Security and Privacy Policy

1. Introduction and commitment to privacy

FindB Europa recognises the importance of privacy, personal data protection and information security in the digital environment.

This policy sets out the principles and rules that govern the personal data we collect through the FindB Europa institutional website and portfolio, in particular to present the brand, receive professional contacts, develop strategic partnerships, engage with businesses, identify sponsors and receive commercial proposals.

It has been prepared with reference to the General Data Protection Regulation (EU) 2016/679 (GDPR), the applicable European rules on privacy and electronic communications and, where relevant, the national law of the countries in which we operate.

We commit to processing personal data lawfully, fairly and transparently, and only for specified and legitimate purposes. No policy can guarantee zero risk, so we also apply technical and organisational measures that match how this website really works.

2. Who is responsible for your data

For GDPR purposes, the data controller is the entity that decides why and how personal data is processed. The details below identify the brand and the contact points for privacy matters.

• Brand: FindB Europa, The Immigrant Social Network.
• Institutional website: www.joaodelabernarde.com. Official platform: comunidadesfindbeuropa.com.
• Privacy contact: Alesca de Labernarde and João Carlos de Labernarde.
• Privacy email: suporte@comunidadesfindbeuropa.com.
• Commercial partnerships: partnerships@findbeuropa.com and parcerias@findbeuropa.com.
• Postal address for contact purposes: Rua Marechal Zagalo, 42, 3880-250 Ovar, Aveiro, Portugal.
• Data Protection Officer: no Data Protection Officer has been appointed. The GDPR does not require every organisation to appoint one, as it depends on the criteria in Article 37.

2.1 Scope

This policy applies to personal data processed in connection with:

• Visits to the FindB Europa institutional website and portfolio.
• Contact requests and requests for an institutional presentation.
• Applications for commercial and strategic partnerships.
• Enquiries from businesses interested in sponsoring the platform.
• Institutional collaboration proposals.
• Contacts from potential investors, sponsors, affiliates and partners.
• Follow-up communications about contact requests or commercial negotiations.
• Security operations and technical maintenance of the website.

2.2 What this policy does not cover

If you are redirected to another platform, an external form or a third-party service, that service's own privacy policy may also apply. Other FindB Europa features, such as the social network, communities and member services on the official platform, are governed by their own specific policies.

3. Purposes of processing

We use personal data only for legitimate, specific purposes that are compatible with the context in which you gave it to us.

3.1 Receiving and managing professional contacts

We process data to:

• Receive and answer contact requests and questions about FindB Europa.
• Identify businesses interested in the platform.
• Organise commercial contacts and schedule institutional meetings.
• Provide information about projects, services and collaboration opportunities.
• Follow up on outstanding enquiries.

3.2 Managing strategic partnerships

When a person or business shows interest in a partnership, we may process data to assess the proposal, understand the products or services offered, identify opportunities for cooperation, arrange meetings, prepare commercial proposals, negotiate terms, formalise contracts and keep the records needed to show our decisions and commitments. Submitting a proposal does not mean it will be accepted.

3.3 Sponsorships and institutional opportunities

We may use data to assess sponsorship, institutional support and commercial collaboration proposals. This can include professional information about the proposing business, its contact person and role, the proposal and the commercial terms discussed. We do not ask for excessive personal data or confidential information without a specific need and an appropriate legal basis.

3.4 Security and prevention of misuse

Technical data and activity logs may be processed where strictly necessary to protect the website from unauthorised access, identify fraud attempts, prevent cyberattacks, detect abusive use of forms, investigate security incidents and keep the service available. These activities follow the principles of necessity, proportionality and storage limitation.

3.5 Legal obligations and protection of rights

Where necessary and legally justified, we may use data to comply with legal obligations, answer lawful requests from competent authorities, establish, exercise or defend legal claims, keep accounting or contractual records that the law requires and show compliance with data protection obligations.

3.6 Marketing communications

We may wish to send information about institutional news, projects, partnership opportunities and commercial initiatives. Promotional communications are not authorised merely because you submit a contact form.

Where the law requires prior consent, we ask for it separately, through a voluntary, specific, informed and unticked option. Even where another legal basis may apply, we follow the national rules on electronic communications and direct marketing.

