Privacy Policy

The Platform uses Umami, a privacy-friendly analytics tool designed to avoid collecting personal data. Umami records a limited amount of technical data when visitors view and interact with the Platform, allowing ICS-ULisboa to understand how the Platform is used and to improve it.

• Pages visited (page URL, page title, page type)

• The source website (referrer)

• The device and browser used (type, operating system, browser name)

• The approximate country/city of the visitor

• IP addresses, used only momentarily to derive the above and never stored in a form that identifies a visitor

When something goes wrong on the Platform, limited technical error data is also processed to diagnose and fix the problem.

Analytics data is used to measure how the Platform is found and used as a whole. This helps ICS-ULisboa understand which indicators and stories are useful, how visitors navigate the Platform, and where content, design, and performance can be improved. The data is not used to identify or profile individual visitors.

As ICS-ULisboa is a public-law entity, processing is carried out primarily on the basis of the performance of a task carried out in the public interest (Article 6(1)(e) of the General Data Protection Regulation), supported, where relevant, by ICS-ULisboa's legitimate interest in understanding and improving the use of the Platform (Article 6(1)(f) of the General Data Protection Regulation) as a subsidiary basis, justified by a documented balancing test. Because the analytics data is aggregated and does not identify individuals, this processing has a minimal impact on the rights and freedoms of visitors.

Analytics data is retained for 12 months. Technical error data is retained only for as long as necessary to diagnose and resolve the relevant issue. The Platform is hosted on an external provider, whose relevant servers are located in the United States. Survey and indicator data shown on the Platform is supplied in aggregated form (percentages and averages only) and contains no information allowing the identification of individual respondents; the Platform itself never processes individual-level personal data. This guarantee is documented for accountability purposes.

Access is limited to authorized staff at ICS-Ulisboa and to the following service providers, which process data only on ICS-Ulisboa's behalf under contracts requiring confidentiality and appropriate security measures:

• Interactive Things GmbH (Zürich, Switzerland) — design, development and technical maintenance of the Platform; transfers are covered by the European Commission's adequacy decision for Switzerland

• Vercel Inc. (United States) — hosting and content delivery; certified under the EU-U.S. Data Privacy Framework

• Umami — cookie-free, privacy-friendly analytics (open-source, self-hosted by Interactive Things on Vercel's infrastructure and therefore covered by Vercel's EU-U.S. Data Privacy Framework certification)

• Sentry — error monitoring (United States); participates in the EU-U.S. Data Privacy Framework

• DatoCMS — management of the editorial content shown on the Platform (operated by an Italian (EU) entity)

Data is not sold or shared with third parties for their own purposes.

Where a service provider is located outside the European Economic Area and is not covered by an adequacy decision or a valid EU-U.S. Data Privacy Framework certification, ICS-Ulisboa ensures that the transfer is governed by the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), complemented by a transfer impact assessment. The service providers identified above act exclusively on behalf of ICS-Ulisboa, under contracts ensuring confidentiality and appropriate security measures, and may not engage further sub-processors without authorization.

Because analytics data is not stored in a form that identifies individuals, ICS-ULisboa is generally unable to link any data to a specific person. In line with Article 11 of the General Data Protection Regulation, ICS-ULisboa cannot usually act on requests for access, rectification, erasure, restriction of processing, or data portability, as it cannot determine to whom the data relates.

The right to object to this processing and the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), remain unaffected. Where a visitor provides information sufficient to identify data relating to them, or exercises the right to object, ICS-ULisboa will respond within one month and assist in exercising any applicable rights.

The Platform may contain links to websites operated by other organizations. This privacy policy applies only to the Platform; visitors following a link elsewhere should consult that website's own privacy policy.

This privacy policy is kept under regular review, and any updates are published on this page. This privacy policy was last updated in July 2026.

For questions about this privacy policy, the data held, or the exercise of data protection rights, please contact:

Instituto de Ciências Sociais da Universidade de Lisboa
Av. Professor Aníbal de Bettencourt, 9, 1600-189 Lisboa, Portugal
Data Protection Officer / contact: rgpd@ulisboa.pt