privacy policy.

1. Who we are

Moonshot Pirates Foundation is a registered non-profit association under Austrian law (gemeinnütziger Verein, ZVR 1020512239), based at Co-Innovation Factory, Absberggasse 27/1/3, 1100 Vienna, Austria. The Foundation is the sole owner of beapirate GmbH (FN 530030 g), our wholly-owned social enterprise, which operates our digital platforms and commercial activities on behalf of the Foundation.

For GDPR purposes, beapirate GmbH (Moonshot Pirates) is the primary data controller responsible for processing your Personal Data, under the oversight of the Foundation. In this Policy, "Moonshot Pirates," "we," or "us" refers to both entities operating together.

Privacy contact

Marko Londa, Co-Founder & Chief Changemaker — [email protected]

Formal requests

[email protected]

At our current operational scale, Moonshot Pirates is not required to appoint a Data Protection Officer (DPO) under GDPR Article 37. Privacy oversight is handled directly by the founders, with external legal review on a periodic basis. We will appoint a formal DPO if and when we meet the thresholds requiring one.

2. What information we collect

We only collect Personal Data that is relevant and necessary for the purposes of our programs and operations.

Information you provide directly

• Contact details: Name, email address, telephone number, postal address, and other basic contact information.
• Profile information: Age or date of birth, gender (if you choose to provide it), country of residence, nationality, languages spoken, and optionally a photo or short bio.
• Education and background: School or university, occupation, areas of interest or expertise, and skills relevant to our programs.
• Program application data: Motivation statements, project ideas, portfolios, or references, where required for specific programs.
• Event logistics data: For in-person events — travel details, accommodation needs, dietary requirements, emergency contact persons, and medical or allergy information (only where necessary for safe participation).
• Payment information: For paid events or donations, payment details handled by our payment processor (Stripe). We do not store full card numbers ourselves.
• Communications: The content of any messages or inquiries you send us.

We do not collect sensitive categories of personal data (racial origin, political opinions, biometric data, etc.) unless there is a clear and lawful reason, such as a voluntary diversity survey with explicit consent.

Information we receive from third parties

• Partners or referrals: Schools, youth organizations, or partners may refer you to our programs and share your contact information for that purpose.
• Public sources: We may consult publicly available information (e.g., a LinkedIn profile) to evaluate applications or invitations.
• Payment verification: Our payment processor may use anti-fraud services that verify payment information.

Information we collect automatically

When you visit our websites:

• Device and browsing information: IP address (which we receive but do not store long-term), browser type, operating system, and region/country inferred from IP.
• Usage data: Pages visited, time spent, links clicked, and referrer URL.
• Analytics: We use Cloudflare Web Analytics, which is cookieless and does not track individual visitors. It provides aggregate metrics only. We do not use Google Analytics, Facebook Pixel, or other tracking pixels on our website.

Mentor data

Mentors register through our platform and provide their name, contact details, professional background, profile photo, and other information relevant to their role. With consent, mentoring sessions may be recorded for safeguarding, quality assurance, and (separately) promotional purposes. Mentor data may be shared with assigned participants and partner organizations as agreed at registration.

Donor data

When you donate, we collect your name, email address, donation amount, and (optionally) community affiliation. Donors may remain anonymous. We do not sell, share, or trade donor information. Payments are processed by Stripe.

Images and recordings

We may photograph or record participants at events for documentation and promotional purposes. See our Terms & Conditions Section 7 (Media) for opt-out information. For participants under 18, additional consent rules apply as set out in our Safeguarding Policy.

3. How we use your information

We use your Personal Data only for purposes consistent with running our programs and fulfilling our mission. Specifically:

• Delivering our programs. Processing registrations, forming cohorts, matching mentors to mentees, sending program materials, issuing certificates, and communicating updates.
• Improving our services. Analyzing aggregate participation data to identify what is working, where to improve, and how to reach underserved communities. We use anonymized or aggregated data wherever possible.
• Communicating with you. Sending program-related notifications (essential, cannot be opted out of while you are an active participant) and newsletters or marketing communications (only with your consent, with easy unsubscribe).
• Facilitating program activities. Sharing limited participant profiles with mentors, fellow participants, or partners where necessary for the program to function.
• Operating our website. Ensuring site security, blocking malicious traffic, and maintaining functionality.
• Safeguarding and legal compliance. Verifying identities, monitoring for inappropriate behavior, and responding to safeguarding concerns or legal obligations.
• Other purposes with your consent. Any new use not described above will require your active consent.

