Last updated: 28.04.2026
This Privacy Policy aims to define the general principles and rules applicable to the processing of personal data carried out within the Matchbox platform (“Platform”), ensuring compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), as well as other applicable legislation regarding the protection of personal data.
This Privacy Policy also aims to provide data subjects with specific, explicit, and informed information about the collection and processing of their personal data in the context of accessing, registering for, and using the Platform.
Within the Platform, personal data is processed in accordance with the following principles:
a) Personal data is processed lawfully, fairly, and transparently;
b) Personal data is collected for specific, explicit, and legitimate purposes and is not further processed in a way that is incompatible with those purposes;
c) Personal data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed;
d) Personal data is accurate and, where necessary, kept up to date, with appropriate measures being taken to ensure that inaccurate data is erased or rectified without delay;
e) Personal data is retained only for the period necessary for the purposes for which it is processed, without prejudice to applicable legal retention periods;
f) Personal data is processed in a manner that ensures its security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
Startup Portugal also ensures that third parties acting on its behalf in the processing of personal data within the Platform are subject to confidentiality, security, and compliance obligations equivalent to those set out in this Privacy Policy and applicable legislation.
The entity responsible for processing personal data within the Matchbox Platform is:
Startup Portugal – Portuguese Association for the Promotion of Entrepreneurship (SPAPPE)
Headquarters: Rua de Salazares, n.º 842, 4100-442 Porto
Email: matchbox@startupportugal.com
Startup Portugal determines the purposes and means of processing personal data collected within the Platform. For the purposes of this Privacy Policy, it is also important to note that Startup Portugal is the Administrator of the Platform.
Without prejudice to the provisions of the preceding paragraph, Beta-i – Collaborative Innovation may act as a partner entity in providing methodological and operational support to the Platform and may have access to personal data to the extent strictly necessary for the achievement of these purposes, under the terms agreed with Startup Portugal and in accordance with applicable legislation. For the purposes of this Privacy Policy, it is also important to note that Beta-i acts as the Operational Partner.
Within the Platform, Startup Portugal may collect and process, in particular, the following categories of personal data:
a) Identification data, including full name, position or function held, entity represented, and other professional identification details, where applicable;
b) Contact information, including email address, phone number, and business address;
c) Registration and authentication data, including access credentials, account identifiers, and information necessary for profile management and authentication on the Platform;
d) Professional and business data, including sector of activity, description of the entity, function performed, information on the activity of the company or startup/scaleup (specifically, size, maturity, and areas of operation), solutions, products, or services developed, technical skills, success stories, information on the status of startup and scaleup, and other information voluntarily entered in the User and/or Entity profile;
e) Data relating to the use of the Platform, including information submitted in challenges, responses, proposed solutions, messages, communications between Users through the Platform, and other interactions carried out on the Platform (including views, registrations, and selections), history of participation in matching processes, use and technical data associated with access to the Platform (IP address, browser type, operating system, date and time of access), and information about browsing behavior on the Platform;
f) Communication data, including the content of contacts made with the Matchbox team, whether with the Platform Administrator or with operational partners, support requests, clarifications, complaints, or other communications;
g) Browsing data and cookies, including information collected through cookies or similar technologies, in accordance with the Platform's respective Cookie Policy.
Startup Portugal does not, as a rule, request or recommend the inclusion of special categories of personal data (sensitive data) in the normal use of the Platform. If such data is exceptionally provided voluntarily by Users (for example, in the description of a technological solution in the healthcare field), its processing by Startup Portugal will be limited to what is strictly necessary for the purposes of the Platform and subject to applicable legal conditions.
Minors: The Matchbox Platform is intended exclusively for individuals aged 18 or older and legally constituted entities represented by adults with powers of representation. Startup Portugal does not intentionally collect personal data from individuals under 18 years of age. If Startup Portugal becomes aware that it has collected data from a minor without the proper consent of the holders of parental responsibilities, such data will be deleted as soon as possible.
Personal data may be collected, in particular, through the following means:
a) During the account creation and registration process on the Platform, by filling out the registration form;
b) In filling out or updating User profiles, including the voluntary insertion of professional, commercial, technical, or other information considered relevant by the User;
c) In the publication of challenges by companies, including a description of the business problem, technical requirements, evaluation criteria, and other information associated with the challenge;
d) In the submission of solutions or proposals by startups or scaleups in response to the published challenges, including the description of the solution, implementation proposal, technical information, and supporting documentation;
e) In the exchange of information and communications between Users through the Platform, whether through messages, comments, or other interaction tools made available by the Platform;
f) Through direct contact with Startup Portugal or the Matchbox operational team, including the operational partner, via email, contact forms, telephone, or other means provided;
g) Through cookies or similar technologies, when browsing and using the Platform, in accordance with the Cookie Policy;
h) Through the presentation of documentation or additional information submitted by Users for the purposes of eligibility validation, identity verification, or compliance with other requirements for participation in the Platform.
