Privacy Policy
Effective Date: 1 September 2026 · Last Updated: September 2026
NIPC (Tax / Legal Entity Number): 517 674 394
Headquarters / Registered Office: Largo Almirante Gago Coutinho, n.os 6 e 6-A, 2780-245 Oeiras, Portugal
Data Protection Contact: info@tlg.foundation | +351 214 316 029
1. Introduction & Scope
Fundação Lakhani (“TLG Foundation”, “we”, “us”, or “our”) is dedicated to protecting the privacy and fundamental rights of all visitors, partners, donors, volunteers, and event participants. This Privacy Policy sets out how we collect, process, store, and protect personal data in strict compliance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Portuguese Law n.º 58/2019, of 8 August.
2. Categories of Personal Data We Collect
We only collect personal data that is necessary for institutional, educational, community, and philanthropic activities:
- Contact & General Enquiries: Name, email address, telephone number, and message content submitted through our contact forms.
- Event & Competition Registrations: Participant name, age/date of birth, parent/guardian contact details (for participants under 18), submissions, working titles, and synopses (e.g. Festival Gandhi Youth Creative Competition).
- Donations & Financial Support: Name, email, tax identification number (NIF/NIPC) where tax documentation is requested, and bank transfer reference details. (Card payments are not processed directly on this website).
- Volunteering & Training Programmes: Contact information, educational background, language levels, and course registration data for Portuguese Language (PLA) and vocational training initiatives.
- Technical & Browsing Data: IP address (anonymized), browser type, device information, operating system, and pages visited via essential and analytical cookies.
3. Legal Bases for Processing (Article 6 GDPR)
| Purpose of Processing | Data Processed | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Responding to general and institutional enquiries | Name, email, message | Consent (Art. 6(1)(a)) & Legitimate Interest (Art. 6(1)(f)) |
| Processing competition pre-registrations & event participation | Name, age, guardian details, email, phone | Consent (Art. 6(1)(a)) & Performance of terms (Art. 6(1)(b)) |
| Managing donations, donor receipts & statutory records | Name, NIF, bank details | Legal obligation (Art. 6(1)(c) – Accounting & Fiscal Law) |
| Website security, spam prevention & service optimization | IP address, system logs | Legitimate Interest (Art. 6(1)(f) – IT & security compliance) |
4. Special Protection for Minors
Where youth competitions or cultural activities involve participants under the age of 18, explicit parental or legal guardian consent and contact details are mandatory. We never publish names, photographs, or identifiable creative works of minors without prior verified written guardian consent.
5. Data Processors & Third-Party Sharing
Fundação Lakhani does not sell, rent, or commercially trade personal data. Data is shared exclusively with authorized sub-processors under formal Data Processing Agreements (Art. 28 GDPR):
- Zoho Corporation: CRM, secure form handling, and internal email communications (EU servers, strict GDPR alignment).
- Web Hosting & Infrastructure: Dedicated secure servers located in the European Union.
- Public & Regulatory Authorities: Presidência do Conselho de Ministros (PCM), Tax Authorities (AT), or judicial bodies solely when mandated by Portuguese law.
6. Data Retention Periods
Personal data is retained only for the period necessary to fulfill the specific purpose for which it was collected:
- Enquiries & Event Pre-registrations: Retained for the duration of the event/competition and deleted within 12 months following event closure.
- Donor & Financial Records: Retained for 10 years as required by Portuguese fiscal and statutory foundation reporting laws.
- Technical Logs: Retained for a maximum of 90 days.
7. Your Data Subject Rights
Under the GDPR and Portuguese law, you have the right to:
- Access: Request confirmation and copies of your personal data held by us.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure (“Right to be Forgotten”): Request deletion of your personal data where retention is no longer legally required.
- Restriction & Objection: Restrict or object to the processing of your data.
- Data Portability: Receive your data in a structured, commonly used, machine-readable format.
- Withdraw Consent: Withdraw previously granted consent at any time without affecting prior lawful processing.
To exercise any of these rights, contact us in writing at info@tlg.foundation. You also hold the right to lodge a formal complaint with the Portuguese Data Protection Authority: Comissão Nacional de Proteção de Dados (CNPD) (www.cnpd.pt).
8. Security Measures
We implement technical and organizational measures (Art. 32 GDPR) including SSL/TLS 256-bit encryption, strict role-based access control, multi-factor authentication (MFA) for administrators, and routine security audits.