Privacy Policy
Effective Date: 27/06/2025
1. Organization Details
This Privacy Policy applies to the activities of ASSOCIAÇÃO CRISTÃ – AS IGREJAS EM PORTUGAL, henceforth referred to as ACIP (“we”, “us” or “our”), a nonprofit association headquartered at Rua Cruz da Carreira, 4B, 1150-119 Lisboa, Portugal, and operating publicly under the name Life for All – Europe.
ACIP is the legal entity and data controller for all activities carried out under the name Life for All – Europe. When you interact with us through this public identity (e.g., events, websites, live streams, social media, or email), your data is collected and processed by ACIP under this Privacy Policy.
For questions regarding data protection, please contact our Data Protection Officer at staff@lifeforall-europe.org
2. What Personal Data We Collect
The ACIP may collect and process the following types of personal data:
- Full Name
- Email Address
- Phone Number
- Birthday, Gender, Country of Birth
- Country and City of Residence
- Spoken Languages
- Allergies (Food or Medicine)
- Arrival/Departure flight number and travel info (when needed for transport coordination)
- Event participation data
- Photographs and video recordings during events
- IP address, device and browser data
- Live streams interactions (via YouTube)
- Payment confirmation documents (e.g., bank transfer proof with sender details and transaction data which may include IBAN, sender name, transaction ID, and bank details)
When payment confirmations are submitted via WhatsApp, we may collect the sender’s phone number and any other personal data included in the message or media.
3. How We Collect Your Data
The ACIP collects your data when:
- You register for events via Google Forms
- You contact us or provide information directly
- You participate in live streams or physical events
4. Why We Collect Your Data
The ACIP processes your data to:
- Register and organize guests for events
- Coordinate event logistics (e.g. dietary needs, travel pickups)
- Accept and manage donations
- Manage volunteers and service teams
- Archive photos and videos for church promotion or historical record
- Enable live streaming and media display during events
- Confirm event payments and reconcile transactions with participant registrations
5. Legal Basis for Processing
The ACIP processes your data on the basis of:
- Consent: You provide it voluntarily during registration
- Legitimate interest: To organize events and ensure proper care of participants
- Legal compliance: (where applicable)
- Contractual necessity: To confirm and reconcile event payments (Art. 6(1)(b))
We do not require the use of WhatsApp to submit payment proof and offer alternative methods (e.g., email). Processing via WhatsApp occurs based on legitimate interest and user-initiated contact.
We do not use your personal data for automated decision-making or profiling.
6. How Your Data Is Stored
The ACIP will be responsible in the way your data is collected and stored, as such:
- All data is stored using Google Drive, Google Sheets, and Google Forms
- Access to personal data is limited to authorized personnel who require it for specific tasks, and we follow the principles of data minimization and security by design
- There are proper procedures to ensure our volunteers handles your data in accordance with GDPR and applicable law
Use of Third-Party Platforms (Google Services)
We store and process data using free Google services, including Google Drive, Google Forms, and Google Sheets. While we do not have a customized Data Processing Agreement with Google, we rely on their publicly available data protection terms and privacy commitments, which include compliance with the General Data Protection Regulation (GDPR).
More information is available at https://policies.google.com/privacy and https://cloud.google.com/security/gdpr
Use of WhatsApp for Communication
In some cases, participants may send payment confirmations or event-related data via WhatsApp. These messages are processed through WhatsApp’s platform, which is owned by Meta and may involve data transfers outside the European Economic Area (EEA). While we do not require or encourage the use of WhatsApp for sending sensitive data, if such information is received, it is handled in accordance with this Privacy Policy and stored only on secure, authorized devices.
International Data Transfers
Some of the third-party services we use (such as Google Forms, Drive, and YouTube) may transfer or store personal data outside the European Economic Area (EEA), including in the United States. In such cases, we rely on the Standard Contractual Clauses (SCCs) and other safeguards provided by these service providers to ensure adequate protection of personal data, in line with GDPR requirements.
We have reviewed Google’s data processing and international transfer policies to ensure they align with GDPR standards, and take appropriate measures to assess and mitigate associated risks.
Additionally, when participants contact us via WhatsApp, Meta Platforms may process personal data. This may involve international transfers outside the EEA. Meta states that such transfers are safeguarded using Standard Contractual Clauses. More details are available at https://www.whatsapp.com/legal/privacy-policy-eea.
Data Breach Notification
In the event of a data breach involving your personal data and posing a risk to your rights and freedoms, we will notify you and the relevant authorities in accordance with GDPR Articles 33 and 34.
7. How Long We Keep Your Data
The ACIP retains personal data only for as long as necessary to fulfill the purposes for which it was collected, in accordance with GDPR guidelines. Our general retention periods are:
- Event Registration Data: 2 years after the event date
- Medical or Dietary Information: Deleted within 30 days after the end of the event
- Travel Information (e.g., flight details): Deleted within 30 days after the end of the event
- Images and Videos from Events: Up to 5 years unless consent is withdrawn
- Volunteer Information: Retained for as long as the person remains an active volunteer, and up to 2 years after inactivity
- Contact Information for Donations or Legal Purposes: Retained for up to 7 years in accordance with applicable tax and legal obligations.
