NEISE / UALG
Privacy policy
Updated on 29 September 2026.
1. Controller and scope
The site is operated by NEISE — Núcleo de Estudantes do Instituto Superior de Engenharia da Universidade do Algarve. NEISE manages the site independently, is not affiliated with the Academic Association and is officially registered with the ISE administration.
Privacy contact: neise.ualg@gmail.com.
This policy covers the public site, user accounts, membership fees, shop reservations, events, appointments, contact requests, communications and NEISE's management of these activities. Payments are made outside the site and confirmed manually by authorised staff.
2. Data and purposes
Accessing the site involves your IP address and technical connection data. Technical error and security data may be logged to keep the service working, diagnose faults and prevent abuse, on the basis of NEISE's legitimate interest in operating the site securely.
When you contact us by email, we use your address, any name you provide and the message to reply and follow up, on the basis of our legitimate interest in responding to messages sent to NEISE. Where a request concerns steps you have asked us to take before entering into a contract or a legal obligation, the corresponding legal basis applies.
The site uses necessary cookies for sessions, authentication and protection against forged requests (CSRF). It does not include advertising or audience analytics tools.
When you create an account, we process your name, email address and hashed password to authenticate you, confirm your email and restore access. Your profile may include a phone number, language and preferences; your activities may generate records of membership fees, appointments, reservations, event participation, manually confirmed payments, messages and audit activity. The basis is to provide the features you request and our legitimate interest in the security and evaluation of the service. An optional newsletter subscription is based on consent and can be cancelled.
Account and activity data are kept for as long as needed to provide the requested services, maintain their histories and comply with applicable obligations. Deletion requests are assessed individually; some payment or audit records may need to be retained. Accounts are not automatically deleted as a general rule. You can request deletion using the contact above.
2.1. Protecting forms against abuse
We use Cloudflare Turnstile on registration, contact, account recovery and reservation forms and, when activity is repeated, on login, confirmation resends and appointments. This helps prevent bots, spam, unauthorised access attempts and abusive reservations, on the basis of NEISE's legitimate interest in the security and availability of the service.
When the verification loads, your browser communicates with Cloudflare, which processes technical signals such as your IP address, TLS connection characteristics, browser and the widget's origin. According to Cloudflare, these signals protect websites and improve bot detection. See its Turnstile privacy addendum and privacy policy.
NEISE checks a temporary response before accepting the action. Local abuse-prevention counters use keyed hashes of identifiers; the table does not store email addresses, IP addresses or Turnstile responses in plain text. The counters expire within 24 hours, and an operational maintenance task removes expired entries every minute. These identifiers are pseudonymised, not anonymous.
Pre-clearance is not enabled. If verification fails, you can try again without losing ordinary form fields or contact neise.ualg@gmail.com for help. Other security records follow the retention periods below.
3. Activities and payments
Membership fee requests, shop orders and event requests are recorded on the site. The site does not charge cards or process online payments. An authorised NEISE representative manually confirms receipt and, where applicable, records refunds and their reason. These records are needed to fulfil requests, answer questions and keep NEISE's accounts.
4. Gmail and Google authorisation
The “Site NEISE” application sends NEISE communications through neise.ualg@gmail.com after an authorised representative grants OAuth access. This sending integration is used for account confirmations, operational notices and other NEISE communications. Visitors do not need to connect their Google accounts.
To send a message, the application processes the recipients, subject, content and any necessary attachments and transmits them to Google for delivery. Its initial scope is email sending; any future reading feature will be described before it is activated.
The application does not ask for or store the Google account password. OAuth credentials are stored on the server with restricted access and used only for authorised functions. Data received through this integration will not be sold, used for personalised advertising or used to train artificial intelligence models.
Use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API data policy.
The account owner can revoke access in their Google Account connections and ask NEISE to delete the local credentials. Revoking access does not delete messages already sent or copies in recipients' inboxes.
5. Access and service providers
NEISE administers the server. Administrative access and access to credentials are limited to people authorised to operate and maintain it. HTTPS connections and restricted access permissions are used.
Google provides Gmail and processes messages, recipients and attachments to deliver email. Cloudflare provides DNS for neise.org and the Turnstile verification described above; in this configuration, web traffic reaches NEISE's server directly. Netim is the domain registrar.
These providers may process data in countries outside the European Economic Area. Google describes the mechanisms it uses, including adequacy decisions and standard contractual clauses where applicable, in its international transfer information. Cloudflare describes its practices and safeguards in its privacy policy. You can contact NEISE with questions about the providers it uses.
6. Retention and deletion
Data are kept for as long as needed for their purpose. For contact requests, this depends on whether the request is still being handled and whether legal obligations or the need to defend rights justify retention. You can request deletion through the privacy contact; any restrictions will be explained in the response.
Technical system logs are configured to be kept for no more than 14 days and may be deleted earlier due to space limits. This period does not apply to messages in Gmail or to data retained to investigate a specific incident.
OAuth credentials are kept while the connection is authorised and needed. Copies of messages on the server, in the Gmail account and in recipients' inboxes are separate; deleting one copy does not automatically delete the others.
7. Your rights
You may request access, rectification, erasure and restriction of processing, and exercise the rights to object and to data portability where applicable. Where processing relies on consent, you may withdraw it without affecting earlier processing. We may ask for proportionate information to verify your identity before responding.
Send requests to neise.ualg@gmail.com. You may also lodge a complaint with the Portuguese Data Protection Authority (CNPD).
8. Updates
This page will be reviewed when the site's features or data-processing practices change. The version date appears at the top.