Privacy Policy

This website is operated by Techstars Startup Weekend València. The data controller and legal operator responsible for GDPR and LSSI compliance is:

• +CLOVERTRONIX SOUTHERN EUROPE, SOCIEDAD LIMITADA
• +NIF: B75861807
• +C/ dels Sants Just i Pastor, 133, Bajo Derecha, 46022 Valencia, Spain
• +Registry: Registro Mercantil de Valencia, número V-223755
• +Contact email for privacy matters: hola@startupweekendvalencia.com

This policy explains what personal data we collect, why we collect it, how we use it, with whom we share it, how long we keep it, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 on Data Protection (LOPDGDD), and related legislation including Spanish cookie rules under Law 34/2002 (LSSI).

We only process data strictly necessary for each type of interaction with the event:

A) Contact enquiries by email. Data: name, email address, and the content of the message (and any other information you choose to include). Source: emails sent to the contact address published on the website.

B) Sign-up form data. Data: your name, your email address, and the record of your consent, which is the fact that you ticked the consent box, the version of the consent wording shown to you, and the time the submission was received, together with the language of the page you used. Source: the sign-up form on this website. The box is never ticked in advance and the form cannot be submitted without it.

C) Role form data. Data: the information each form asks for, which is your name, email address and phone number, the answers specific to the role you choose (for example company details), and how you heard about the event. Source: the two role forms published on this website, for pre-registration and sponsorship. These forms are provided by Notion and are embedded in the page. Each form page loads its form as soon as the page opens, so Notion sets its own cookies at that point and displays its own cookie notice inside the form.

D) Image, voice and recordings. Data: photographs, video footage, and audio recordings capturing your image or voice during the event. Source: footage taken at the event by the organiser and/or authorised service providers (photographers, videographers). Important: participants sign an image/audio/recording authorisation agreement during the accreditation or registration process. See Section 9 for your rights regarding this material.

E) Navigation and analytics data (cookies). Data: IP address, browser identifiers, device type, pages visited and browsing behaviour, where cookies or similar technologies are active. Source: automatic collection during browsing. Analytics cookies are only activated with your explicit consent via our cookie consent manager (CookieYes), and where you give that consent, measurement tags loaded through Google Tag Manager collect navigation data. The one exception is described in point C above: the embedded form on each role form page loads as soon as that page opens, so Notion sets its cookies at that point. See our Cookie Policy for full details.

F) Embedded video (YouTube). Data: your IP address, device and browser data, and your interaction with the video player, together with any cookies or similar local storage that YouTube sets or reads. Source: the event recap video embedded on the homepage, and only when you play it. Before that, the video frame shows an image served from our own server and nothing is requested from YouTube or Google. The play button stays disabled until you accept the relevant cookie category in the consent banner; when you then press play, the player loads from youtube-nocookie.com (YouTube's privacy-enhanced mode) and YouTube receives this data directly. The separate "Open on YouTube" link simply takes you to youtube.com.

Your data may be processed for the following purposes:

• +Responding to enquiries: to manage and respond to requests received by email or contact forms relating to the event.
• +Handling expressions of interest: to review and respond to pre-registration and sponsor submissions, and to contact you about the role you expressed interest in.
• +Operational event management: communications, logistics, schedule changes, accreditations and access management necessary to organise your participation.
• +Visual and audiovisual coverage: to produce, edit and publish photographs, videos and audio recordings on the organiser's own channels, in accordance with the authorisation agreement signed by participants.
• +Marketing communications: newsletters, event updates and follow-up communications, sent only to those who have given explicit consent or are in an existing event relationship.
• +Website measurement: where you give your consent, tags loaded through Google Tag Manager collect navigation data about how this site is used. No measurement tag runs before you consent, and you can withdraw that consent at any time through Cookie Settings.
• +Displaying the embedded recap video: to show the event recap video from YouTube on the homepage when you ask to play it. The video plays only after you give your consent in the cookie banner and press play. You can withdraw that consent at any time through Cookie Settings in the website footer, which locks the player again.
• +Compliance with legal obligations: where required by applicable law or a competent authority.

The legal bases under GDPR Article 6 that legitimise each processing activity are:

• +Performance of contract / event participation (Art. 6.1.b): to manage your registration, provide event services, handle accreditations and operational communications.
• +Consent (Art. 6.1.a): for non-essential cookies and analytics, for loading the embedded YouTube video, for marketing and promotional communications, and for the capture and use of image, voice and recordings in accordance with the signed authorisation agreement. Consent may be withdrawn at any time, see Section 9.
• +Legitimate interest (Art. 6.1.f): for limited administrative communications improving event delivery, balanced against your privacy rights.
• +Legal obligation (Art. 6.1.c): where required by applicable law.