You can object at any time to the use of your data for direct marketing. After a valid objection we stop using your data for that purpose, keeping only the minimum information needed to honour it and avoid further unwanted messages.

4. Categories of personal data

We collect only data that is adequate, relevant and necessary for each purpose. What we actually receive depends on what you choose to send.

• Professional identification: name, professional title or role, company or organisation, country of activity and, where necessary, city or region.
• Contact details: professional email address, business telephone number and other contact details you provide voluntarily. Giving a phone number does not authorise advertising by SMS, WhatsApp or other channels.
• Proposal data: the type of partnership, the product or service, a description of the proposal, area of activity, any budget or commercial terms you choose to share, contact preferences and relevant professional information.
• Technical and browsing data: depending on how the website is configured, data such as IP address, access date and time, browser type, operating system and security logs kept by our hosting provider. We only use this data for operation, security and the other legitimate purposes described here. For abuse prevention we store only a keyed hash of the IP address that changes every day, deleted after one day, and records of login attempts to the staff area, deleted after two days.
• Form and booking data: everything you type into the partnership proposal form, the meeting booking form or the BlackSells agency enquiry form, the meeting date and time you choose and, for bookings, your name and email, together with the date and wording version of the consent you gave.
• Professional contact data: details of a company representative, director, employee or owner can still be personal data if they identify a natural person. A business context does not remove GDPR protection.

4.1 Data we ask you not to send

Our forms do not ask for identity documents, personal banking details, passwords, health information, religious beliefs, political opinions, information about sex life, biometric data or other special categories of personal data under Article 9 GDPR. Please do not include this kind of information in free-text fields.

5. Legal bases for processing

We identify the legal basis for each purpose under Article 6 GDPR. There is no single basis for every operation.

5.1 Pre-contractual steps and business relationships

When you ask for information or start negotiations with us, some processing is necessary to take steps at your request before a possible contract (Article 6(1)(b) GDPR). This applies only when the processing is genuinely necessary for what you asked.

5.2 Legitimate interests

We may rely on legitimate interests (Article 6(1)(f)) where processing is necessary for a legitimate purpose and your rights and freedoms do not override it, for example answering professional enquiries, managing existing business relationships, protecting systems against fraud and abuse, keeping the website secure and defending legal claims. This is not a general permission for unrestricted advertising, indiscriminate data collection or unlimited monitoring of visitors.

5.3 Consent

We use consent where it is the right basis, such as for optional promotional communications and for the optional cookie categories. Consent must be freely given, specific, informed and unambiguous, and you can withdraw it as easily as you gave it. Withdrawal does not affect processing carried out before it.

5.4 Legal obligations

Where necessary, we process data to comply with legal obligations that apply to us (Article 6(1)(c) GDPR).

6. How our forms work

Forms matter because they let us identify potential partners, sponsors and interested businesses. To reduce risks, we follow these rules.

6.1 What happens when you submit a form

The partnership proposal form on the contact page, the meeting booking form and the BlackSells agency enquiry form on its dedicated page send the data you enter to our server, where it is stored in a database (PostgreSQL) hosted on infrastructure we control or by our hosting provider. Nothing is sent until you tick the consent box and submit the form.

The data is shown to authorised staff in a password-protected administration area, together with the date and the wording version of the consent you gave. When you book a meeting in an available time slot, we also store the booking (date, time, name and email).

The BlackSells form is the enquiry form of a separate agency brand, BlackSells, available on its dedicated page. Data sent through it is received by the BlackSells brand, operated by the same person, with the same storage and security, and is used only to answer that enquiry.

6.2 Minimised fields and privacy information

Forms ask only for data needed for the purpose. Before you submit, you have access to clear privacy information, and the form includes a consent box that you must tick yourself. This policy tells you:

1. Who the data controller is.
2. Why the data is collected.
3. The legal basis.
4. Who receives it, or the categories of recipients.
5. How long we keep it, or the criteria used.
6. Your rights.
7. How to contact us.
8. Your right to complain to the competent supervisory authority.

6.3 Separate marketing consent

If we ever use your contact for promotional campaigns that require consent, we will offer a separate option that is unticked by default. You can use the contact form without agreeing to promotional communications that are not needed to handle your request.

