PRIVACY AND COOKIES POLICY
3D Fun Art Museum | Lisbon · Funchal · Portimão
Policy applicable to the museums in Lisbon, Funchal and Portimão.
1. Scope and data controller
This Privacy Policy explains how personal data collected through the websites, contact forms and booking services of the 3D Fun Art Museum locations in Lisbon, Funchal and Portimão is processed.
3D Fun Art Museum is the trading name of the museums operated by Criativapproach, Unipessoal, Lda., Portuguese tax identification number 518 482 405, with its registered office at Rua Velha da Ajuda, 123, Bloco E, 7.º B, 9000-749 Funchal, Portugal. The company is the controller of the personal data covered by this policy.
For privacy, data protection or requests to exercise data subject rights, please contact: info@3dfunart.com.
2. Personal data processed
Depending on the nature of the request, we may process your name, email address, telephone number, message content and any other information you choose to provide. In connection with bookings, we may also process information required to identify the booking, the visit date, the number of participants and billing details, where applicable. We do not request personal data that is unnecessary for these purposes.
3. Purposes and legal bases for processing
Data submitted through contact forms is used to respond to enquiries, provide information, prepare quotations and manage requests for visits or events. Depending on the circumstances, such processing is based on steps taken at the data subject’s request prior to entering into a contract or on our legitimate interest in responding to communications received.
Data relating to bookings and payments is processed to perform the contract for a visit or event and to comply with legal obligations, including tax and accounting requirements. Where processing requires consent, we will request it specifically, as required by law.
4. Online bookings and ticket purchases
Bookings and ticket purchases made through the 3D Fun Art Museum websites are processed using the FareHarbor platform. To manage bookings and process payments, the personal data necessary to provide the service is processed, including identification, contact, booking and transaction information. Online payments are processed through the payment services integrated with FareHarbor, in accordance with their applicable terms and data protection law. 3D Fun Art Museum can access the information needed to manage bookings and confirm payments, but does not have access to customers’ full payment card details.
5. Marketing communications
At present, 3D Fun Art Museum does not use contact details collected through forms or bookings to send newsletters or promotional email campaigns. If this practice changes, this policy will be updated and the applicable legal requirements for marketing communications will be observed.
6. Recipients and service providers
Personal data may be accessed by authorised staff and, where necessary, by service providers supporting our websites, hosting, email, ticketing, payments and accounting, subject to applicable confidentiality and data protection obligations. Data may also be disclosed to public authorities where legally required. We do not sell personal data to third parties.
7. International data transfers
The 3D Fun Art Museum websites are hosted on Hostinger servers located in France, within the European Union. The use of external platforms, including FareHarbor, and other technology services may involve the processing of personal data outside the European Economic Area. Where international transfers of personal data take place, the requirements of the General Data Protection Regulation (GDPR) will be observed, including the use of lawful transfer mechanisms and appropriate safeguards where required.
8. Data retention
3D Fun Art Museum retains personal data only for as long as necessary for the purposes for which it was collected, subject to applicable legal obligations. Data received through contact forms is generally retained for up to 12 months after the last communication. Correspondence relating to bookings and visits may be retained for up to 24 months after the visit. Data associated with complaints, tax obligations or potential disputes may be retained for longer where legally necessary. Once the applicable retention periods have expired, data will be deleted or anonymised unless there is a lawful basis for further retention.
9. Data subject rights
Under applicable law, individuals may request access to, rectification or erasure of their personal data, restriction of or objection to processing, and data portability, where applicable. Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise these rights, please use the contact details in section 1. Individuals may also lodge a complaint with the Portuguese Data Protection Authority (Comissão Nacional de Proteção de Dados — CNPD) at www.cnpd.pt.
10. Data security
Appropriate technical and organisational measures are adopted to protect personal data against unauthorised access, alteration, loss or improper disclosure, taking into account the nature of the data and the risks associated with its processing.
11. Cookies and similar technologies
The 3D Fun Art Museum websites use cookies necessary for their operation and, subject to consent, cookies for statistical analysis and advertising.
11.1. Providers and services used — The 3D Fun Art Museum websites for the Lisbon, Funchal and Portimão museums use the following services and technologies, grouped by their purposes and cookie categories:

Non-essential cookies require the visitor’s prior consent. Visitors can accept, reject or change their cookie preferences through the cookie consent management tool available on the website.
Additional information about cookies, including their retention periods, is available through the consent management tool provided on the websites.
12. Links to third-party websites
Our websites may contain links to external services. Those services’ privacy practices are governed by their own policies, which we recommend reviewing before providing personal data.
13. Children’s personal data
Visits may involve children accompanied by adults or taking part in school groups. Children’s personal data should be collected only where necessary to provide the services and in accordance with applicable legal requirements. We do not request sensitive personal data relating to children through our general contact forms.
14. Changes to this policy
This policy may be updated to reflect legal, technical or operational changes. The current version will be available on the museums’ websites. Where necessary, additional information will be provided or fresh consent requested in accordance with applicable law.