Privacy and cookie policy
What this site collects, on what basis, for how long, and what you can do about it.
Who is responsible
The controller of the data collected through this site is Cascais SAD, based in Cascais, Portugal.
You can contact us about anything to do with personal data at marketing@csc.pt, which is where every request is handled. We answer within one month, as article 12 GDPR requires.
The short version
This site asks you for nothing in order to read it. There is no account, no profiling, no advertising, and nothing is sold or shared with advertisers.
While you read, your browser talks to nobody else: the typefaces are served by us, the images — including those from Instagram and the shop — pass through our own server before they reach you, and there is no embedded video, map or social button anywhere on the page.
The one exception is Google Analytics, and only after you accept it. If you refuse, or simply do not answer, nothing is requested from Google and nothing is stored on your device for that purpose.
There are three moments where we end up with data about you, all of them at your initiative: when you accept analytics cookies, when you subscribe to the newsletter, and when you fill in the partnership form. Each is set out below.
What we collect, why, and on what basis
Each row is a separate activity. If you do nothing but read, only the first two apply to you.
Serving and protecting the site
- Data
- IP address, browser type, page requested, date and time — in our host’s technical logs. Not linked to you and not used to identify you.
- Legal basis
- Legitimate interests (art. 6(1)(f) GDPR): delivering the pages and detecting abuse.
- Kept for
- Held only briefly by the host and used for nothing else.
Remembering the language you chose
- Data
- The NEXT_LOCALE cookie, holding “pt” or “en” and nothing else.
- Legal basis
- Necessary to provide the service you asked for by switching language (art. 5(2), Portuguese Law 41/2004).
- Kept for
- Until you close your browser.
Remembering your answer about cookies
- Data
- The csc-consent cookie, holding “granted” or “denied” and nothing else.
- Legal basis
- Necessary to honour your choice and not ask again (art. 5(2), Portuguese Law 41/2004).
- Kept for
- Six months, after which we ask once more.
Knowing how many people visit the site
- Data
- Pages viewed, language, approximate country and city, device type, and a random identifier stored in Google Analytics’ cookies. Never your name or your email address.
- Legal basis
- Your consent (art. 6(1)(a) GDPR and art. 5(1), Portuguese Law 41/2004).
- Kept for
- The cookies last up to two years on your device; you can delete them at any time, and we delete them if you withdraw consent. Google retains the underlying event data for at most 14 months.
Sending you the club newsletter
- Data
- Your email address. Nothing else — we ask for no name and no other detail.
- Legal basis
- Your consent (art. 6(1)(a) GDPR).
- Kept for
- Until you unsubscribe. Every email carries the way to do it.
Answering your partnership enquiry
- Data
- Business name, your name, your email, and — if you choose to fill them in — a phone number and a message. We also store which language the form was in and when it arrived, so we can reply in the same language.
- Legal basis
- Your consent, given by the box you have to tick to send the form (art. 6(1)(a) GDPR). If the contact leads to a partnership, the processing becomes necessary for that contract instead (art. 6(1)(b)).
- Kept for
- While the conversation is live and for up to 24 months after the last contact, unless you ask us to delete it sooner or it leads to a contract, in which case statutory record-keeping periods apply.
How to change your mind
At any time, under “Cookie preferences” at the bottom of any page. The question comes back and you can answer differently.
If you withdraw consent we stop loading Google Analytics and immediately delete the _ga and _ga_1S7RVK3CWE cookies from your device. Withdrawing does not affect the lawfulness of processing carried out beforehand, as article 7(3) GDPR provides.
To leave the newsletter, use the link at the foot of any email we send you, or write to us.
Who else has access
We do not sell or trade data. We use four service providers, who process data on our behalf, only on our instructions and under a processor agreement as required by article 28 GDPR:
- Vercel — hosting. Handles the technical logs described above.
- Sanity — the content system, where partnership enquiries are stored.
- Brevo — sending the newsletter, and sending the email that tells us about a new enquiry.
- Google — Google Analytics, and only if you accept analytics cookies.
Transfers outside the European Union
Some of these providers process data outside the European Economic Area, chiefly in the United States. Those transfers rely on the mechanisms in chapter V GDPR: the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework where the recipient is certified under it, and the Commission’s standard contractual clauses otherwise.
You can ask us which mechanism applies to which provider, at the address at the foot of this page.
What we do not do
We do not build profiles of you, we make no automated decisions with legal effect for you, and we carry out no profiling within the meaning of article 22 GDPR.
We do not collect special category data — health, beliefs, origin, orientation — and we ask for none of it on any form.
We use no advertising, no tracking networks, no third-party pixels and no embedded social widgets. The shop, the tickets, Instagram and YouTube open on third-party sites with policies of their own: while you are here those sites receive nothing about you; from the moment you click, their rules apply.
Do you have to give us anything
No. You can read the whole site without giving us anything and without accepting any analytics cookie.
On the forms, the marked fields are the ones needed for the purpose in question: without an email address we cannot send the newsletter, and without a name, a business and an email we cannot answer a partnership enquiry. Not filling them in simply means that request does not go.
Children
Analytics cookies and the newsletter both rest on your consent. In Portugal, article 16 of Law 58/2019 sets 13 as the age from which that consent can be given for information society services; below it, consent rests with whoever holds parental responsibility.
We ask nobody their age and have no way to verify it, so we do not knowingly collect data about children. If you know that someone under 13 has accepted cookies or subscribed to the newsletter, write to us and we will delete whatever there is — no questions.
Your rights
Under articles 15 to 22 GDPR, you have the right to:
- Access — know what we hold about you and receive a copy.
- Rectification — correct anything wrong or incomplete.
- Erasure — ask us to delete what we hold about you.
- Restriction — ask us to pause processing while a question is settled.
- Portability — receive the data you gave us in a machine-readable form, or have us send it to someone else.
- Objection — object to processing based on legitimate interests.
- Withdrawal of consent — at any time, without giving a reason and at no cost, as described above.
If you think we have handled it badly
Write to us first if you like: it is quicker and it usually settles the matter.
You always have the right to complain to the supervisory authority, which in Portugal is the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa — www.cnpd.pt, geral@cnpd.pt.
Security
All traffic to this site is encrypted in transit. The access keys for the services we use exist only on the server and are never sent to your browser. Partnership enquiries sit in a private content system, reachable only by the people at the club who need to read them, and are stored as received rather than as something editable.
Changes to this policy
If what we do with data changes, this page changes with it and the date at the top becomes the date of the revision. The version published here is the one that applies.
For anything about your data, or to exercise any of the rights above:
Cascais SADCascais, Portugalmarketing@csc.pt