6.4 No incompatible reuse

Data you send us to answer a partnership enquiry is not used to create public contact lists, sell databases, pass contacts to other businesses for their own advertising, add you to messaging groups without proper authorisation or run unrelated marketing campaigns. Any additional use needs its own legal basis and transparency.

6.5 Security of forms

Our website uses HTTPS. Information you submit is not made public or sent to recipients who do not need it, and administrative access is restricted to authorised people.

7. Retention and deletion

We do not keep personal data indefinitely just because it was received through the website. Retention periods reflect the purpose, the necessity and the legal obligations that apply.

7.1 Retention criteria

We use the following reference periods and review them against how we actually work:

• Contact enquiries, partnership proposals, BlackSells enquiries and meeting bookings with no follow-up: up to 12 months after the last relevant interaction, unless a contract or legal duty requires longer.
• Commercial leads without active negotiations: up to 12 months after the last relevant interaction, subject to review.
• Ongoing negotiations: for the period needed to negotiate and legitimately follow up on the proposal.
• Data relating to concluded contracts: for the contract term and any additional period required by law.
• Marketing consent records: while we rely on the consent, keeping appropriate evidence of it.
• Marketing objection records: for as long as needed to honour the objection and prevent unwanted further messages.
• Abuse-prevention data: a keyed, daily-rotating hash of the IP address, deleted after one day, and login attempt records for the staff area, deleted after two days.
• Records subject to statutory retention: for the period the law requires.
• Data associated with disputes: for as long as needed to protect the rights involved, within legal limits.

7.2 Deletion or anonymisation

When data is no longer necessary and there is no legal obligation or other legitimate basis to keep it, we securely delete or anonymise it. Where technically feasible and legally required, deletion covers the active databases, contact-management systems, mailboxes used to store enquiries, exported copies and other systems under our control.

Where backups exist, deletion follows a documented retention cycle and takes technical and legal limits into account. Data that must be kept by law or to defend legal claims is restricted to that purpose and protected by access controls. We do not promise immediate deletion of every copy where our systems cannot guarantee it.

7.3 Deletion requests

You can send requests to suporte@comunidadesfindbeuropa.com. We assess them under Article 17 GDPR and the circumstances of each case. The right to erasure is not absolute, for example where we must keep data to comply with a legal obligation or to establish, exercise or defend legal claims. We answer within the legal deadlines. Authorised staff can also delete a record from the administration area at any time, which is how we honour erasure requests.

8. Sharing data with third parties

We do not sell personal data collected through this website. We share data only where there is a legitimate purpose, an appropriate legal basis and compliance with applicable law.

8.1 Technology service providers

Depending on how the website is configured, providers may include hosting and infrastructure, data storage, business email, anti-spam, cybersecurity and business communications services. Where a provider processes personal data on our behalf, a data processing agreement is in place where Article 28 GDPR requires it. Where a third party decides its own purposes, we assess its legal role separately. The database that stores form and booking data is hosted on infrastructure we control or by our hosting provider, which acts as a processor under our instructions.

8.2 Business partners and sponsors

Submitting a form to us does not authorise us to disclose your data to business partners or sponsors. If a specific sharing activity is needed, we inform you in advance, identify the purpose and establish the appropriate legal basis. Where sharing depends on consent, we obtain valid and specific consent.

8.3 Public authorities

We may disclose data to competent authorities where the law requires it or in response to a legally valid request, limited to what is necessary where possible.

8.4 Corporate transactions

In a merger, acquisition, reorganisation or transfer of assets, we may need to transfer certain data. Any such operation follows the GDPR principles, transparency duties and applicable safeguards.

9. International data transfers

Some of our team and providers may be established outside the European Economic Area (EEA), including in Brazil. Before any such arrangement, we identify the provider and the receiving entity, the destination country, the data categories, the purposes, any applicable adequacy decision, the safeguards required under Chapter V GDPR and any supplementary measures needed. The same applies to the database and hosting provider: if the servers are located outside the EEA, we rely on an adequacy decision or on appropriate safeguards.

Where no adequacy decision applies, transfers rely on appropriate safeguards such as standard contractual clauses, together with the assessments and additional measures that may be necessary. We do not use GDPR derogations routinely to get around the transfer rules.

