Last updated: 3 October 2026
This policy explains how FEST – Associação Cultural, the organisation responsible for FEST FILM LAB, processes personal data when you visit our website, register for a workshop, contact us or subscribe to our newsletter. It covers filmlab.fest.pt and its staging website.
1. Who is responsible for your data
FEST – Associação Cultural, Portugal, is the data controller for our workshop administration and communications. For privacy enquiries or to exercise your rights, contact filmlab@fest.pt or telephone +351 227 327 545.
2. Information we process
Depending on your interaction with us, we process your name, email address, telephone number, country and any billing details needed for your purchase; the workshop selected, order reference, payment status and transaction reference; correspondence and information you provide in workshop questionnaires, such as professional experience, interests and learning objectives; and technical information such as IP address, browser information, security logs, session identifiers and cookie preferences.
If someone purchases a place on your behalf, we may receive your details from that purchaser. If you register another person, please inform them about this policy. Please avoid providing sensitive personal information or confidential information about other people in general enquiries or questionnaires.
3. Why we use your data and our legal grounds
- Workshop bookings and delivery: to process purchases, confirm paid registrations, provide workshop information, administer attendance and respond to booking enquiries. Our legal ground is taking steps at your request before a contract and performing that contract. Registration is confirmed after payment; an unpaid or abandoned order is not a confirmed place.
- Accounting and legal obligations: to maintain the records required by applicable law and respond to lawful requests. Our legal ground is compliance with legal obligations.
- Support and security: to resolve enquiries, protect the website, prevent misuse and fraud, and establish or defend legal claims. Our legal ground is our legitimate interest in operating a reliable service and protecting participants and the organisation, balanced against your rights.
- Newsletters: to send workshop announcements and related FEST FILM LAB news when you subscribe. Our legal ground is your consent. You can unsubscribe using the link in each newsletter or contact us. Withdrawing consent does not affect earlier lawful processing.
- Optional questionnaires: to help tutors understand participants’ professional backgrounds and tailor sessions. Information necessary to deliver the workshop is processed for that contract; optional information is provided voluntarily. A questionnaire does not determine whether a paid registration is accepted.
Information marked as required at checkout is needed to process the purchase or satisfy relevant billing requirements. Without it, we may be unable to complete your booking. Newsletter subscriptions and optional questionnaire answers are not conditions of purchasing a workshop. Booking and practical emails are separate from marketing subscriptions.
4. Payments and service providers
Payments are processed through Stripe or PayPal, depending on the workshop. Card details are handled by the payment provider; FEST FILM LAB does not store full card numbers or card security codes. We receive the information needed to associate a payment with its order. Payment providers also process data for their own regulatory, security and fraud-prevention purposes under their privacy notices: Stripe and PayPal.
Authorised FEST staff have access where needed for their work. We use hosting, email, maintenance and backup providers to operate the service, MailerLite for newsletters, and Google services for questionnaires and administrative documents. Tutors and workshop partners may receive only the participant information needed for workshop delivery, such as attendance details or relevant questionnaire answers. We may disclose information to professional advisers or public authorities where required or necessary for a legal matter. We do not sell participant data.
5. International processing
Some service providers and workshop partners operate outside the European Economic Area. Transfers must comply with applicable data-protection requirements, including an applicable adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses, as relevant. You can contact us for information about the safeguards applicable to your data.
6. How long information is kept
We retain booking and operational information for as long as needed to administer the workshop and related support. Records needed for accounting, legal obligations, refunds, disputes or legal claims may be kept for the applicable statutory or limitation periods. Questionnaire and attendance information is retained only for as long as needed for workshop administration and related follow-up. Enquiries are retained while being resolved and for any necessary follow-up. Newsletter information is retained while your subscription remains active; a limited suppression record may be kept to respect an unsubscribe request. Security logs and backups follow operational retention cycles. These purposes and requirements determine the retention period; information no longer needed should be deleted or anonymised.
7. Cookies and external services
The website uses cookies and similar technologies for functions such as checkout sessions, security and remembering preferences. External payment, newsletter, antispam or embedded-content services may also process technical information under their own notices. Non-essential cookies require consent where applicable. You can use the website’s cookie controls and your browser settings to manage preferences; restricting necessary cookies may prevent checkout or other functions from working.
8. Your rights
Subject to the conditions and exceptions in applicable law, you can request access to your personal data, correction, erasure, restriction of processing or data portability. You can object to processing based on legitimate interests and withdraw consent at any time. We may need proportionate information to verify your identity before acting on a request. We normally respond within one month; where legally permitted, a complex request may require an extension, which we will explain.
Contact filmlab@fest.pt. You can also lodge a complaint with Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or another competent supervisory authority.
9. Security and automated decisions
We use access restrictions and technical and organisational measures to protect personal data. No online system can guarantee absolute security. FEST FILM LAB does not select participants through automated profiling or make solely automated decisions with legal or similarly significant effects. Payment providers may carry out their own fraud and payment checks.
10. Changes to this policy
We may update this policy as our services or requirements change. The latest version and its update date will be available on this page. We will provide additional information about material changes where required.