Privacy and data protection

Controller: Obsidian Innovation Institute – Associação, Portugal. Contact for privacy matters: use the website contact channel and identify the request as a data-protection matter.

Data processed: information voluntarily supplied through enquiries or collaboration requests; account identity used for authorised administration; technical security logs required to protect the service; language and privacy preferences stored on the visitor’s device.

Purposes and legal bases: responding to an enquiry and taking pre-contractual steps; administering agreed activities and relationships; complying with legal obligations; protecting the website and institute systems on the basis of legitimate interests; and operating optional analytics or external media only where valid consent has been given.

Recipients and processors: authorised institute personnel and service providers strictly necessary for hosting, security, communications and technical operation. Personal data is not sold. Any transfer outside the EEA must rely on an applicable adequacy decision or appropriate safeguards under Chapter V GDPR.

Retention: enquiries are retained only while required for response, follow-up and accountable records; security data is retained for the shortest operationally justified period; consent choices are retained for up to six months before renewal; legal or contractual records may be retained for the applicable statutory period.

Rights: data subjects may request access, rectification, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. Consent may be withdrawn at any time without affecting earlier lawful processing. A complaint may be submitted to the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD).

Requests will be handled without undue delay and normally within one month. Identity verification may be required where necessary to protect the data subject.