Privacy Policy

Last updated: 21 October 2026

This policy explains how Ink of Freedom (https://inkoffreedom.dctr.pt) collects and uses personal data, in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Portuguese Law no. 58/2019.

1 - Who we are

The controller responsible for your personal data is:

  • DCTR - Associação Cultural
  • NIF: 513721452
  • Address: Rua Aviação Naval, nº 47, 3810-056 Aveiro, Portugal
  • Email: geral@dctr.pt

For any question about this policy or your personal data, write to geral@dctr.pt.

2 - What data we collect

We collect two kinds of data: what you choose to send us through the story form, and anonymous or pseudonymous usage data from analytics, only if you accept analytics cookies.

Story form. Sharing a story is entirely voluntary. When you use the form we collect:

  • Your name
  • Your email address
  • The story you write, and any details you choose to include in it

Because the stories relate to dictatorships and their aftermath, they may reveal your political opinions, or those of family members or other people you mention. The GDPR treats political opinions as a special category of data. We only process this information with your explicit consent (see section 3).

Please avoid including other people's full names, contact details or other identifying information unless they have agreed to it.

Analytics data. If you accept analytics cookies, PostHog and Google Analytics collect information such as pages visited, time on page, clicks, referring website, approximate location (country or city, based on your IP address), device type, browser and operating system. We use this data in aggregate and do not use it to identify you.

3 - Why we use your data and on what legal basis

We only use your data for the purposes below, and never sell it or use it for advertising.

Purpose Data used Legal basis (GDPR)
Receive, preserve and archive your story as part of a collective memory of dictatorship periods Story, name, email Your explicit consent, Art. 6(1)(a) and Art. 9(2)(a)
Identify you as the author of your story and verify submissions Name, email Your consent, Art. 6(1)(a)
Contact you about your story, for example to answer a question or ask your permission for a new use Name, email Your consent, Art. 6(1)(a)
Understand how visitors use the site and improve it Analytics data Your consent to analytics cookies, Art. 6(1)(a) and Art. 5(3) of the ePrivacy Directive (Portuguese Law no. 41/2004)

You give consent by ticking the consent box on the form before submitting. We will not publish your story, or share your name or email, without first asking for your separate permission.

We will not send you newsletters or promotional messages unless you sign up for them separately.

4 - Cookies and analytics

Analytics tools only load after you accept them in our cookie banner. If you decline, no analytics cookies are set and the site works normally.

We use two analytics services:

  • PostHog, provided by PostHog Inc., with data hosted on its EU servers in Frankfurt, Germany.
  • Google Analytics 4, provided by Google Ireland Limited. Google Analytics 4 does not store full IP addresses.
Cookie Provider Purpose Duration
Consent cookie Our cookie banner Remembers your cookie choices Up to 12 months
ph_<project>_posthog PostHog Distinguishes visits and sessions 1 year
_ga Google Analytics Distinguishes visitors 2 years
_ga_<ID> Google Analytics Keeps session state 2 years

WordPress may also set strictly necessary technical cookies, for example for security. These do not need consent and are not used for analytics.

You can change or withdraw your consent at any time through the cookie settings link at the bottom of every page, or by deleting cookies in your browser.

5 - Who has access to your data

Stories and form data are stored in our own website database and are accessed only by authorised members of DCTR - Associação Cultural working on this project.

We use these service providers, who process data on our behalf under data processing agreements:

Provider Role Data location
Hostinger Website and database hosting European Union
PostHog Inc. Site analytics EU cloud, Frankfurt, Germany
Google Ireland Limited Site analytics EU, with possible transfers to the United States

Some of these companies have parent companies or support staff in the United States. Where data may be transferred outside the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework or by Standard Contractual Clauses approved by the European Commission.

We may disclose data if required by law, for example at the request of a court or a competent authority.

6 - How long we keep your data

We keep stories, together with the author's name and email, indefinitely, because the project's purpose is to build a lasting archive of memories of dictatorship periods for historical and cultural purposes, as allowed by Art. 5(1)(e) and Art. 89 of the GDPR.

Keeping data indefinitely does not limit your rights. You can ask us at any time to delete your story, your name and email, or all of them, and we will do so without undue delay and within one month.

Data How long we keep it
Story, name and email Indefinitely, until you ask us to delete them
Analytics data in PostHog According to our PostHog retention settings
Analytics data in Google Analytics 14 months
Cookie consent record Up to 12 months

7 - Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you and get a copy of it
  • Rectify data that is inaccurate or incomplete, including editing your story
  • Erase your data, including your story
  • Restrict how we use your data
  • Data portability, receiving your data in a structured, commonly used format
  • Object to the processing of your data
  • Withdraw consent at any time, without affecting processing that happened before you withdrew it

To exercise any of these rights, email geral@dctr.pt. We will reply within one month, and may ask you to confirm your identity, usually by replying from the email address you used on the form. Exercising your rights is free.

If you believe we have not handled your data correctly, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, Av. D. Carlos I, 134, 1º, 1200-651 Lisboa.

8 - Security

We protect your data with encrypted connections (HTTPS), restricted and password-protected access to the website administration, and regular software updates. No system is completely secure, but if a breach affects your data we will notify the CNPD and, where required, you.

9 - Children

The story form is intended for people aged 16 or over. Under Portuguese law, children under 13 need the consent of a parent or guardian to share personal data. If you are a parent and believe your child has sent us a story without your consent, contact us and we will delete it.

10 - Changes to this policy

We may update this policy when the website or the law changes. The date at the top shows the latest version. If we make significant changes to how we use stories, we will contact the authors by email before they take effect.