Privacy Policy

This Privacy and Personal Data Protection Policy sets out the terms applicable to the processing of personal data in connection with the provision and use of:

• The website available at https://www.plotshelf.com; and
• The PlotShelf mobile application,

hereinafter jointly referred to as the "Services".

This Policy is intended to ensure compliance with the information and transparency obligations established in Articles 12, 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data ("GDPR"), as well as Portuguese Law No. 58/2019 of 8 August, which implements the GDPR within the Portuguese legal system, and any other applicable national and European legislation.

The controller responsible for the processing of personal data carried out in connection with the Services, within the meaning of Article 4(7) of the GDPR, is:

Nuno Melo
Website: https://www.plotshelf.com
Contact for privacy and data protection matters: nunomelodev@gmail.com

For the purposes of this Policy, the data controller may also be referred to as "PlotShelf".

Personal data is processed in accordance with the principles established in Article 5 of the GDPR, including the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

PlotShelf seeks to ensure that only data which is adequate, relevant and limited to what is strictly necessary for each purpose is processed.

4.1. Name provided by the user

When first accessing the application, the user may optionally provide a name for the sole purpose of personalising the interface and user experience.

Providing a name:

• Is optional;
• Is not a requirement for accessing or using the application;
• Does not result in the creation of an account, registration or user profile;
• Does not enable the user to be authenticated or identified by PlotShelf;
• Does not involve the transmission of the name to PlotShelf or to any infrastructure controlled by PlotShelf; and
• Does not result in the name being used for advertising, commercial, analytical or profiling purposes.

The name is stored exclusively on the user's device and remains under the user's material control. PlotShelf does not have remote access to the name, does not receive it within its systems and cannot associate it with an identified or identifiable natural person.

The user may amend or delete the name through the features made available within the application or by deleting the application's locally stored data. Uninstalling the application may also result in the deletion of such data, without prejudice to any backup or restoration mechanisms provided and controlled by the operating system, device manufacturer or user.

4.2. Reading activity data

Information entered or generated by the user when using the application, including, without limitation:

• Books added to the library;
• Book lists;
• Reading status and progress;
• Reading sessions and reading time;
• Number of pages read;
• Notes and annotations;
• Ratings and reviews;
• Monthly or annual goals; and
• Statistics, preferences and other records relating to reading activity,

is stored exclusively on the user's device.

PlotShelf does not externally receive, store or access this information and does not use it for behavioural advertising, direct marketing, profiling or disclosure to other users.

The use of backup, synchronisation or restoration mechanisms provided by the operating system or device manufacturer, where enabled by the user, is governed by the respective third parties' terms and privacy policies.

5.1. Purpose

The application uses Sentry, a service provided by Functional Software, Inc., for technical monitoring, fault diagnosis, identification of execution errors, performance analysis and the maintenance of the application's security and stability.

When an error or technical event occurs, the following data may be processed, depending on the technical configuration of the application and device:

• Device type, model and technical characteristics;
• Operating system and version;
• Application version;
• Date and time of the event;
• Technical logs, error messages and execution sequence information;
• The technical state of the application at the time of the event;
• Technical or pseudonymous identifiers associated with the installation or event;
• Data relating to the application's performance and operation; and
• IP address, where its processing or inference has been technically enabled.

PlotShelf does not intentionally configure Sentry to transmit the optional name, notes, reviews, lists, reading history or other content entered by the user.

5.2. Legal basis

The processing is based on the legitimate interests pursued by the data controller, under Article 6(1)(f) of the GDPR, consisting of ensuring the application's security, integrity, stability, maintenance and technical improvement.

PlotShelf considers this processing to be necessary and proportionate, given the strictly technical nature of the data and the need to identify and resolve faults that may compromise the application's operation.

5.3. Recipient and processor

Functional Software, Inc., the provider of Sentry, may process data on behalf of and in accordance with PlotShelf's instructions, in its capacity as a processor under Article 28 of the GDPR.

Information regarding the provider's privacy practices is available at: https://sentry.io/privacy/

The website does not provide contact forms, newsletter subscriptions, waiting lists, restricted areas or account-creation mechanisms.

