Identity of the Data Controller
The controller of your personal data is the Convoca team, reachable at ola@convoca.pt. Convoca is a platform for publishing and discovering local events in Portugal.
Data Protection Officer
The appointment of a Data Protection Officer (DPO) is not required for Convoca, as our data processing is small-scale and does not constitute a primary activity of processing sensitive data under Lei n.o 58/2019 of 8 August (Portugal's GDPR implementation law).
Purposes of Processing
We process your personal data for the following purposes:
Event publication: enabling organisers to publish local events and users to discover them.
RSVP management: processing your attendance confirmation and sending confirmations and reminders by email.
AI email processing: when you send an email to criar-evento@mail.convoca.pt, the content is automatically analysed by artificial intelligence to extract event details. The original email content is not stored after processing.
Legal Basis for Processing
Processing of your data rests on the following legal bases:
Legitimate interest (Art. 6(1)(f) GDPR): to facilitate local event discovery and connect community members.
Consent (Art. 6(1)(a) GDPR): when you submit an RSVP, you provide explicit consent to the processing of your email address.
Contract performance (Art. 6(1)(b) GDPR): for event organisers, processing is necessary to perform the requested service.
Legitimate Interests Pursued
The legitimate interest pursued by Convoca is to connect local community members with events near them, promoting the discovery of local events in Portugal in a free and universally accessible way.
Recipients of Data
Your personal data may be shared with the following sub-processors:
Convex (data hosting): platform data is hosted on Convex, Inc. infrastructure, with servers in the European Union.
Clerk (authentication): the user authentication service is managed by Clerk, Inc.
Resend (email delivery): transactional emails are sent via Resend, Inc.
OpenRouter (AI processing): email content is processed by OpenRouter, Inc. to automatically extract event details.
Transfers to Third Countries
Some of our sub-processors (Clerk, Resend, and OpenRouter) are based in the United States. Transfers are carried out on the basis of Standard Contractual Clauses approved by the European Commission, pursuant to Chapter V of the GDPR.
Data hosted on Convex is stored on servers located in the European Union.
Retention Periods
Personal data is retained for the following periods:
Event data: retained until the organiser requests deletion of the event.
RSVP data: retained until the end of the event plus 30 days, after which it is automatically deleted.
Email content: the original content is not stored after AI processing.
Data Subject Rights
Under the GDPR, you have the following rights:
Right of access (Art. 15): you may request a copy of the personal data we process about you.
Right to rectification (Art. 16): you may request correction of inaccurate data.
Right to erasure (Art. 17): you may request deletion of your personal data.
Right to restriction of processing (Art. 18): you may request temporary suspension of processing.
Right to data portability (Art. 20): you may receive your data in a machine-readable format.
Right to object (Art. 21): you may object to processing based on legitimate interests.
To exercise any of these rights, send an email to ola@convoca.pt. We will respond within 30 days.
Right to Withdraw Consent
Where processing is based on your consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing. Contact us at ola@convoca.pt.
Right to Lodge a Complaint
You have the right to lodge a complaint with the competent supervisory authority. In Portugal, the supervisory authority is the Comissao Nacional de Protecao de Dados (CNPD): www.cnpd.pt.
Voluntary Nature of Data Provision
Providing your personal data is entirely voluntary. There is no legal or contractual obligation to provide your email address. Refusal only prevents access to features that require email, such as RSVP.
Automated Decision-Making and Profiling
Convoca does not carry out automated decision-making with legal or similarly significant effects, nor does it profile individuals based on the personal data processed, within the meaning of Art. 22 GDPR.
Last updated: 2025-03-17