- Minors’ Data: Retained no longer than 2 years after the event or until consent is withdrawn
- Payment confirmation documents: Retained for up to 2 years after the event, or up to 10 years if required by applicable financial or tax regulations.
After the retention period, the data will be securely deleted or anonymized.
8. Use of Cookies and Trackers
Our website uses only strictly necessary cookies that are essential for the proper functioning of the site. These cookies do not collect personal data for marketing or analytics purposes. No optional or third-party cookies (e.g., for advertising or analytics) are used.
The cookies we use include:
- wpEmojiSettingsSupports: Ensures emoji compatibility across browsers.
- elementor: Stores actions performed by the user within the Elementor page builder to support dynamic interface rendering.
If we introduce any non-essential cookies (e.g., for analytics or media embeds), we will update this policy and implement a cookie consent banner in compliance with GDPR and ePrivacy regulations.
9. Photos and Videos
By attending our events, you consent to being recorded (photo/video).These materials may be:
- Displayed live on projection screens
- Live Streamed online (e.g., YouTube)
- Used in future church communications or promotional material
All event registration and participation forms include a required checkbox for users to confirm that they have read and agreed to our Privacy Policy. This includes:
- Consent to collect and store their data as described
- Optional separate consent for use of images or video recordings during events
Consent for image or video use is requested through a separate, unticked checkbox on all event registration forms. Refusing this consent does not affect participation in the event.
10. Consent on Registration Forms
All event registration and participation forms include a required checkbox for users to confirm that they have read and agreed to our Privacy Policy. This includes:
- Consent to collect and store their data as described
- Optional separate consent for use of images or video recordings during events
Consent decisions are recorded and stored securely. You may withdraw your consent at any time by contacting staff@lifeforall-europe.org.
If the participant is under 16, a parent or guardian must give consent on their behalf.
11. Children’s Data and Parental Consent
ACIP is committed to protecting the privacy of children who participate in our events. In accordance with the General Data Protection Regulation (GDPR), we apply special safeguards when collecting and processing personal data from minors under the age of 16.
Age Threshold
If a child under the age of 16 is registered for an event, the registration form will automatically request the contact details of a parent or legal guardian and trigger the parental consent fields.
Parental Consent Procedure
The registration form includes a specific section for parental or guardian consent, which requires:
- Full name of the parent or legal guardian
- Email address of the parent or legal guardian
- A required checkbox stating that the parent or legal guardian gives consent for:
- The child’s participation in the event
- The collection and processing of the child’s personal data in accordance with this Privacy Policy
- (Optional) The use of the child’s image or likeness in photos or video, where applicable
- A typed name (digital signature) of the consenting adult
This process allows us to obtain verifiable parental consent directly through the form submission.
What Happens If Consent Is Not Provided
Registrations submitted without valid parental consent for minors under 16 will be considered incomplete and will not be processed. These submissions may be deleted after 7 days unless consent is properly completed.
Verification of Parental or Guardian Identity
As a general rule, we do not require documentation to verify parental status. However, we reserve the right to request additional verification when:
- The registration appears incomplete, suspicious, or inconsistent
- Sensitive data is involved (e.g., medical or allergy information)
- The child is expected to appear in media content (e.g., photo/video or livestream)
- Extra verification is deemed necessary to ensure the safety and privacy of the child
In such cases, we may request proof of guardianship, such as a signed declaration or scanned ID.
Data Handling for Children
Children’s personal data is processed exclusively for purposes related to event organization, participation, safety (e.g., medical or dietary needs), and logistics (e.g., transport arrangements). This data is retained only for as long as necessary and may be deleted upon request by the parent or guardian.
Your Rights
Parents and legal guardians have the right to:
- Access the data we hold about their child
- Request corrections or deletions
- Withdraw their consent at any time by contacting us at staff@lifeforall-europe.org
12. Your Data Rights
In accordance with the General Data Protection Regulation (GDPR), you have the right to:
- Request access to your personal data
- Request correction or deletion of your data
- Withdraw consent at any time
- Object to or restrict certain types of data processing
You can exercise these rights in two ways:
- By submitting a request via the [Data Access/Deletion Request Form] available on our website
- By contacting our Data Protection Officer directly at staff@lifeforall-europe.org
The ACIP will respond to all valid requests within 30 days.
You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese Data Protection Authority, at www.cnpd.pt. If you reside in another EU member state, you may also lodge a complaint with your local data protection authority.
How to Submit a Request
You can exercise your data rights by contacting our Data Protection Officer at staff@lifeforall-europe.org
In your request, please specify:
- Your full name and contact information
- The nature of your request (e.g., access, correction, deletion, withdrawal of consent)
- If applicable, the event or activity you participated in
We may request additional information to verify your identity before processing your request.
We will respond within 30 days, in accordance with GDPR requirements.
13. Third Parties
We use YouTube to host live streams. When you engage with these live streams, YouTube may process your data under its own privacy policy, available at https://policies.google.com/privacy
14. Transparency
The name Life for All – Europe is used as a public-facing ministry identity. All data collected through this name is managed by ACIP, the legally registered data controller. There is no separate legal entity or structure behind the name.
15. Changes to This Policy
The ACIP may update this policy as needed to reflect changes in law or organizational practice. The updated version will be posted on our website.
Last updated: 18/06/2025
