Privacy and Cookies

Last updated: November 15, 2026

Data controller

The controller of your personal data is [NOME DA ENTIDADE RESPONSÁVEL], tax number [NIF], registered at [MORADA COMPLETA]. For any privacy question, write to [EMAIL DE CONTACTO].

What data we collect

• Account data: name, email and account identifier, provided by Google or Microsoft when you sign in. We never receive your password.
• Signature data: the drawing, colour, position on the shirt, the name you choose to display, your optional message to Cristiano, the country and optional city you enter, and the date and time.
• Technical data: IP address, browser type and access logs, kept by our providers for security reasons.

Why we use it and our legal basis

• Managing sign-in and ensuring one signature per person: performance of the Terms (Article 6(1)(b) GDPR).
• Publicly displaying your signature, chosen name and message: your consent, given when you sign (Article 6(1)(a)). You can withdraw it by deleting your signature.
• Security and abuse prevention: our legitimate interest (Article 6(1)(f)).
• Meeting legal obligations, where they apply (Article 6(1)(c)).

What is public

Only your signature, its colour, its position, the name you choose to display, the country and city you enter and your message, if you write one, are public. Your email is never shown. If you prefer, use just your first name or a nickname.

Who we share it with

• Supabase: database hosting and authentication.
• Google and Microsoft: sign-in services, under their own privacy policies.
• [FORNECEDOR DE ALOJAMENTO, ex. Netlify]: website hosting.

These providers process data only on our behalf. We do not sell your data or use it for advertising.

Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area, in particular in the United States. In those cases the transfer is protected by the EU-US Data Privacy Framework or by the standard contractual clauses approved by the European Commission.

How long we keep it

We keep your data while your account and signature exist and for the duration of the Campaign. When the Campaign ends, we delete or anonymise account data within 12 months. Public signatures may remain in a commemorative archive, and you can ask for yours to be removed at any time. Technical logs are kept for the short periods set by our providers.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw your consent at any time. You can delete your signature directly on the Site or write to [EMAIL DE CONTACTO]. We reply within one month. You also have the right to lodge a complaint with the Portuguese Data Protection Authority, CNPD (www.cnpd.pt), or with the authority in your country.

Children

In Portugal, the age from which a person can consent alone to online services is 13. Children under 13 may only take part with permission from a parent or legal guardian. If we learn that a child took part without that permission, we will delete the data.

Cookies and local storage

We do not use advertising or analytics cookies. We only use local storage that is strictly necessary for the Site to work: keeping you signed in and remembering your chosen language. Because it is essential, it does not require consent. If we ever add analytics, we will update this policy and ask for your consent first.

Security

We use encrypted connections (HTTPS), database security rules and restricted access to data.

Changes

We may update this policy. The date of the latest update is shown at the top of this page, and we will announce important changes on the Site.