote summary (rules and number of voters) is kept, without the voters;
l) Security and audit logs: 3 years;
m) Backups: 7 days on the server and 30 days in external storage, replaced in the normal cycle.
7. Your rights
7.1 Under the GDPR, you can ask AAC, at any time and free of charge, for:
a) Right of access: confirmation that your data is processed and a copy of it;
b) Right to rectification: correction of inaccurate or incomplete data, in the app (Section fees › My details, as described in point 3.1) or through Support;
c) Right to erasure: deletion of your data, in the app (About the app › Request deletion of my data, or in Section fees) or on the website, on the Delete data page;
d) Right to restriction of processing: restriction of processing in certain circumstances. While restricted, your data is only stored: you cannot sign in to the member area, no new fees are created, sections stop seeing you and automatic deletion is suspended;
e) Right to object: to processing based on legitimate interest;
f) Right to data portability: the data you gave us, in a structured format;
g) Right to withdraw consent: for the newsletter, notifications or the health answer, without affecting earlier processing.
7.2 We reply within one month, extendable by two more in complex cases, explaining why. We may ask you to confirm your identity.
7.3 You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).
8. Minors
8.1 The app and the website are mainly for AAC students and members, but some sections accept underage members.
8.2 Children under 13 may only subscribe to the newsletter or turn on notifications with the authorisation of their parents or legal guardian (Article 16 of Portuguese Law 58/2019).
8.3 Anyone under 18 who asks to join a section must name a responsible person, who authorises the request with the code sent to their email (point 3.13).
8.4 Until the member turns 18, their responsible persons (up to two) can sign in to the member area and exercise the rights in point 7 on their behalf. At 18, the responsible persons' access ends and their data is deleted.
9. Data security
9.1 All communications use HTTPS.
9.2 Personal data (names, emails, dates of birth, tax numbers, addresses, phones, identification details, responsible persons, change requests, join forms, electoral rolls and messages) and invoices are stored encrypted (AES-256), with a key kept separately from the database. Backups are encrypted too. Codes and sessions are only stored as a cryptographic hash.
9.3 Each staff role only sees the data it needs. Signing in to the dashboard requires the password and a second factor (an authenticator app, mandatory for roles that manage members, payments or votes, a passkey or a code sent by email), and the member register is only available in the dashboard (not in the app). Every access to member data is logged.
9.4 The membership declaration is digitally signed by AAC and protected against editing: any change to the document invalidates the signature.
9.5 Published images are processed to remove metadata such as location.
9.6 In the event of a personal data breach, AAC notifies the CNPD within 72 hours and, where there is a high risk to your rights, you as well.
10. Changes to this policy
10.1 We may update this policy when the app, the website or the law change. The date of the last change is shown at the top.
10.2 If the change is significant, we will let you know in the app or by email.