Last updated: 12 September 2026 · Version 2.0
1. Project and privacy contact
This policy explains how personal data are handled on the website of FungiFoam, a project not yet incorporated as a company. Contact location: Madan Parque, Rua dos Inventores, 2825-182 Caparica, Portugal. For privacy questions, rights requests or general enquiries, contact operations@fungifoam.eu.
2. Scope
This policy covers browsing fungifoam.eu and enquiries sent through the contact form or by email. The institutional website presents the project, technology, intended applications and collaboration opportunities. It does not currently offer online purchases, payments, public customer registration, newsletter subscriptions or personalised advertising.
Data are provided by people who contact us or generated technically through use of the website. We do not collect payment card details through this website. Providing a company or organisation in the form is optional.
3. Data, purposes and legal bases
| Processing | Data | Purpose and legal basis |
|---|---|---|
| Institutional, professional, press, investment and partnership enquiries | Name, email, organisation if supplied, topic and message | Assessing and responding to the enquiry. Legitimate interests in managing communications addressed to the project and professional relationships: GDPR Article 6(1)(f). |
| Requests for a proposal to enter a contract personally | Identity, contact details and information needed for the proposal | Taking steps requested by the data subject before entering a contract: Article 6(1)(b). An enquiry is not a purchase. |
| Operation and security | Connection information, IP addresses in infrastructure logs, request timing and characteristics; an identifier derived from the IP address for temporary rate limiting | Providing the service, limiting spam and investigating incidents. Legitimate interests in website security and availability: Article 6(1)(f). |
| Recording enquiries and preventing duplicates | Enquiry content, language, version of the privacy information displayed, and an identifier derived from the email, topic and message | Managing enquiries, avoiding duplicates and maintaining the communication context. Legitimate interests in properly managing communications: Article 6(1)(f). |
| Data protection rights requests | Request, contact details, response and proportionate identity verification information where necessary | Complying with data protection obligations: Article 6(1)(c). |
| Legal claims | Only information necessary for the matter or dispute | Establishing, exercising or defending legal claims on the basis of legitimate interests under Article 6(1)(f), or a specific legal obligation where applicable. |
Where we rely on legitimate interests, we limit the data to what is necessary and consider individuals' reasonable expectations and rights. You may ask about this assessment and object as explained below.
Fields marked with an asterisk are needed to receive and respond to your enquiry. Without this information we may be unable to process it. The form does not subscribe you to marketing or require advertising consent. Do not send passwords, full payment card numbers, identity documents or sensitive information unless necessary and an appropriate channel has been agreed.
4. Retention and deletion
Enquiries are retained in the private enquiry area for up to 12 months after receipt. A daily routine is scheduled to move older enquiries to the WordPress trash. The trash follows the WordPress deletion cycle, normally up to a further 30 days. Scheduled execution depends on the hosting environment and requires operational monitoring.
Where a relationship continues, a new communication updates the handling context. If information must be retained to perform an agreement, meet an obligation or defend rights, only the relevant material is retained separately while that purpose remains; the remaining enquiry is not used for incompatible purposes.
The temporary rate-limit identifier expires after one hour of validity on the server. Expired technical records may remain until temporary storage is cleaned. The duplicate identifier follows the retention of its enquiry. These identifiers are pseudonymised and should not automatically be treated as anonymous.
Rights requests and responses are retained as needed to complete the request, demonstrate compliance or resolve a complaint. Hosting logs and backups follow the cycles of the contracted service and are used for security and recovery, with restricted access. Deletion from the active system does not instantly erase every backup; relevant deletions and restrictions must be reapplied after a restoration. You can ask the privacy contact for retention information applicable to your data.
5. Recipients and service providers
Enquiries are stored privately in WordPress and accessed by authorised administrators to handle communications. Project team members should receive only the information needed for their response and responsibilities. The form does not automatically email a copy or send the enquiry to a marketing platform.
Hostinger provides hosting and associated technical services, including storage, infrastructure operations, security and backups according to the contracted service. Website maintenance providers may access data only where necessary for an authorised intervention. Using WordPress software does not in itself mean that form data are sent to WordPress.com.
Email messages are processed by the mail services involved in transmission and mailbox management and are used to respond to your enquiry. Disclosures to advisers or authorities are limited to justified situations involving legal obligations, necessary assistance or the defence of rights.
Providers acting on our behalf are subject to the applicable processor obligations. Where a recipient determines its own purposes required by law or its service, it is responsible for that separate processing. We do not sell enquiry data to third parties.
6. International services
The browser receives fonts and illustrative images from this website. Google Fonts and advertising platforms are not needed to read the public pages.
Hostinger infrastructure and support may involve entities or access in other countries, depending on the service and subprocessors used. A project contact location in Portugal does not mean that all technical operations take place in Portugal. Hostinger describes transfer mechanisms and standard contractual clauses in its data processing agreement and privacy policy.
Transfers subject to Chapter V of the GDPR must have an appropriate basis and safeguards, including assessment of destination conditions where required. You may request information about recipients, countries and safeguards applicable to your data, or a copy of the safeguards, via operations@fungifoam.eu, subject to legitimate protection of confidential information.
7. Your rights
Subject to the legal conditions, you may access your data and obtain a copy, rectify inaccurate data, request erasure where there is a legal basis, and request restriction of processing. Erasure does not override every legal obligation or legitimate need to defend legal claims.
Portability applies to data you provided where processing is automated and based on consent or a contract. In those circumstances you may receive the data in a structured, commonly used and machine-readable format and request direct transmission to another controller where technically feasible.
You may object, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop that processing unless there are overriding compelling legitimate grounds or it is needed to establish, exercise or defend legal claims. An objection to direct marketing, should it be introduced, requires that marketing processing to stop.
If future processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Updating this policy does not constitute consent to new purposes.
8. Exercising rights and making a complaint
Contact operations@fungifoam.eu, explaining your request and providing enough information to locate the relevant communication. We respond without undue delay and normally within one month of receiving the request. Complexity or the number of requests may justify an extension of up to two further months; we will explain this within the first month.
Requests are free of charge except in legally permitted cases of manifestly unfounded or excessive requests, which we must demonstrate. If we reasonably doubt your identity, we request only necessary and proportionate additional information. We do not routinely require a complete copy of an identity document.
If we cannot meet the request, we will explain the reasons and available remedies. You may complain directly to Portugal's Comissão Nacional de Proteção de Dados (CNPD) without contacting us first. You may also contact the competent authority in the Member State of your habitual residence, workplace or the alleged infringement, and seek judicial remedies under the applicable rules.
9. Security, children and automated decisions
The form uses server-side validation, protection against improper requests, an antispam field and temporary rate limiting. Administrative permissions are required to access enquiries. The public connection uses HTTPS. These measures reduce risks but do not guarantee that incidents are impossible. Where a breach requires notification, the legally required communications must be made.
The website is intended for people interested in the project, professionals and potential collaborators; it is not designed to collect children's data. Contact us if you identify inappropriate collection. This institutional website does not make solely automated decisions producing legal or similarly significant effects on individuals.
10. Changes
We review the policy when processing or services change. The date and version appear above. Before introducing purchases, accounts, optional analytics or other purposes, the corresponding information and controls must be updated. See also the Cookie Policy.