Privacy Policy

1. Data controller

WEPAC — Companhia de Artes, based in Carcavelos, Portugal. For privacy questions or to exercise your rights, contact us at info@wepac.pt.

2. Data we process

• Website and enquiries: name, email, telephone number, message content, event details, applications and Wessex chat history.
• WEPACKER account: identity, contact details, protected credentials, profile, avatar, Agreements and technical authentication records.
• My Journey: Stage, Life Map and its history, Trails, Goals and Actions.
• Relationships and participation: Connections, Mentorships, Pack Memberships, Cycle Enrollments and Facilitation.
• Sessions: schedule, participants, links, attendance, discussion points, private mentor notes, shared notes and outcomes.
• Session Transcript and Debrief: the complete Transcript text, attachment author and date, and derived structured drafts. This data may contain particularly sensitive information.
• Technical data: strictly necessary cookies, security information and operational records without private content wherever possible.
• Support Preview: Admin, Person and Session identifiers, structured purpose, a keyed digest of the external reference, timestamps and access events without the projected content.

3. Purposes

We process data to respond to enquiries and applications, provide WEPAC services, manage accounts and My Journey, enable relationships and participation that have been explicitly accepted, organise Sessions, communicate operational information, protect the platform and comply with legal obligations. Any AI Debrief is used only to create a private draft subject to human review; it does not publish notes or create Actions automatically.

4. Legal bases

Depending on the operation, the legal basis may be performance of a contract or steps requested by the data subject, compliance with a legal obligation, legitimate operational and security interests, or specific consent where required. A general Agreement, Pack Membership, Connection or presence in a Session does not, by itself, constitute consent to a Transcript or AI processing.

5. Transcripts, minors and current status

New Session Transcript attachments and replacements are disabled. They will be enabled only when there is a specific, informed consent request, evidence of who consented, age verification and Parent/Guardian involvement where applicable, a concrete retention rule and a simple withdrawal mechanism. Only the Session organizer can remove an existing Transcript; removal also deletes its derived Debrief. AI Session Debrief remains disabled until technical and privacy certification is complete.

6. Retention

Commercial enquiries and applications are retained while legitimate follow-up continues and, as a rule, for no longer than 24 months after the last contact. Account, My Journey, relationship and Session data remains while the corresponding account or relationship is active and for any additional period needed to resolve requests, security matters or legal obligations. There is currently no separate automatic retention period for existing Transcripts; new attachments therefore remain blocked until that period is defined and applied. Erasure requests are assessed without undue delay, subject to retention obligations and third-party rights.

In Support Preview, the reference digest becomes eligible for redaction when the 15-minute grant expires; the grant is deleted after 30 days and the content-free audit event after 365 days. When erasure is requested, active grants are removed and direct references to the Person are anonymized before the account can be deleted.

7. Recipients and service providers

Access within WEPAC is limited to the necessary role and relationship. We may use hosting, email, scheduling, authentication and AI providers as processors. Wessex chat may send the necessary message to the configured AI provider. Session Debrief does not send Transcripts to Agents Hub while disabled. We do not sell personal data. International transfers, where they occur, are subject to applicable safeguards and can be clarified through the contact above.

8. Your rights

Where applicable, you may request access, rectification, erasure, restriction, portability or objection, and withdraw consent without affecting earlier processing. You may also lodge a complaint with Portugal's data-protection authority at cnpd.pt.

Where the data subject is a minor, these rights may be exercised by their legal representative according to the minor's age and maturity.

9. Cookies and security

We use cookies required for authentication and operation. We do not use these cookies for behavioural advertising. We apply proportionate technical and organisational controls, including HTTPS, resource-level authorisation and limits on content included in logs. No measure eliminates all risk; incidents are handled in accordance with applicable obligations.

A Session Support Preview is read-only and does not exchange identity, JWT or role. The exact organizer can project only an explicit attendee in their own Session. Admin support requires password re-authentication, a reason code, ticket digest and a signed cookie limited to that Session and Person; the Admin projection excludes the meeting URL, Transcript, Debrief, discussion points and private notes.