Legal bases under GDPR

• Performance of a contract (Art. 6(1)(b)) — to provide the services you registered for.
• Consent (Art. 6(1)(a)) — for newsletter signup, marketing, and any optional data uses. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with applicable laws.
• Legitimate interest (Art. 6(1)(f)) — to operate, improve, and secure our programs, balanced against your rights.

4. How we share or disclose information

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

Program partners and sponsors

We may share limited participant information (typically names, project topics, age groups) with partners directly involved in delivering a program. Partners are contractually required to use this data only for the agreed purpose and to keep it confidential. They may not contact you for independent marketing without your separate consent.

Mentors, judges, and volunteers

Mentors and judges receive participant information necessary to fulfill their role (name, age, country, project summary). All mentors and judges sign a confidentiality and data handling agreement and complete safeguarding training before engaging with participants. They may not retain or use participant data beyond the program scope without your separate consent.

Service providers (data processors)

We use the following categories of service providers, each bound by a Data Processing Agreement under GDPR Article 28:

• Hosting: Cloudflare, Inc. (EU and US edge servers; covered by Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable)
• Email and form processing: Brevo (SAS Sendinblue, France — EU-based, GDPR-compliant)
• Payment processing: Stripe, Inc. (covered by Standard Contractual Clauses and EU-US Data Privacy Framework)
• Existing program platform: Bubble.io (US-based, covered by Standard Contractual Clauses)
• Communication tools: Video conferencing and messaging tools used for program delivery, each governed by their own Data Processing Agreement

We choose providers that meet GDPR standards and limit data shared to what is necessary for the service.

Legal compliance and protection

We may disclose information when required by law, when responding to a court order or law enforcement request, or when necessary to protect the safety of participants or others. We will limit disclosure to what is required and notify affected individuals where legally permitted.

Organizational transitions

If Moonshot Pirates merges with, is acquired by, or transfers operations to another non-profit entity with a substantially similar mission, participant data may be transferred. We will notify affected individuals at least 30 days in advance where practicable and provide an opportunity to request deletion before any transfer.

With your consent

Any sharing not described above will require your explicit consent.

5. Data security and storage

We implement administrative, technical, and physical safeguards to protect your data:

• Encryption in transit (HTTPS/TLS) for all data transmitted to and from our website.
• Access controls limiting personal data to staff and contractors who need it for their role.
• Vetted service providers with documented security practices.
• Incident response procedures and notification protocols in case of a data breach.
• Limited retention of identifying logs and analytics.

No method of transmission or storage is 100% secure. In the event of a data breach posing risk to you, we will notify you and the relevant Data Protection Authority as required by GDPR Article 33.

6. Cookies and tracking

Our website uses Cloudflare Web Analytics, which is cookieless. No tracking cookies, advertising pixels, or third-party trackers are set on our website by us.

The only cookies that may be set are:

• Strictly necessary cookies required for site functionality (e.g., maintaining your session if you log in)
• Cookies set by third-party platforms you choose to interact with — for example, if you click a YouTube embed, YouTube may set its own cookies. These are governed by the third party's privacy policy.

Because we do not use non-essential cookies, no cookie consent banner is displayed on our website. If our cookie practices change in the future, we will update this Policy and implement an active consent mechanism as required by law. For our existing program platform at app.moonshotpirates.com (Bubble), separate cookie practices apply and are disclosed within that platform.

7. Children's privacy and parental consent

Moonshot Pirates programs are open to participants aged 15 and above. We do not knowingly collect Personal Data from children under 13 from any jurisdiction. We acknowledge that the age of digital consent under GDPR Article 8 varies across EU member states (between 13 and 16), and that the age of majority in most jurisdictions is 18.

Minimum age

Our minimum participation age is 15. If we learn that a child under 13 has provided us with Personal Data, we will delete it promptly.

