Privacy Policy

1. Introduction and Data Controller Overview

Carnivalsortsprk Media Lda. ("Carnivalsortsprk", "we", "us", or "our"), operating the domain carnivalsortsprk.bond, is dedicated to upholding the highest standards of data privacy and transparency. We act as the primary Data Controller under Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or GDPR) and relevant Portuguese national data protection legislation (Lei n.º 58/2019).

2. Data We Collect and Processing Foundations

We only collect personal information that is directly necessary to deliver our Portuguese café trails, newsletters, and interactive 3D experiences. Categories of data processed include:

• Directly Provided Information: When you subscribe to the Weekly Bica Bulletin or submit a message via our contact form, we collect your name, email address, and any specific inquiries submitted.
• Automated Device & Technical Telemetry: Anonymized IP addresses, browser engine user-agents, screen resolution, viewport geometry, WebGL rendering capabilities, time zones, and navigation pathways across our pages.
• Cookie & State Storage: Persistent preference flags stored strictly within your browser’s `localStorage` (such as consent confirmations) to ensure seamless UI persistence without invasive tracking.

3. Legal Bases for Data Processing

Under Article 6 of the GDPR, our legal bases for processing your personal data comprise:

• Consent (Art. 6(1)(a)): Explicit consent given when subscribing to our digital dispatches or electing to enable non-essential analytical cookies.
• Legitimate Interests (Art. 6(1)(f)): Monitoring network security, preventing distributed denial-of-service (DDoS) vectors, and diagnosing client-side WebGL rendering errors.
• Legal Obligations (Art. 6(1)(c)): Compliance with Portuguese tax, accounting, and regulatory transparency laws.

4. Third-Party Processors & International Transfers

We do not sell, rent, or trade your personal data to commercial data brokers. We only share essential metadata with trusted infrastructure processors including cloud hosting networks, content delivery networks (CDNs), and transactional email relays located within the European Economic Area (EEA) or protected under European Commission Standard Contractual Clauses (SCCs).

5. Your Rights Under European and Global Privacy Laws

As a data subject, you are entitled to exercise the following rights without fee or penalty:

1. Right of Access: Request a complete machine-readable copy of any personal data we hold associated with your email identifier.
2. Right to Rectification: Require the immediate correction of inaccurate or incomplete details.
3. Right to Erasure (“Right to Be Forgotten”): Demand the permanent deletion of your subscriber profile from all active marketing and database backups.
4. Right to Restrict or Object to Processing: Halt specific analytics or direct communication streams at any moment.
5. Right to Data Portability: Obtain your data formatted in standard JSON or CSV protocols.

6. Data Retention Protocols

Subscriber details are retained only for the duration of an active subscription. If you unsubscribe or request erasure, your records are permanently purged from our active relays within 30 days, except where financial retention laws mandate archival.

7. Data Protection Officer Contact Details

For any data protection inquiries, formal Subject Access Requests (SAR), or complaints, please reach out to our appointed Data Protection Officer at: