Privacy Policy

1. Who we are

This Privacy Policy explains how Smart City Concierge ("Smart City Concierge", "we", "us" or "the service") collects, uses and protects your personal data.

Data controller: Smart City Concierge, located at Rua do Brasil, n.º 239, 3rd floor, Coimbra, Portugal.

Contact for data protection matters: info@smartcityconcierge.com

We are committed to processing your data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and other applicable law.

2. Scope of this policy

This policy applies to:

• The website smartcityconcierge.com and its sub-pages;
• The WhatsApp travel concierge service, including the public demonstration available in Coimbra.

When Smart City Concierge is provided to a city, municipality or tourism region under that entity's own brand (white-label model), that entity is normally the controller of visitors' data, with Smart City Concierge acting as processor. In those cases, the privacy policy of the entity operating the destination also applies.

3. What data we collect

Data you provide through WhatsApp:

• Your phone number and WhatsApp account identifier;
• Your WhatsApp profile name, where available;
• The content of the messages you send us (text and, if you choose to share them, location, images or voice messages) and the replies we exchange with you.

Data we collect automatically on the website:

• Technical browsing data (for example, device and browser type, pages visited), through strictly necessary cookies and similar technologies and, where applicable, analytics. See the "Cookies" section.

Data you provide by other means:

• Contact details you voluntarily send us (for example, by email) when you get in touch.

We do not ask for, and do not need, sensitive data (such as health, religious or political information). Please do not share this type of information in the conversations.

4. How we use your data and on what basis

5. Use of artificial intelligence

The service uses an artificial intelligence model to interpret your messages and generate replies automatically. For this purpose, the content of your messages is processed by an AI technology provider (currently Google, through the Gemini model API).

Replies are generated automatically and may, in certain cases, be reviewed or continued by a member of our human team where this is necessary to assist you.

We do not make automated decisions that produce legal effects concerning you or that similarly significantly affect you. The service's replies are informational and advisory in nature.

6. Who we share your data with

We do not sell your personal data. We share data only with those needed to operate the service:

• Meta Platforms Ireland Ltd. (WhatsApp), as the channel through which you communicate with us;
• Google, to process messages through the AI technology that generates the replies;
• Infrastructure and hosting providers that support the technical operation of the service;
• Our team, when human involvement in the support is needed;
• Local partners (restaurants, experiences, tour operators and booking platforms), when and to the extent necessary to fulfil a booking or request you make, sharing only the data strictly necessary for that purpose;
• Public authorities, where required by law.

All processors are bound by confidentiality and data protection obligations.

7. International data transfers

Some of our providers (in particular Meta and Google) may process data outside the European Economic Area. Where this happens, we ensure appropriate safeguards are in place, such as the Standard Contractual Clauses approved by the European Commission or an applicable adequacy decision.

8. How long we keep your data

We keep the content of conversations for up to 12 months, after which the data is deleted or anonymised, unless the law requires a different period or it is necessary to keep it in order to establish, exercise or defend legal claims.

Contact details you send us are kept only for as long as necessary to respond to and manage the matter in question.

9. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration, including access controls and limiting information to those who need it.

10. Your rights

Under the GDPR, you have the right to:

• Access your data and obtain a copy;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Restrict processing;
• Object to processing based on legitimate interest;
• Portability of the data you provided to us;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at info@smartcityconcierge.com. You may also lodge a complaint with the competent supervisory authority. In Portugal, the National Data Protection Commission (CNPD), www.cnpd.pt.

11. Children

The service is not directed at children under 16 and we do not knowingly collect children's data. If we become aware that we have collected data from a child without appropriate consent, we will delete it.

12. Cookies

On the website we use cookies that are strictly necessary for it to function and, where applicable, analytics cookies to understand in aggregate how the site is used. Non-essential cookies are only used with your consent, which you can manage or withdraw at any time in your browser settings or in the consent banner, where available.

13. Changes to this policy

We may update this Privacy Policy whenever necessary. The version in force is always the one published on this page, showing the date of the last update.

14. Contact

For any question about this policy or about the processing of your data, contact us at info@smartcityconcierge.com.