Participants aged 15–17

For participants between 15 and 17, we require active parental or guardian consent to register for our programs and to process their Personal Data beyond what is strictly necessary for participation. We collect this consent through a digital consent form during signup, and the parent/guardian receives confirmation by email. The signed consent form is retained alongside the participant's record.

COPPA compliance (US under-13)

We do not offer services to children under 13 in the United States or any other jurisdiction. The US Children's Online Privacy Protection Act (COPPA) requires verifiable parental consent for processing data of US children under 13; we comply by simply not collecting such data.

Parental rights

Parents and guardians of participants under 18 may review the Personal Data we hold about their child, request corrections or updates, request deletion (subject to legal retention exceptions), and withdraw consent at any time. Contact [email protected] to exercise these rights. We will verify your identity and relationship to the child before releasing any data.

Use of minor data

We use minor Personal Data only for program operation and participant well-being. We do not profile minors for marketing or share their data with third parties for commercial purposes. Where we feature minor participants publicly (e.g., spotlighting a project winner), we typically use first name only and a country, never full name and identifying details, unless the minor and their guardian explicitly consent otherwise.

Safeguarding

Our Child Safeguarding & Protection Policy contains additional protections for minors, including communication channel restrictions, mentor verification requirements, and reporting procedures. The Safeguarding Policy is incorporated into this Privacy Policy by reference.

8. Data retention

We retain Personal Data only for as long as necessary:

• Active program data: for the duration of the program plus a reasonable follow-up period
• User accounts: until deletion is requested, or until 2 years of inactivity (at which point we will contact you before deletion)
• Alumni records: basic information (name, contact, programs attended, year) for up to 10 years from last interaction, after which it is anonymized or deleted, unless you request earlier deletion
• Newsletter subscriptions: until you unsubscribe
• Communication history: typically 2–5 years, subject to email system retention policies
• Analytics: Cloudflare Web Analytics provides aggregate data only and does not retain individual-level data
• Financial records: retained for 7 years as required by Austrian commercial and tax law
• Safeguarding incident records: retained as long as necessary to protect participants and the organization, often at least until any minor involved reaches adulthood, in compliance with Austrian and applicable law

You may request earlier deletion at any time via [email protected].

9. International data transfers

Moonshot Pirates operates from Austria, but we work with service providers based in the EU, the United States, and other jurisdictions. Where we transfer Personal Data outside the EU/EEA, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, included in our data processing agreements with non-EU providers
• EU-US Data Privacy Framework where the receiving party is certified (e.g., Stripe, Cloudflare for relevant data flows)
• Adequacy decisions for transfers to countries with EU-recognized data protection laws

We transfer only the data necessary for the service. We monitor legal developments (such as Schrems II rulings and updates to SCCs) and adjust our practices accordingly. If a particular transfer cannot be adequately safeguarded, we will ask for your explicit consent.

10. Your rights

Under GDPR and applicable laws, you have the right to:

• Access your Personal Data and information about how it is processed
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten") in defined circumstances
• Restrict processing in certain situations
• Object to processing based on legitimate interest, and to opt out of direct marketing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time, without affecting prior lawful processing
• Lodge a complaint with a Data Protection Authority

To exercise these rights, contact [email protected]. We will verify your identity and respond within 30 days, with one possible extension of up to 60 days for complex requests. We do not charge for these requests, except in cases of manifestly unfounded or excessive demands.

Lead authority

Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40-42, 1030 Vienna, Austria — [email protected] · dsb.gv.at

You may also contact the Data Protection Authority in your country of residence.

11. Updates to this policy

We may revise this Policy from time to time. For material changes, we will update the effective date and version number at the top, notify registered users by email at least 30 days before the changes take effect, and where required, request renewed consent.

Non-material changes (clarifications, wording adjustments) take effect upon posting. Continued use of our Services after the effective date constitutes acceptance of non-material changes only. Material changes require active acceptance. Prior versions are available on request.

12. Contact

Privacy

[email protected]

Privacy contact

Marko Londa — [email protected]

Safeguarding

[email protected]

General

[email protected]

Post

Co-Innovation Factory, Absberggasse 27/1/3, 1100 Vienna, Austria

Phone

+43 670 507 9815