Notwithstanding the above, accessing the website may result in the automatic processing of technical data required to establish communications, provide content, secure the infrastructure and prevent abusive use, including:

• IP address;
• Date and time of access;
• Requested resource or page;
• Browser type and version;
• Operating system;
• Technical information concerning the device;
• Referring website or address;
• Server response codes; and
• Technical and security logs.

Such data may be processed by the hosting and technological infrastructure provider used by PlotShelf.

The legal basis for this processing is the legitimate interests pursued by the data controller, under Article 6(1)(f) of the GDPR, in making the website available, ensuring its integrity and security, preventing unauthorised access and diagnosing technical incidents.

7.1. Nature and purpose of the processing

The website uses Google Analytics, a service provided by Google, to collect statistical information regarding website use and to assess its performance.

Depending on the settings adopted and the consent provided by the user, the following data may be processed:

• Online identifiers or random identifiers;
• Cookies and equivalent technologies;
• Browser, operating system and device information;
• Interactions, pages viewed and navigation events;
• Date, approximate duration and origin of sessions;
• Approximate geographical location; and
• IP address during technical transmission, without prejudice to the measures applied by Google Analytics to prevent its logging or storage.

PlotShelf must not transmit names, email addresses or other information that directly identifies users to Google Analytics.

7.2. Legal basis

The processing of data through Google Analytics and the storage of or access to information on the user's terminal equipment is subject to the user's prior, freely given, specific, informed and unambiguous consent, pursuant to:

• Articles 6(1)(a) and 7 of the GDPR; and
• Article 5 of Portuguese Law No. 41/2004 of 18 August, as amended.

Analytics cookies and their associated data-collection mechanisms must not be activated before the user has provided valid consent.

Refusing consent does not restrict access to the website's essential features.

7.3. Withdrawal of consent

The user may refuse or withdraw consent at any time and as easily as consent was initially provided, through the cookie-preference management mechanism made available on the website.

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

The user may also use the Google Analytics opt-out browser add-on, available at: https://support.google.com/analytics/answer/181881

Information concerning Google's privacy practices is available at: https://policies.google.com/privacy

The website may use:

8.1. Strictly necessary cookies

These are cookies that are essential for the website's technical operation, security or the provision of features expressly requested by the user.

Where strictly necessary, these cookies may be exempt from the prior-consent requirement under applicable legislation, without prejudice to the applicable information obligations.

8.2. Analytics cookies

These cookies are used to measure and analyse website use, including through Google Analytics.

Analytics cookies may only be placed or accessed after the user has provided consent.

Specific information concerning each cookie's name, provider, purpose and duration must be included in the consent-management mechanism or in a supplementary Cookie Policy, in accordance with the technical configuration effectively implemented on the website.

Personal data may be disclosed or made available, to the extent strictly necessary, to the following categories of recipients:

• Hosting and technological infrastructure providers;
• Functional Software, Inc., as the provider of Sentry;
• Google and the relevant entities within its group involved in providing Google Analytics;
• Technical, legal or security advisers subject to confidentiality obligations; and
• Administrative, judicial, law-enforcement or regulatory authorities, where disclosure is required by law.

PlotShelf does not sell, commercially transfer or otherwise make personal data available for third parties' direct-marketing purposes.

The use of providers established outside the European Economic Area or whose infrastructure is located outside the European Economic Area may result in international transfers of personal data.

Where applicable, such transfers will be conducted under one of the mechanisms provided for in Chapter V of the GDPR, including:

• An adequacy decision adopted by the European Commission under Article 45 of the GDPR;
• The EU–US Data Privacy Framework, where the recipient is duly certified;
• Standard contractual clauses approved by the European Commission under Article 46 of the GDPR; or
• Any other legally admissible mechanism.

Where required, supplementary measures appropriate to the nature of the data, circumstances of the transfer and identified risks will be adopted.

Personal data will be retained only for the period necessary to fulfil the purposes for which it was collected or for any period required by applicable law.

