Privacy Policy

This Privacy Policy explains what personal data Escola CRIAR collects, for what purposes, on what legal grounds, for how long it is kept and what your rights are, under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable Portuguese law.

1. Data controller

The controller of personal data is Lápis Positivo, Lda. (hereinafter “Escola CRIAR”), tax number (NIPC) 517436736, with registered office at Rua da Torre, 909, 2750-768 Cascais, Portugal.

Data protection contact

For any question about the processing of your personal data or to exercise your rights, contact us by email at info@escolacriar.pt, by phone on +351 215 981 368, or by post at the address above.

2. What data we collect

We only collect the data strictly necessary for each purpose:

• Contact data you send us when you ask for information or book a visit (by email, phone, WhatsApp or in person): name, email, phone number and the content of your message.
• Student and family data, for enrolment and school attendance: identification and contact details of the student and their parents or guardians, billing data, and information needed for educational support.
• Health and specialised support data (for example, allergies, dietary needs, or information shared with the school psychologist and therapeutic team), processed only when necessary and with enhanced confidentiality.
• Images (photos and videos) of school activities.
• Job applicant data from people who send us their CV.
• Browsing data collected when you visit this website (see section 7).

3. Purposes and legal grounds

3.1. Performance of the educational services contract

• Enrolment, attendance management and educational support for students;
• Communication with parents and guardians about school life;
• Billing and payment collection.

3.2. Pre-contractual steps, at your request

• Answering requests for information and scheduling visits;
• Assessing job applications.

3.3. Compliance with legal obligations

• Tax and accounting obligations;
• School insurance;
• Obligations towards the Ministry of Education and other authorities;
• Handling complaints (including the official Complaints Book).

3.4. Consent

• Health and specialised support data, with the explicit consent of parents or guardians;
• Use of images of students, with prior authorisation from parents or guardians. On the school’s website and social media, children’s faces are never shown: they are always covered or blurred;
• Sending information about school events and initiatives to people who are not parents or guardians of our students;
• Marketing and statistics cookies on the website (see section 7).

You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before that date.

3.5. Legitimate interest

• Sending parents and guardians information about school events and activities, to which you may object at any time;
• Security and proper functioning of the website.

4. Who we share data with

Escola CRIAR does not sell personal data. Data may only be disclosed to:

• Service providers that process data on our behalf and under our instructions: email and documents (Google Workspace), website hosting (GitHub Pages), our accounting firm and payment services;
• Insurer, for school insurance;
• Public, judicial or administrative authorities, where required by law;
• Meta Platforms (Facebook/Instagram) and Google (Google Maps), through tools embedded in the website (see section 7).

Transfers outside the European Union

Some of these providers (Google, GitHub and Meta) may process data in the United States. These transfers are based on the EU-US Data Privacy Framework (European Commission adequacy decision) or on standard contractual clauses approved by the European Commission.

5. How long we keep data

• Requests for information and visits: up to 1 year after the last contact, unless the child is enrolled;
• Student records: while the student attends the school and, afterwards, for the period required by applicable law;
• Billing and accounting: 10 years, as required by tax law;
• Health and specialised support data: while the student attends the school, deleted at the end unless otherwise required by law;
• Images: for as long as the authorisation remains in place; you may withdraw it at any time;
• Job applications: up to 1 year after receipt;
• Cookies: for the periods set out in section 7.

After these periods, data are deleted or anonymised.

6. Your rights

Under the GDPR, you have the right to:

• access your personal data;
• rectify inaccurate or incomplete data;
• request erasure of your data;
• restrict processing;
• receive your data in a structured format (portability);
• object to processing based on legitimate interest, including receiving communications;
• withdraw your consent at any time.

To exercise these rights, contact us using the details in section 1. We reply within one month. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

Children’s data are provided and managed by the holders of parental responsibility, who exercise these rights on their children’s behalf.

7. Cookies and third-party tools on the website

Cookies are small files stored on your device when you visit a website. This website uses:

• Meta Pixel (Meta Platforms): measures the effectiveness of the school’s campaigns on Facebook and Instagram. It is a marketing cookie and is only activated with your consent, given through the cookie notice. Meta cookies may be kept for up to 90 days;
• Google Maps (Google): the map on the contact page is provided by Google, which may collect your IP address and set its own cookies;
• Content providers (website hosting and an image slideshow library), which receive your IP address in order to deliver the pages, without setting tracking cookies.

You can change your cookie choice at any time, and you can delete or block cookies in your browser settings.

8. Security

Escola CRIAR takes appropriate technical and organisational measures to protect personal data against unauthorised destruction, loss, alteration, disclosure or access, including restricting access to health and specialised support information to the professionals who need it.

9. Social media

Escola CRIAR has social media pages (Instagram). When you interact with those pages, your data are also processed by the social network concerned, under its own privacy policy. Escola CRIAR reserves the right to remove comments that are offensive, illegal or infringe the rights of others.

10. Changes to this policy

Escola CRIAR may update this Privacy Policy. The current version is always published on this website, with the date of the last update.

Last updated: 11 October 2026