Privacy Policy
Effective Date: 1 September 2026 · Last Updated: September 2026
Data Controller: Fundação Lakhani (operating as “TLG Foundation”)NIPC (Tax / Legal Entity Number): 517 674 394
Headquarters / Registered Office: Largo Almirante Gago Coutinho, n.os 6 e 6-A, 2780-245 Oeiras, Portugal
Data Protection Contact: info@tlg.foundation | +351 214 316 029
1. Introduction & Scope
Fundação Lakhani (“TLG Foundation”, “we”, “us”, or “our”) is dedicated to protecting the privacy and fundamental rights of all visitors, partners, donors, volunteers, and event participants. This Privacy Policy sets out how we collect, process, store, and protect personal data in strict compliance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and Portuguese Law n.º 58/2019, of 8 August.
2. Categories of Personal Data We Collect
We only collect personal data that is necessary for institutional, educational, community, and philanthropic activities:
- Contact & General Enquiries: Name, email address, telephone number, and message content submitted through our contact forms.
- Event & Competition Registrations: Participant name, age/date of birth, parent/guardian contact details (for participants under 18), submissions, working titles, and synopses (e.g. Festival Gandhi Youth Creative Competition).
- Donations & Financial Support: Name, email, tax identification number (NIF/NIPC) where tax documentation is requested, and bank transfer reference details. (Card payments are not processed directly on this website).
- Volunteering & Training Programmes: Contact information, educational background, language levels, and course registration data for Portuguese Language (PLA) and vocational training initiatives.
- Technical & Browsing Data: IP address (anonymized), browser type, device information, operating system, and pages visited via essential and analytical cookies.
3. Legal Bases for Processing (Article 6 GDPR)
| Purpose of Processing | Data Processed | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Responding to general and institutional enquiries | Name, email, message | Legitimate Interest (Art. 6(1)(f)) |
| Processing competition pre-registrations & event participation | Name, age, guardian details, email, phone | Performance of a contract (Art. 6(1)(b)) |
| Managing donations, donor receipts & statutory records | Name, NIF, bank details | Legal obligation (Art. 6(1)(c) – Accounting & Fiscal Law) |
| Website security, spam prevention & service optimization | IP address, system logs | Legitimate Interest (Art. 6(1)(f) – IT & security compliance) |
4. Special Protection for Minors
Where youth competitions or cultural activities involve participants under the age of 18, explicit parental or legal guardian consent and contact details are mandatory. We never publish names, photographs, or identifiable creative works of minors without prior verified written guardian consent.
5. Joint Controllership
For events like the Festival Gandhi Youth Creative Competition, which are co-organized with partners such as Associação Casa da Índia, both entities jointly determine the purposes and means of processing. In these instances, we act as Joint Controllers under Article 26 of the GDPR. A formal arrangement is in place to determine our respective responsibilities, and its essence will be made available to data subjects.
6. Data Processors & Third-Party Sharing
Fundação Lakhani does not sell, rent, or commercially trade personal data. Data is shared exclusively with authorized sub-processors under formal Data Processing Agreements (Art. 28 GDPR):
- Zoho Corporation: CRM and secure form handling. We have a Data Processing Agreement in place. Data is primarily hosted in the EU, with appropriate safeguards (such as Standard Contractual Clauses) applied for any necessary technical access or transfers outside the EEA.
- Web Hosting & Infrastructure: Dedicated secure servers located in the European Union.
- Public & Regulatory Authorities: Presidência do Conselho de Ministros (PCM), Tax Authorities (AT), or judicial bodies solely when mandated by Portuguese law.
7. Data Retention Periods
Personal data is retained only for the period necessary to fulfill the specific purpose for which it was collected:
- Unfulfilled Event Pre-registrations: Deleted securely shortly after the event deadline.
- Event Participants & Winners: Retained for the duration of the event and for specific periods thereafter to manage copyright licenses, prizes, and historical archives.
- Parental Consents & Image Rights: Retained for as long as the respective image or work is utilized under the terms of the authorization.
- Donor & Financial Records: Retained for 10 years as required by Portuguese fiscal and statutory foundation reporting laws.
- Technical Logs: Retained for a maximum of 90 days.
8. Your Data Subject Rights
Subject to the conditions and limitations established by the GDPR, you have the right to:
- Access: Request confirmation and copies of your personal data held by us.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure (“Right to be Forgotten”): Request deletion of your personal data where retention is no longer legally required.
- Restriction & Objection: Restrict or object to the processing of your data.
- Data Portability: Receive your data in a structured, commonly used, machine-readable format.
- Withdraw Consent: Withdraw previously granted consent at any time without affecting prior lawful processing.
To exercise any of these rights, contact us in writing at info@tlg.foundation. You also hold the right to lodge a formal complaint with the Portuguese Data Protection Authority: Comissão Nacional de Proteção de Dados (CNPD) (www.cnpd.pt).
9. Security Measures
We implement appropriate technical and organisational measures, taking into account the nature, scope, context and risks of the processing, in accordance with Article 32 GDPR.