Startup Portugal processes personal data within the Platform for the following purposes:
a) User registration and authentication management, including the creation, validation, maintenance, and management of accounts for accessing the Platform;
b) Verification of User eligibility, including validation of participation requirements applicable to Companies, startups, and scaleups;
c) Managing the operation of the Platform, including publishing challenges, submitting solutions, evaluation and selection processes, matching processes, and facilitating interactions between Users;
d) Managing the relationship with Users, including responding to contact requests, providing technical support, clarifications, complaints, or other requests;
e) Compliance with legal, regulatory, and administrative obligations to which Startup Portugal is subject, including reporting, transparency, and accountability duties;
f) Guaranteeing security and preventing, detecting, and investigating fraud, abuse, misuse of the Platform, or violations of the Terms and Conditions or the Platform Regulations;
g) Improving the user experience, performance, functionalities, and design of the Platform, including usability testing and technical optimization;
h) Production of statistical, analytical, or management information, preferably in aggregated, anonymized, or pseudonymized form, for the purposes of evaluating the Platform's performance, preparing activity reports, and supporting decision-making;
i) Sending communications related to the use of the Platform, including service notifications, activity alerts, confirmations of actions taken, contractual changes, especially to the Terms and Conditions, Privacy Policy, Regulations, or other operational or legal communications essential to the functioning of the Platform;
j) Sending institutional, promotional, or informational communications, including newsletters, information about new programs, events, opportunities, or other initiatives of Startup Portugal or partners, when there is a legal basis for doing so under applicable law.
The processing of personal data within the Platform is based, as applicable, on the following legal grounds:
a) Performance of a contract or pre-contractual steps, when processing is necessary for registration, use of the Platform, or management of the relationship with the User;
b) Compliance with a legal obligation, when processing is necessary for compliance with legal duties to which Startup Portugal is subject;
c) Legitimate interest, when processing is necessary to ensure the operation, security, improvement, and management of the Platform, provided that the fundamental rights and freedoms of the data subjects do not prevail;
d) Consent of the data subject, when legally required;
e) Protection of vital interests, when such grounds are applicable in exceptional situations;
f) Achievement of objectives of public interest, when applicable under the law.
When processing is based on the data subject's consent, the data subject may withdraw it at any time through the means indicated in the relevant communication or by contacting: matchbox@startupportugal.com. Withdrawal of consent does not compromise the lawfulness of the processing carried out based on the consent previously given.
Startup Portugal may share personal data, to the extent strictly necessary for the achievement of the identified purposes, with the following categories of recipients:
a) Entities providing technological services, including providers of hosting, cloud storage, systems maintenance, technical support, software development, IT security, data analysis, and other entities that provide services essential to the technical operation of the Platform;
b) Beta-i, as a partner entity responsible for methodological, technical, and operational support to the Matchbox Platform;
c) Subcontractors or service providers acting on behalf of Startup Portugal, under documented instructions and subject to contractual obligations of confidentiality and data protection;
d) Public, regulatory, judicial, or administrative authorities, whenever such communication is required by law, regulation, court decision, by legitimate order of a competent authority, or when it is necessary for compliance with a legal obligation to which Startup Portugal is subject;
e) Other users of the Platform, when such sharing occurs as a result of the normal operation of the Platform and is necessary for facilitating connections between Companies and startups/scaleups, in accordance with the Terms and Conditions and Regulations.
Whenever applicable, Startup Portugal will ensure that third parties accessing personal data within the Platform are bound by confidentiality obligations and appropriate contractual obligations regarding data protection.
Startup Portugal does not, under any circumstances, sell personal data to third parties.
Within the scope of the Platform's operation, personal data may be shared between Users, especially to facilitate contact, the evaluation of collaboration opportunities, and the possible progression to later stages of the matching process.
Data sharing between Users generally occurs in the following situations:
• When a startup or scaleup is shortlisted for a challenge, the company may access the startup's contact information and profile;
• When there is mutual interest in proceeding to further stages of discussion or negotiation, the parties may exchange additional information directly or through the Platform;
• When the Platform facilitates matching by providing contact details or other information necessary to connect the parties.
Regarding data sharing between Users:
a) The provision of contact details or other information necessary for contact between Users is intended exclusively for the evaluation of a potential collaboration;
b) Any subsequent processing of personal data carried out by Users is the sole responsibility of the Users, who must ensure compliance with applicable data protection legislation;
c) Users agree not to use the personal data received for purposes other than those that justified its sharing;
d) Users who receive personal data from other Users are subject to the confidentiality obligations set forth in the Platform's Terms and Conditions and must treat all information received with the appropriate level of diligence and security.