10. Information security and technical measures

We implement technical and organisational measures that are appropriate to the risk to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Article 32 GDPR requires security that fits the risk, not a guarantee of invulnerability.

10.1 Secure communications

The website uses HTTPS with valid TLS certificates and an up-to-date configuration. We avoid unsecured connections and do not transmit personal data through unprotected channels.

10.2 Access controls

We apply the following measures where technically feasible:

• Restrict access to personal data to authorised people.
• Use individual accounts and strong passwords.
• Enable multi-factor authentication for administrative access.
• Revoke access when it is no longer required.
• Avoid shared administrative accounts without traceability.
• Keep appropriate logs of relevant operations.

10.3 System protection and secure storage

As appropriate, we assess and apply security updates, malware protection, protection against automated attacks, limits on access attempts, validation of form input, protection against code injection and common vulnerabilities, incident monitoring, secure management of credentials and keys, protected backups and recovery testing. Personal data is stored in systems with restricted permissions, and credentials, tokens and secret keys are never exposed in public code or visitor-facing pages.

10.4 Confidentiality and suppliers

People authorised to access data are subject to appropriate confidentiality obligations and may not use data for personal purposes. We assess the security of suppliers with access to personal data and, where necessary, set out processing instructions, confidentiality, security measures, assistance with data subject rights and incident response in contracts.

10.5 Limits of security assurances

Despite preventive measures, no digital system can guarantee absolute protection against every threat. We do not claim that our systems are invulnerable or that incidents can never occur. Our commitment is to implement, maintain and review measures suited to the risk and to respond appropriately to incidents.

11. Incident management and personal data breaches

A personal data breach may involve unauthorised access, disclosure, loss, destruction, alteration or unavailability of personal data. We follow an internal procedure:

1. Identify and contain the incident.
2. Secure affected systems.
3. Assess the nature and scope of the incident.
4. Identify the categories and approximate number of people affected.
5. Assess the risk to people's rights and freedoms.
6. Document decisions and actions.
7. Decide whether a supervisory authority must be notified.
8. Decide whether affected people must be informed.
9. Fix the vulnerabilities identified.
10. Review procedures to reduce the risk of recurrence.

11.1 Notification

Under Article 33 GDPR, we notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. If we cannot notify within that period, we give the reasons for the delay. Even where notification is not required, we document the breach as the law requires.

Where a breach is likely to result in a high risk to people's rights and freedoms, we communicate it to the affected people without undue delay, in clear language, unless a legal exception applies (Articles 33 and 34 GDPR).

12. Your rights

Under the GDPR you can exercise the rights that apply to your situation:

• Access: ask whether we process your data and obtain a copy and the information required by law.
• Rectification: ask us to correct inaccurate data or complete incomplete data.
• Erasure: ask us to delete data where the conditions in Article 17 are met. This right is not absolute.
• Restriction: ask us to restrict processing in the circumstances set out in Article 18.
• Objection: object to processing based on legitimate interests under Article 21 and, at any time, to direct marketing, including related profiling.
• Portability: receive data you provided in a structured, commonly used and machine-readable format where Article 20 applies.
• Withdraw consent: at any time, without affecting earlier processing.
• Complain: lodge a complaint with a competent supervisory authority, in particular in the EU Member State where you live, work or where the alleged infringement occurred (Article 77 GDPR).

12.1 How to exercise your rights

Send your request to suporte@comunidadesfindbeuropa.com, for the attention of the privacy contact (Alesca de Labernarde and João Carlos de Labernarde). Say which right you want to exercise and give enough information for us to assess it. We may ask for additional information strictly necessary to verify identity where we have reasonable doubts, and we do not ask for identity documents automatically or disproportionately.

Under Article 12 GDPR we generally answer within one month. This can be extended by two further months where necessary, given the complexity and number of requests, and we will tell you within the first month. Exercising your rights is free of charge except in the exceptional circumstances the law permits.

13. Cookies and tracking technologies

The use of cookies and similar technologies follows the GDPR and the applicable electronic communications privacy rules. Today this website uses only a strictly necessary storage item that remembers your cookie choices and, only if you agree, a functional item that remembers your language. We do not use analytics, advertising or marketing technologies. The full list, with purposes and durations, is in our Cookie Policy. Staff who sign in to the administration area receive a strictly necessary session cookie that is used only there and is never set for ordinary visitors.