In particular:

• The name and content relating to reading activity remain stored locally until amended or deleted by the user or until the application data is deleted;
• Website technical logs will be retained for the period necessary for security, maintenance and incident investigation purposes;
• Data processed through Sentry will be retained for the period configured in the account used by PlotShelf and necessary for the analysis and resolution of faults;
• Google Analytics data will be retained for the period configured in the relevant property, without prejudice to its earlier deletion or aggregation; and
• Data required to comply with legal obligations or establish, exercise or defend legal claims may be retained for the applicable statutory limitation periods.

At the end of the relevant retention period, the data will be deleted, anonymised or rendered inaccessible unless continued retention is required by law.

Under and subject to the limitations established in Articles 15 to 22 of the GDPR, the data subject may exercise the following rights, depending on the relevant processing activity:

• The right of access to personal data;
• The right to rectification of inaccurate or incomplete data;
• The right to erasure;
• The right to restriction of processing;
• The right to object to processing based on legitimate interests;
• The right to data portability, where applicable;
• The right to withdraw consent at any time; and
• The right not to be subject to decisions based solely on automated processing which produce legal or similarly significant effects.

These rights may be exercised by contacting nunomelodev@gmail.com.

PlotShelf may request additional information that is strictly necessary to verify the requester's identity, under Article 12(6) of the GDPR.

Requests will be handled without undue delay and, in any event, within the period established in Article 12(3) of the GDPR.

With regard to the name and content stored exclusively on the device, PlotShelf has no technical access to such data and has no means of associating it with the relevant user. Accessing, rectifying or deleting such data must therefore be carried out directly through the application or device settings.

Where processing is based on Article 6(1)(f) of the GDPR, the data subject has the right to object, at any time and on grounds relating to their particular situation, to the processing of personal data concerning them.

Following an objection, the processing will cease unless compelling legitimate grounds for the processing are demonstrated which override the data subject's interests, rights and freedoms, or unless the processing is required for the establishment, exercise or defence of legal claims.

Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with the competent supervisory authority under Article 77 of the GDPR.

The competent supervisory authority in Portugal is:

Comissão Nacional de Proteção de Dados — CNPD
Avenida D. Carlos I, No. 134, 1st Floor
1200-651 Lisbon
Portugal
Website: https://www.cnpd.pt

PlotShelf adopts technical and organisational measures appropriate to the relevant risks, in accordance with Article 32 of the GDPR, intended to ensure an appropriate level of security, including, where applicable:

• Data minimisation;
• Local storage of information entered by the user;
• Access restrictions and controls;
• Protection of communications;
• Fault and incident monitoring; and
• Periodic assessment of the adequacy of the implemented measures.

Notwithstanding the adoption of appropriate safeguards, no information system or data-transmission method can guarantee absolute security.

Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, PlotShelf will notify the competent supervisory authority in accordance with the requirements and deadlines established in Article 33 of the GDPR.

Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, the affected individuals will be informed in accordance with Article 34 of the GDPR, unless a legally established exception applies.

PlotShelf does not make decisions based solely on automated processing of personal data which produce legal effects concerning the user or similarly significantly affect the user, within the meaning of Article 22 of the GDPR.

PlotShelf does not use the processed data for behavioural profiling or personalised advertising.

The Services are not specifically directed at children and are not intended to collect children's personal data.

If PlotShelf becomes aware that a child's personal data has been processed in breach of applicable legislation, it will take appropriate measures to delete the data or otherwise bring the processing into compliance.

A legal representative may contact PlotShelf at nunomelodev@gmail.com.

The Services may contain links to websites, applications or services operated by third parties.

PlotShelf does not control or assume responsibility for processing activities independently conducted by such third parties. Users are advised to review the relevant privacy policies before using those services or providing any information.

PlotShelf reserves the right to amend this Policy whenever necessary to reflect legal, regulatory, technical or functional changes.

The current version will be made available at https://www.plotshelf.com, together with its latest revision date.

Where amendments materially affect data subjects' rights, reasonable measures will be taken to ensure that they are appropriately publicised.

To exercise data-protection rights or request clarification regarding the processing of personal data:

Data controller: Nuno Melo
Email: nunomelodev@gmail.com
Website: https://www.plotshelf.com