Startup Portugal is not responsible for the processing of personal data carried out independently by Users after direct contact has been established between them, especially in the context of negotiations, contracts, or other relationships established outside the Platform.
Startup Portugal will seek to ensure that the processing of personal data within the Platform takes place within the European Economic Area.
In exceptional cases where it becomes necessary to use service providers or solutions that involve the transfer of personal data to third countries or international organizations, Startup Portugal will ensure that such transfer is carried out in accordance with applicable legislation, namely through the adoption of appropriate and legally admissible mechanisms.
Startup Portugal retains personal data only for the period necessary to achieve the purposes for which it is processed, without prejudice to legally required retention periods.
In particular:
a) Account and profile data will be retained while the account remains active and, after its closure, for the period necessary to comply with legal obligations and defend rights;
b) Data related to challenges, solutions, evaluation, selection, matching, and interactions may be retained for the period necessary for the management of the Platform, the documentation of the activity carried out, and the defense of rights in case of litigation;
c) Data processed based on consent will be kept until that consent is withdrawn, without prejudice to the need to retain proof of the consent given;
d) Data necessary for compliance with legal obligations will be retained for the legally required periods.
When data is no longer needed, it will be deleted or anonymized, unless its retention is required by law or proves necessary for the declaration, exercise, or defense of a right in judicial, arbitral, or administrative proceedings.
Under applicable law, data subjects have the following rights:
a) Right of access;
b) Right of rectification;
c) Right to erasure;
d) Right to restriction of processing;
e) Right to object;
f) Right to data portability;
g) Right to withdraw consent, when the processing is based on this ground;
h) Right to lodge a complaint with the competent supervisory authority, in particular the Portuguese Data Protection Authority (CNPD).
The exercise of these rights may be requested via email: matchbox@startupportugal.com.
Startup Portugal will respond to the request within a maximum of one month from its receipt, except in cases of particular complexity or a high number of requests, in which case this period may be extended to two months, in accordance with the law.
To facilitate the processing of the request and ensure the protection of personal data, Startup Portugal may request the following from the data subject:
• Identification of the account holder (name and email registered on the Platform);
• Specification of the right the data subject wishes to exercise (access, rectification, erasure, etc.);
• Additional information allowing Startup Portugal to identify the personal data in question and verify the identity of the data subject, when there are reasonable doubts as to the identity of the person submitting the request.
Taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, as well as the risks to the rights and freedoms of data subjects, Startup Portugal adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
These measures may include, in particular:
a) Access controls and authentication;
b) Differentiated access profiles based on knowledge requirements;
c) Logical and physical security measures;
d) Mechanisms for monitoring and preventing unauthorized access;
e) Internal security and confidentiality policies;
f) Periodic evaluation of the effectiveness of the measures implemented.
Nevertheless, no security measure is absolutely infallible, so Startup Portugal recommends that Users also adopt diligent and responsible behaviors in protecting their credentials and the information they share.
In the event of a personal data breach that could result in a risk to the rights and freedoms of data subjects, Startup Portugal will notify the Portuguese Data Protection Authority (CNPD), the competent supervisory authority, in accordance with the terms and deadlines legally applicable.
Whenever a breach is likely to pose a high risk to the rights and freedoms of data subjects, Startup Portugal will notify the affected data subjects, when legally required.
Any suspected personal data breach related to the Platform may be reported to: matchbox@startupportugal.com.
The Platform may use cookies or similar technologies to ensure its functionality, improve the browsing experience, analyze Platform usage, and, where applicable, personalize content or communications.
The use of cookies is governed by the respective Cookie Policy, which is incorporated into this Privacy Policy for all legal purposes.
Startup Portugal reserves the right to alter, modify, update, or supplement this Privacy Policy at any time, namely to adapt to legislative and regulatory changes, the evolution of data processing practices, new Platform functionalities, or recommendations from supervisory authorities.
Any relevant changes will be communicated through the Platform or by other means deemed appropriate, indicating, where applicable, the date on which they will take effect.
The most current version of the Privacy Policy will be permanently available on the Platform.
Continued use of the Platform after the changes come into effect constitutes full and unreserved acceptance of the updated Privacy Policy.
This document is written in both Portuguese and English. If versions in other languages are available, the Portuguese version will always prevail for interpretation and application purposes.
For any questions related to this Privacy Policy or the processing of personal data within the Matchbox Platform, the data subject may contact:
Startup Portugal – Portuguese Association for the Promotion of Entrepreneurship (SPAPPE)
Email: matchbox@startupportugal.com
Version: 1.0
Effective date: 28.04.2026
Last updated: 28.04.2026