Privacy Policy

1.1 The entity responsible for the collection and processing of your personal data is Guindais Eventos, Lda., tax registration number (NIPC) 515961787, based at Porto, Portugal.

1.2 For any questions concerning the protection of your personal data or to contact our Data Protection Officer (DPO), you may use the email contact@casadasmaquinas.com.

2.1 The processing of personal data by Casa das Máquinas is governed by the principles of lawfulness, fairness, and transparency, ensuring that information is handled clearly and on valid legal grounds.

2.2 The principles of purpose limitation (collection for specified, legitimate purposes), data minimization (collecting only what is strictly necessary), and accuracy of processed data are strictly observed.

2.3 Data is retained only for the period necessary to fulfill its respective purposes and is protected under the principles of integrity and confidentiality against unauthorized access, accidental loss, or destruction.

3.1 Ticketing and Registration Data: Full name, email address, telephone number, and selection of the date and time slot of the visit.

3.2 Tax and Billing Data: Billing name, address, and Tax Identification Number (NIF), should the Customer request an invoice with a tax ID.

3.3 Payment Data: Transaction validation details issued by the secure payment gateway. The Operating Entity does not access or store full payment card numbers or security codes (CVV).

3.4 Video Surveillance Footage (CCTV): Footage recorded by security cameras in public circulation areas and entrances to the physical premises of Casa das Máquinas.

3.5 Customer Support and Complaints: Data provided in connection with information requests, support inquiries, date/session change requests, or formal complaints.

3.6 Marketing Communications: Email address provided voluntarily to subscribe to newsletters and receive updates regarding new exhibitions and events.

3.7 Browsing Data: Anonymized IP address, pages visited, device details, and statistical parameters gathered via consented cookies.

4.1 Ticket Sales and Access Management: Processing ticket orders, issuing digital tickets, and managing entry to sessions. Legal basis: Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).

4.2 Compliance with Tax and Legal Obligations: Issuing legal invoices, accounting records, and compliance with statutory tax obligations. Legal basis: Compliance with a legal obligation (Art. 6(1)(c) GDPR).

4.3 Safety of People and Property (CCTV): Protecting premises, crime prevention, and detection. Legal basis: Legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR, and Private Security Legislation).

4.4 Operational Communications and Support: Sending booking confirmations, urgent notifications, or session rescheduling. Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

4.5 Marketing and Cultural Outreach: Sending news, upcoming exhibitions, and promotional campaigns. Legal basis: Explicit and revocable consent of the data subject (Art. 6(1)(a) GDPR).

4.6 Browsing Analysis and Continuous Improvement: Collecting anonymous statistics to improve website experience. Legal basis: Consent of the data subject via cookie settings (Art. 6(1)(a) GDPR).

5.1 Tax and Accounting Records: Retained for the statutory mandatory period of 10 years.

5.2 Ticketing and Booking Data: Retained throughout the duration of the contract and kept for 3 years following the visit for history, warranty, and complaint management.

5.3 Video Surveillance Footage (CCTV): Retained for the strict statutory period of 30 days, after which it is automatically and permanently erased, unless required in pending criminal proceedings.

5.4 Marketing Subscriptions: Retained until the data subject withdraws consent (opt-out) or requests unsubscription.

5.5 Disputes and Complaints: Retained until definitive resolution of proceedings or the expiration of applicable legal limitation periods.

6.1 Service Providers (Processors): Limited to essential providers (online ticketing platform, payment gateways, web hosting, and email platforms), all subject to strict confidentiality and security obligations under the GDPR.

6.2 Public Authorities: Communication of data when required by law to the Tax and Customs Authority, law enforcement, or competent courts.

6.3 Non-Commercialization: Guindais Eventos, Lda. does not sell, rent, or commercially disclose your personal data to third parties for advertising purposes.

7.1 Personal data is primarily processed within the European Economic Area (EEA).

7.2 When international technology providers are used (e.g., Google LLC analytics tools), recognized legal safeguards are ensured, such as the EU-U.S. Data Privacy Framework and European Commission Standard Contractual Clauses.

8.1 Data subjects may exercise their rights of Access, Rectification, Erasure (Right to be Forgotten), Restriction of Processing, Portability, and Objection, pursuant to Articles 15 to 22 of the GDPR.

8.2 Data subjects also have the right to withdraw marketing consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

8.3 Rights may be exercised by written request addressed to Guindais Eventos, Lda. via email at contact@casadasmaquinas.com or by post to Rua Arnaldo Gama 101.

8.4 Data subjects have the right to lodge a formal complaint with the competent national supervisory authority: the National Data Protection Commission (CNPD) via www.cnpd.pt.

9.1 The Operating Entity implements appropriate technical and organizational measures to prevent the loss, misuse, alteration, or unauthorized access to personal data collected.

9.2 Website communications are encrypted using SSL/HTTPS protocols, with strict physical and digital access controls in place for all information systems.

10.1 The Website uses cookies to deliver essential browsing functionalities, store preferences, and compile anonymous visitor statistics.

10.2 For detailed information regarding each cookie category and managing preferences, please refer to our Cookie Policy; consent may be modified or revoked at any time via the settings button in the website footer.

11.1 This Privacy Policy may be revised and updated periodically to reflect regulatory amendments or operational enhancements, taking effect immediately upon publication on the Website.

11.2 The applicable version is always the one available online on this page, indicating the date of the latest revision: 15 October 2026.