If optional cookies are ever used, they stay blocked until you give consent, you can refuse as easily as you can accept, and you can change or withdraw your choice at any time.

14. External links and third-party platforms

The website may contain links to external services, social media pages and other digital resources. When you use them, the privacy policies and practices of their operators apply, and we do not control processing carried out independently by those entities. A link does not guarantee the safety, availability, legality or quality of the destination.

15. Children's data

The institutional portfolio and its forms are intended for partners, businesses and sponsors and are not designed to collect children's personal data. We avoid collecting it through these forms. If children's data is processed through other platform features, a separate legal assessment applies, taking account of Article 8 GDPR and national law.

16. Visitor responsibilities

Please use the website lawfully and respect third-party rights. When you complete a form, give accurate information and avoid submitting other people's personal data without an appropriate legal basis. Please do not:

• Attempt to gain unauthorised access to systems.
• Introduce malicious code.
• Use forms for spam or fraud.
• Submit passwords or confidential credentials.
• Send excessive or unnecessary personal data.
• Use the website for unlawful activities.
• Attempt to circumvent legitimate security measures.

17. Liability and limits of assurances

We take reasonable and proportionate measures to maintain website security, protect personal data and comply with our legal obligations. We do not claim that digital security is absolutely guaranteed, that incidents can never occur, that no third party can ever gain improper access or that publishing this policy removes all legal risk.

Nothing in this policy excludes or limits liability that cannot lawfully be excluded or limited, or restricts the rights the law gives you.

18. Changes to this policy

We may update this policy after relevant changes in the law, processing purposes, website forms, technology tools, suppliers with access to data, retention practices, security measures or procedures for handling rights. We communicate material changes where the law requires or transparency calls for it, and the date at the top shows the current version. We do not use changes to justify earlier processing that lacked an appropriate legal basis.

19. Privacy contact

For requests about access, rectification, erasure, objection, restriction or portability, or for questions about this policy, contact:

• FindB Europa, The Immigrant Social Network
• Privacy contact: Alesca de Labernarde and João Carlos de Labernarde.
• Email: suporte@comunidadesfindbeuropa.com.
• Postal address: Rua Marechal Zagalo, 42, 3880-250 Ovar, Aveiro, Portugal.
• Commercial partnerships: partnerships@findbeuropa.com or parcerias@findbeuropa.com.
• Privacy requests should go to the privacy contact and not be handled as ordinary commercial enquiries.

20. Legal references

This policy mainly refers to:

• Regulation (EU) 2016/679 (GDPR), including Articles 5, 6, 12 to 22, 25, 28, 32 to 34, 37 and 44 to 49.
• Directive 2002/58/EC (ePrivacy Directive), as amended and implemented in national law.
• The data protection legislation of the competent Member State.
• Regulation (EU) 2022/2065 (Digital Services Act), where it applies to the platform's actual activities.
• Portuguese Law No. 58/2019 of 8 August, implementing the GDPR in Portugal, where applicable.
• The Data Protection Act 2018 in Ireland, where applicable.
• Other applicable European and national rules on electronic communications, digital security, contracts and consumer protection.
• Official sources: eur-lex.europa.eu (GDPR text), commission.europa.eu (data protection) and dataprotection.ie (Irish Data Protection Commission).

21. Partnerships, commercial agreements and formal commitments

Any partnership, sponsorship, commercial collaboration or other business arrangement involving FindB Europa is formally concluded only once the parties have held a meeting, agreed the relevant terms and signed a written contract through their duly authorised representatives.

Submitting a proposal, expressing interest, exchanging emails, taking part in preliminary discussions or attending a meeting is not, in itself, final acceptance of a partnership and does not create a definitive contractual commitment on behalf of FindB Europa.

Agreements must clearly set out the scope of the collaboration, each party's rights and obligations, financial terms, responsibilities, duration, termination conditions and any other relevant provisions. We may assess, negotiate, accept or decline any proposal, subject to applicable law and any binding obligations already undertaken.

Nothing in this section excludes or overrides a legal obligation or binding agreement that may arise under applicable law, whatever the form in which it is concluded.