Preview version, under review. I am not taking bookings yet.

Contact

Privacy policy

Courtesy translation. If there is any difference, the Portuguese version prevails.

In short

This site does not use cookies, analytics or forms. The data I process is what you give me when you contact me and, if we work together, what is needed for that work to continue.

Some of that data is health data. I only process it with your explicit consent, keep it with access restricted to me, do not share it without your authorisation and delete it at the end of the period set out below. At any time you can ask to see it, correct it, take it with you or delete it.

DRAFT for review by a health law lawyer before publication Version of DATE.

Who is responsible for your data

Controller
Diogo Pinto, tax number (NIF) 254142125
Address
R. Ramalho Ortigão 65, Lj 5, 4760-091 Vila Nova de Famalicão, Portugal

I work alone. There is no appointed data protection officer: any question comes directly to me, through these contacts.

What data I process, why and on what basis

For each type of data, I state the purpose and the legal basis under the General Data Protection Regulation (GDPR).

Contact and bookings
Name, phone number, email and the messages you send me to book or ask questions. They are used to reply and organise sessions. Legal basis: steps prior to entering an agreement and performance of the agreement between us (Article 6(1)(b)).
Screening, history-taking and session notes
What you tell me about your situation, relevant health history and the notes I take during the process. They are used to know whether the work is appropriate and for the work to continue from session to session. This is health data. Legal basis: your explicit consent (Article 9(2)(a)), which I ask for before we start, in writing, on the admission form.
Wing Chun admission form
Contact details and the health history relevant to training safely (injuries, heart conditions, medication that affects exertion). This is health data. Legal basis: explicit consent (Article 9(2)(a)).
Invoicing
Name, tax number, service and amount. Used to issue invoices and meet tax obligations. Legal basis: legal obligation (Article 6(1)(c)). Invoices do not state what sessions were about.
Companies
Business contact details of those who request a proposal. Legal basis: steps prior to entering an agreement (Article 6(1)(b)).
Visits to this site
The site does not use cookies or analytics tools. The host (Cloudflare), like any server, receives technical connection data, such as your IP address, to deliver the pages and protect the site against abuse. I do not use this data for anything else. Legal basis: legitimate interest in the security of the site (Article 6(1)(f)).

I do not collect data I do not use, I do not profile you or make automated decisions about you, and I do not sell or give data to anyone.

Children and adolescents

Work with minors only takes place with the informed consent of their legal guardians, who also consent to the processing of the data. The scope and depth of the work are adjusted to age.

Who has access

Only I have access to session notes and forms. I share information with your doctor, psychologist or another professional only with your express authorisation and only as far as necessary.

To work, I use third-party services that process data on my behalf (processors). They are:

Notion
Session notes and forms, in a private space protected by a password and two-factor authentication. Notion Labs, Inc., United States.
Google (Gmail)
Email, including screening when it is done by email. Google LLC (United States) and Google Ireland Limited.
Cloudflare
Hosting of this site and receiving email sent to diogo@reconnectproject.pt, which is forwarded to Gmail. Cloudflare, Inc., United States.
WhatsApp
Messages and calls, including screening when it is done by WhatsApp. Messages are end-to-end encrypted. WhatsApp Ireland Limited (Meta group).
Instagram
Direct messages, when that is how you contact me. Meta Platforms Ireland Limited. Instagram messages are not the right channel to talk about health.
Portal das Finanças
Issuing invoices. Portuguese Tax and Customs Authority.

If you would rather your health history did not go through email or WhatsApp, we can do the screening by phone or in the first session.

Data outside the European Union

Some of these services belong to companies based in the United States. In those cases, the transfer relies on the standard contractual clauses approved by the European Commission and, where the company is certified, on the EU-US Data Privacy Framework. Notion Labs, Google LLC, Cloudflare, Inc. and Meta Platforms, Inc. are certified under it.

How long I keep data

Notes and forms
While the process is active and for five years after the last session or training. If you take a break and come back, I keep the form and ask you to update the health declaration. After five years, they are destroyed.
Contact messages
Deleted one year after the last contact, if no work follows.
Invoicing
Ten years, the period required by tax law. TO CONFIRM with accountant

Your rights

At any time and without giving a reason, you can:

  • ask to see the data I hold about you and receive a copy;
  • ask me to correct anything wrong or incomplete;
  • ask me to delete your data, except what the law requires me to keep, such as invoices;
  • ask me to restrict the use of your data or object to processing;
  • receive the data you gave me in a format you can take to another professional;
  • withdraw your consent. This does not make what was done up to then unlawful, but from that moment I stop processing that data and the work ends.

Just ask by email, phone or WhatsApp. I reply within one month at most.

If you feel your data has not been handled as it should, you can file a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados, at cnpd.pt. If you prefer, you can talk to me first.

How I protect data

Notes and forms are kept in accounts protected by a password and two-factor authentication, accessible only to me, on devices with screen lock and disk encryption. I do not print session notes. If there is ever a data breach that could affect you, I will inform you and the CNPD within the time limits set by law.

Changes to this policy

If this policy changes in a relevant way, the date at the top is updated and, if we are working together, I will tell you directly.