We share personal data with the following service providers (data processors) who help us run the website and the event:

Privacy policies published by these providers include:

• +Notion: https://www.notion.so/privacy
• +CookieYes: https://www.cookieyes.com/privacy-policy
• +Google, including YouTube: https://policies.google.com/privacy

We do not sell personal data to third parties. Processors are bound by data processing agreements and may only use your data on our documented instructions.

Some of the providers named in Section 6 may store or process data outside the European Economic Area (EEA). In those cases we rely on the EU-US Data Privacy Framework where the provider is certified under it, and on Standard Contractual Clauses approved by the European Commission as a fallback safeguard. Where neither applies, an adequacy decision or another safeguard permitted by the GDPR is used. The sign-up relay is processed by Supabase in the EU region under a data processing agreement that includes Standard Contractual Clauses. For the embedded YouTube video, the provider for users in the EEA is Google Ireland Limited, and data may be transferred to Google LLC in the United States under these same safeguards.

You can request further information about the specific safeguards in place by contacting us.

We retain personal data only for as long as necessary for each purpose:

• +Email enquiries and contact data: for as long as needed to address the request, plus the minimum period required to manage any potential liability (generally up to 3 years).
• +Registration and event management data: until the end of the event and for a reasonable period thereafter (generally up to 3 years).
• +Marketing lists: until you withdraw consent or unsubscribe.
• +Images, videos and audio recordings: for as long as needed for the stated promotional purposes (generally up to 5 years), and/or until a valid withdrawal or limitation request is received.
• +Website measurement data: retained for the period configured in the measurement tags that run on this site, and collected only where you have given your consent.
• +Embedded video data: collected directly by YouTube (Google) when you play the video, not by us, and retained according to Google's own privacy policy.
• +Legal obligations: for the periods required by applicable law.
• +Data breach and consent logs: retained for compliance demonstration purposes for the legally required period.

Under GDPR and the LOPDGDD, you have the following rights regarding your personal data:

• +Access: to obtain confirmation of whether we process your data and receive a copy.
• +Rectification: to correct inaccurate or incomplete data.
• +Erasure, the right to be forgotten: to request deletion where applicable.
• +Objection: to object to processing, including profiling.
• +Restriction of processing: to request that we limit how we use your data.
• +Data portability: to receive your data in a structured, machine-readable format.
• +Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email hola@startupweekendvalencia.com. Recommended subject line: "Data Protection - Exercise of Rights". We will respond within one month (extendable by a further two months for complex requests, with notice given).

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

Image, voice and recordings, authorisation agreement: you may request access, withdrawal, erasure or restriction of specific uses of your image, voice or recordings by writing to hola@startupweekendvalencia.com, indicating, where possible, a link, a screenshot, or the time and place, to help us locate the material.

We log consent records (what was consented to, the timestamp, and IP address where feasible) to demonstrate compliance with GDPR requirements. When consent is withdrawn, we cease future processing that relied on that consent.

For the sign-up form, the exact wording you agreed to is stored with a version identifier, so the text we hold on record is always the text you were shown.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or destruction. These include: access controls, encryption in transit (HTTPS), secure storage, limited access to authorised personnel only, and regular backups.

We maintain procedures to detect, investigate and contain data breaches. Where legally required (Art. 33-34 GDPR), we will notify the Spanish Data Protection Agency (AEPD) within 72 hours and, where applicable, notify affected individuals without undue delay.

We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you.

Participants must be aged 18 or over to register for this event. Techstars does not permit the running of youth events targeted specifically at people under 18 years old. Accordingly, we do not knowingly collect personal data from anyone under 18. If we become aware that data has been collected from a person under 18, we will delete it promptly.

This website uses cookies and similar technologies. Analytics cookies are only activated with your explicit consent. The embedded form on each of the two role form pages loads as soon as that page opens, so its provider sets cookies at that point. The recap video embedded on the homepage loads from YouTube only after you give your consent and press play. For full details, including cookie types, providers, duration, and how to manage your preferences, please consult the Cookie Policy published on this website.

This Privacy Policy may be updated to reflect legal, technical or operational changes. The current version will always be available on the event website. Where changes are material, we will communicate them appropriately.

Contact: hola@startupweekendvalencia.com