Last updated: September 13, 2026
PSSI is a registered nonprofit in Portugal under NPIC number 519137965, based in Lisbon, Portugal. This policy explains what personal data we collect through this website, why we collect it, and the choices you have.
Who is responsible for your data
PSSI is the data controller for personal data collected through this website. If you have any question about this policy or about your data, you can reach us at sandbox.socialimpact@gmail.com or through our contact form.
What we collect, and why
We only collect the personal data that is reasonably necessary to run this website and respond to you. In practice, that means:
- Contact form and email: when you write to us, we receive your name, email address, and whatever else you include in your message, so we can reply.
- Careers and applications: if you apply to an open role or the Sandbox programme through this site, we collect the details you submit (such as your name, contact details, and CV or application content) to evaluate your application.
- Newsletter: if you subscribe, we collect your email address to send you updates. You can unsubscribe at any time using the link in any email we send.
- Donations: if you donate through this site, payment details are processed directly by our payment provider (such as Stripe or PayPal) — we do not store your card details ourselves.
- Analytics cookies: with your consent, given through the cookie banner shown on your first visit, we use Google Analytics to understand how visitors use the site (pages viewed, general location, device type). We do not load analytics before you consent, and you can withdraw consent at any time via "Cookie Preferences" in the footer.
- Essential cookies: a small number of cookies are required for the site to function correctly (for example, remembering your cookie preference itself, or a dark/light theme choice). These do not require consent under GDPR as they are strictly necessary.
Our legal basis for processing
Depending on the situation, we rely on one of the following legal bases under the GDPR: your consent (for analytics cookies and the newsletter), the steps necessary to respond to a request you have made (for the contact form and applications), or our legitimate interest in running and improving this website in a way that does not override your rights.
How long we keep your data
We keep personal data only for as long as it is needed for the purpose it was collected for — for example, contact messages and applications are kept while we are in contact with you and for a reasonable period afterward, and newsletter addresses are kept until you unsubscribe. We do not sell or rent your personal data to third parties.
Sharing your data
We do not sell personal data. We share data only where necessary to run the site: with our hosting provider, with our payment processor for donations, and with analytics providers (only after you consent to analytics cookies). Any such provider only processes data on our instructions and under an appropriate data processing agreement.
Your rights
Under the GDPR, you have the right to access, correct, or delete the personal data we hold about you, to object to or restrict certain processing, to ask for your data in a portable format, and to withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Portugal's data protection authority, if you believe your data has been mishandled.
To exercise any of these rights, contact us at sandbox.socialimpact@gmail.com.
Changes to this policy
We may update this policy from time to time, for example if we start using a new service on the site. The "Last updated" date at the top of this page will always reflect the most recent change.