Privacy Policy

This policy explains how Tres Dias Portugal collects, uses, shares, and protects your personal data, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR) and Lei n.º 58/2019, of 8 August, the Portuguese law implementing the GDPR in national law.

1. Data Controller

Associação Três Dias com Jesus
Tax ID (NIPC): 519 130 960
Registered address: Rua Eça de Queirós 14, Silveira, 2560-447 Torres Vedras, Portugal
Email for privacy questions: geral@tresdias.pt

2. What Data We Collect

• Identification and contact data: name, email, phone number.
• Registration data: role (Pilgrim/Team), sponsor, application form responses.
• Payment data: processed directly by our payment provider (Stripe, transitioning to IfthenPay). We do not receive or store card numbers on our own servers.
• Account data: for members with access to the members area (training, documents, prayer), including session credentials.
• Communications: messages sent via our contact forms, newsletter sign-up, or prayer requests.

3. Purposes & Legal Basis

• Processing weekend registrations and payments — performance of contract.
• Processing donations and Legacy Partnership subscriptions — performance of contract / consent.
• Sending the newsletter and community communications — consent, revocable at any time.
• Managing the Prayer Vigil and prayer requests — consent.
• Administering member accounts and training — performance of contract.
• Complying with legal and tax obligations (e.g., accounting records for donations).

4. Who We Share Data With

We share data only with processors who provide us with essential services, under contractual confidentiality and security obligations:

• Stripe / IfthenPay — payment processing.
• Resend — transactional email and newsletter delivery.
• Neon (database) and Vercel (hosting) — technical infrastructure.
• Prayvine — an optional, external Prayer Vigil scheduling platform, if you choose to use it.

We do not sell or rent your data to third parties for marketing purposes.

5. International Transfers

Some of our processors may process data outside the European Economic Area. In these cases, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

6. Data Retention

We retain your data only for as long as necessary for the purposes described, including compliance with legal retention periods for tax and accounting records. You may request deletion of your data at any time, per Section 8.

7. Cookies

We use only a strictly necessary session cookie for authentication in the members and admin area. We do not use advertising or tracking cookies. Your light/dark theme preference is stored locally in your browser (localStorage), not as a cookie.

8. Your Rights

Under the GDPR, you have the right to access, rectify, erase, restrict, or object to the processing of your data, as well as the right to data portability and the right to withdraw consent at any time. To exercise these rights, contact us at geral@tresdias.pt.

You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Portugal's data protection authority — www.cnpd.pt.

9. Children

Our services are intended for adults aged 18 and over. We do not knowingly collect data from minors without verifiable parental or guardian consent.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The version in force is always the one published on this page, with the last-updated date indicated above.