Privacy Policy
Effective from 27 September 2026. This policy applies to the OwnMyMind WordPress website at www.ownmymind.pt. The project is currently in research and development. Email subscriptions, when made available through the website form, require address confirmation (double opt-in). At this stage, only transactional confirmation and preference-management messages are provided for; campaign and bulk newsletter sending remains disabled.
1. Who is responsible for your data
BTK, Lda., Portuguese legal entity identification number (NIPC) 517813610, is the controller for the personal data covered by this policy.
Address: Rua Pedro Nunes, Edifício C, 3030-199 Coimbra, Portugal.
Privacy contact: geral@ownmymind.pt.
Website: https://www.ownmymind.pt.
2. What this policy covers
This policy explains the processing of data associated with visiting the OwnMyMind website and blog, subscribing to articles and project updates by email, and contacting the team.
It does not cover the use of a future conversational agent or participation in studies. Subscribing to updates does not constitute consent to participate in research, provide clinical data or have personal data used to train artificial intelligence models.
You can read public content without subscribing to emails or creating a reader account. Your email address and language preference are required only if you wish to receive communications. Sending us a message does not automatically subscribe your address to project updates.
3. What data we process and why
Subscriptions and communication preferences. We process your email address, chosen language, technical subscription identifiers and the necessary records of requests, confirmation, preference changes and unsubscribing. These data allow us to send the articles you requested in your chosen language and respect your decisions. Sending updates is based on consent under Article 6(1)(a) of the GDPR.
Email enquiries. We process your address, name or other details included in your message, its subject, content and any attachments you send, to the extent necessary to respond and follow up. For general questions and suggestions, the legal basis is BTK’s legitimate interest in responding to people who contact it, under Article 6(1)(f) of the GDPR. Where a request concerns preparing a contract with the individual, Article 6(1)(b) may apply, only to the processing necessary for that request.
Operation and security. Technical systems may process access logs, such as IP address, date and time, requested resource and browser information, together with message-processing records. The purpose is to keep the website and communications operational, prevent abuse and diagnose faults, based on BTK’s legitimate interest in protecting these services. The final inventory will limit these data to what is actually necessary and used.
Compliance and individuals’ rights. We retain the minimum evidence needed to demonstrate consent management, respect unsubscribe requests and respond to data protection requests. Compliance with legal obligations is based on Article 6(1)(c) of the GDPR; a specific need to defend legal claims may be based on Article 6(1)(f), with access and retention limited to that purpose. Neither basis authorises continued sending of updates after consent is withdrawn.
The data are supplied by you or generated through the use and administration of the services described. We do not purchase contact lists. We do not use these data to create psychological profiles, train the agent or make solely automated decisions that have legal or similarly significant effects on you.
The website’s contact channels are for matters relating to the project. Please do not send clinical information, intimate accounts or other people’s personal data that are unnecessary for your enquiry. Receiving such a message does not authorise its publication, research use or inclusion in training data.
Subscription collects only the email address, PT/EN language preference and the minimum evidence needed to record the decision: the request, version and language of the information shown, confirmation and any later changes or withdrawal. We do not collect consent to individual tracking of opens or clicks.
4. Confirmation, language preference and unsubscribing
Your subscription becomes active only after you confirm your address through the message we send. You will receive the Portuguese or English edition according to your preference, not both by default.
You can change language or unsubscribe using the links provided in emails, or contact geral@ownmymind.pt. Unsubscribing applies to both editions. To receive updates again after unsubscribing, you must make a new request and provide a new confirmation; an old confirmation does not reactivate the subscription.
Withdrawing consent does not affect the lawfulness of earlier processing. Unsubscribing prevents further sends, but cannot recall a message already transmitted before the request takes effect. Messages strictly necessary to carry out your own request, such as confirming a new subscription, do not in themselves reactivate the newsletter.
5. Who may access the data
BTK manages the website data, updates list and enquiries, with access restricted to people authorised for these tasks. Instituto Pedro Nunes and its Laboratório de Informática e Sistemas do not receive or access these data within the scope described here.
Technical providers for hosting, email, message distribution, maintenance and backups may process data strictly necessary for contracted services. When acting on BTK’s behalf, they are subject to instructions, confidentiality and contractual data protection obligations. We do not sell the data or share them with partners for their own advertising. We disclose data to authorities only where there is an applicable legal basis.
Website hosting and the project’s email service are provided by Amenworld – Serviços Internet, Sociedade Unipessoal Lda., which acts as BTK’s processor for personal data processed in connection with those services.
Amen may use sub-processors to provide its services. The applicable list may be obtained from Amen on request. Where a service involves a transfer of personal data outside the European Economic Area, the safeguards set out in Amen’s data processing agreement apply, including, where necessary and in the absence of an applicable adequacy decision, Standard Contractual Clauses. You can contact us at geral@ownmymind.pt for further information about the providers and safeguards applicable to the processing of your data.
Brevo acts as BTK’s processor for transactional email delivery, on behalf of and under BTK’s instructions, and is the intended newsletter delivery provider when that sending is activated separately. It receives the email address and the information needed to transmit the requested messages. WordPress, FluentCRM and FluentSMTP are software components used by BTK; by themselves, they are not processors and do not identify an external recipient of the data.
6. How long we keep data
| Data | Period or criterion |
|---|---|
| New, unconfirmed subscription request | Up to 30 days after the latest request. An unconfirmed request does not erase an earlier suppression record or other evidence that remains necessary. |
| Active subscription | While you remain subscribed and the updates channel is operating. The need for the list will be reviewed annually. |
| General email enquiries | Up to 12 months after the matter is closed, unless an identified obligation or specific relationship requires a different period. |
| Technical access and security logs | Up to 30 days, unless a specific incident justifies retaining the relevant records for longer. |
| Detailed email-processing history | Up to 90 days, followed by only the minimum required to prevent duplicates, respect unsubscribe requests or address a specific incident. |
| Minimum evidence of consent, withdrawal and responses to rights requests | While the subscription is active and for up to 24 months after unsubscribing or closing the request, unless further retention is specifically justified. |
| Minimum record needed to respect an unsubscribe request | While this channel operates and the record remains necessary to prevent unwanted contact, subject to annual review. A valid resubscription updates the status without reopening old sends. |
| Backups | The hosting currently in use includes automatic daily backups retained for up to 7 days and hourly backups for up to 12 hours. For backups under BTK’s direct control, where used, we apply a target maximum rotation period of 30 days unless a specific documented need justifies longer retention. Recovery must not reactivate cancelled subscriptions or restore data that should remain erased or minimised. |
At the end of a retention period, data will be erased or effectively anonymised, without keeping identifiers that allow the individual to be reconstructed. A pseudonymous identifier is not treated as anonymous data.
A specific legal obligation, complaint, incident or proceeding may justify retaining particular information for longer. In that case, the reason, scope of the data and applicable period will be documented, with use restricted to that need. A limited exception will not justify keeping the entire database.
7. Cookies, measurement and external links
OwnMyMind currently does not use behavioural advertising, visitor analytics tools or individual tracking of opens or clicks.
During the pre-launch verification carried out in an anonymous session on the homepage, no website cookies, Local Storage or Session Storage data, or network requests to third-party services were identified. The resources observed were served by the OwnMyMind domain itself. Team authentication and other administrative functions may use technical mechanisms necessary for the operation and security of those areas.
No non-essential mechanisms requiring prior consent were identified in the current configuration, so the website does not display a cookie-consent banner. If non-essential technologies are introduced in future, the required information will be provided and, where necessary, consent will be obtained before they are activated. Continued browsing will not be treated as consent.
The website includes a simple link to LinkedIn without embedding its feed. Following an external link takes you to a separate service, whose processing should be checked in its own privacy information. Subscribing by email does not require a LinkedIn account.
To protect forms against abuse, we use temporary counters associated with cryptographic derivations of the source address and email address. This protection does not store the IP address in plain text or create marketing profiles. Source limits expire after 15 minutes and email limits after one hour; global sending counters last no more than 24 hours. Expired records are no longer used and are removed on the next site request or during daily privacy maintenance.
The Brevo sending configuration requires tracking consent for each contact (the “Yes” setting). Contacts whose consent is unknown are not tracked. OwnMyMind does not request that consent through the subscription form and does not use individual tracking of opens or clicks. Automatic addition of UTM parameters is switched off.
8. Security
Access is restricted to authorised people. The launch configuration must provide protected transmission, permission management, subscription verification, backup and recovery safeguards and procedures for incidents and individuals’ rights. We do not promise absolute security: measures must be appropriate to the risks and reviewed as the services are used.
9. Your rights
Where applicable, you may request access, rectification, erasure, restriction of processing and portability of your data. You may withdraw consent at any time and object to processing based on legitimate interests. For promotional communications, objection or withdrawal of consent ends the use of your data for that purpose.
Send your request to geral@ownmymind.pt. We may request only the information necessary and proportionate to confirm that the request concerns your data. Exercising your rights is normally free of charge.
We will respond without undue delay and normally within one month. If an extension of up to two further months is necessary, we will inform you of the extension and the reasons within the first month.
You may lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), including through the forms at www.cnpd.pt, or with the competent supervisory authority. A favourable response from BTK is not a prerequisite for exercising this right.
10. Changes to this policy
Last updated: 27 September 2026.
The policy in force will display its update date. Relevant changes will be communicated before they apply. A change to this policy does not replace fresh consent where it is needed for a different purpose.