Privacy Policy

Valuedfriends Workspaces GmbH takes the protection of your personal data very seriously. This privacy policy explains how we process your personal data when you apply for the Impact Sprint Lab (sections 1 to 8) and when you visit this website (sections 9 to 14). 1. Data Controller Valuedfriends Workspaces GmbH Kolonnenstr. 8, 10827 Berlin Contact: info@valuedfriends.eu 2. Purposes of Data Processing The Impact Sprint Lab is a free accelerator programme for social enterprises and impact startups registered in Germany. It is funded by the federal government and the European Social Fund Plus (ESF Plus). We process the personal data you provide in your application to: – review your application and select the participants of a cohort – check whether your company meets the eligibility criteria of the funding programme – contact you about your application – if you are admitted: organise your participation and meet our documentation, reporting and audit obligations towards the funding body We only send you our newsletter if you have subscribed to it separately (see section 11). 3. Application Process and Data Collected The application has two stages and an interview. Application form: In the online application form, we collect your first and last name, your email address, the link to your personal LinkedIn profile, details about your company (e.g. name, legal form, registration date, team size, a short description of your business and your target groups), your answers to the eligibility questions and, if you choose, your pitch deck as an uploaded file. If you provide your LinkedIn profile, we look at the information publicly visible on it to assess your application; we do not retrieve any data from LinkedIn automatically. Follow-up form: If your application is shortlisted, we send you a link to a follow-up form by email. The link contains your email address so that your answers are added to your existing application. In the follow-up form, we collect, for example, your phone number, the federal state of your company's registered office, your register or tax number, the names and roles of the founders, your sector, your business model, your contribution to the UN Sustainable Development Goals and how you measure your impact, the support you expect from the programme, how you heard about us and, if you choose, your pronouns. It also contains the eligibility declarations described in section 4. If you name co-founders, please make them aware of this privacy policy. Interview: If we invite you to an interview, we use your application to prepare it and record the outcome in your application. Online interviews take place via Microsoft Teams (see section 6). Participation agreement: If you are admitted, you sign the participation agreement electronically via Skribble (see section 6). Fields marked as required are necessary to review your application; without them we cannot consider it. All other information is voluntary. 4. Eligibility Declarations and Sharing with the Funding Body Because the Impact Sprint Lab is publicly funded, we have to check and document the eligibility of every participating company. For this purpose, we ask you, in the follow-up form or during onboarding, for: – a self-declaration that your company is a social enterprise as defined by the EU Social Business Initiative (SBI) – a self-declaration of SME status (SME declaration) and, where required, a de minimis declaration – proof of your company's registration (e.g. an extract from the commercial register or a business registration) If you are admitted to the programme, we pass these declarations and documents, together with your name and your company's details, to the project administrator of the funding programme, generally by entering them into its online registration system. We also report your participation in the programme sessions. The funding body, the authorities responsible for ESF Plus and audit bodies (e.g. the responsible federal ministry, the European Commission and the European Court of Auditors) may inspect these documents during audits. 5. Legal Basis – Reviewing your application, the selection process, communication with you and concluding the participation agreement: Art. 6 (1) lit. b GDPR (steps prior to entering into a contract at your request, and performance of the contract). – Eligibility check, sharing with the funding body and documentation for audits (section 4): Art. 6 (1) lit. c GDPR in conjunction with the funding rules, in particular Regulation (EU) 2021/1060 and Regulation (EU) 2021/1057 (ESF Plus), and Art. 6 (1) lit. b GDPR, because participation is only possible on this basis. – Voluntary information (e.g. your pronouns): your consent, Art. 6 (1) lit. a GDPR. – Spam protection in our forms (section 6): Art. 6 (1) lit. f GDPR. 6. Recipients and Processors Within Valuedfriends, only the people involved in the selection process and in running the programme have access to your application. We use the following service providers, who process data on our behalf (Art. 28 GDPR): – HubSpot Ireland Ltd., One Sir John Rogerson's Quay, Dublin 2, Ireland ("HubSpot"): application forms, storage of applications and uploaded files, and emails about your application. HubSpot may transfer data to HubSpot, Inc. in the USA. HubSpot is certified under the EU-U.S. Data Privacy Framework. – Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"): email communication and online interviews (Microsoft 365 and Microsoft Teams). When you take part in a Teams meeting, Microsoft processes the name you enter, your audio and video data and technical data such as your IP address and device information. Microsoft may transfer data to Microsoft Corporation in the USA, which is certified under the EU-U.S. Data Privacy Framework. – Skribble Deutschland GmbH, An der Raumfabrik 29, 76227 Karlsruhe, Germany, and Skribble AG, Förrlibuckstrasse 190, 8005 Zurich, Switzerland ("Skribble"): electronic signature of the participation agreement. Skribble processes your name, email address and mobile phone number, the document to be signed and the records of the signing process (e.g. time of signature). Skribble may process data in Switzerland; the European Commission has recognised Switzerland as providing an adequate level of data protection. To sign with a qualified electronic signature (QES), you have to verify your identity once; this is done by Skribble's identification and trust service partners, which process your data under their own privacy policies. Our application forms use Google reCAPTCHA (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to check whether a form is filled in by a person and not by an automated program. For this, Google processes your IP address, information about your browser and device, and how you interact with the form. Google may transfer data to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. Legal basis: our legitimate interest in protecting our forms against spam and misuse (Art. 6 (1) lit. f GDPR); storing and reading information on your device for this purpose: § 25 (2) No. 2 TDDDG. You have the right to object to this processing (Art. 21 GDPR). More information: policies.google.com/privacy. For the sharing of data with the funding body, see section 4. 7. Data Retention – If you are not admitted, we delete your application six months after the selection process for your cohort has ended. – If you participate, we keep the data needed to document the funding for as long as the funding rules require: under the ESF Plus rules, five years from 31 December of the year in which the final payment for the project is made (Art. 82 Regulation (EU) 2021/1060), or longer if our funding notice requires it. Documents subject to retention obligations under commercial and tax law (e.g. the participation agreement) are kept for the periods required there (§ 257 HGB, § 147 AO). – Voluntary information given with your consent is deleted when you withdraw your consent, at the latest together with your application. – Newsletter: see section 11. 8. Your Rights You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15 to 18 and 20 GDPR). Where we process your data on the basis of our legitimate interest, you have the right to object (Art. 21 GDPR). You may withdraw your consent at any time with future effect. To exercise your rights, contact us at the address in section 1. If you withdraw your application, we delete your data unless we have to keep it under section 7. We decide on applications ourselves; we do not use automated decision-making within the meaning of Art. 22 GDPR. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany. 9. Website, Cookies and Consent Management When you visit this website, we use cookies and similar technologies (e.g. your browser's local storage). Technically necessary storage is always active. All other technologies are only used with your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG), which you give via our cookie notice ("Your data, your choice"). You can change or withdraw your consent at any time with future effect via the link "Cookies" at the bottom of every page or here: open cookie settings. The cookie notice is part of this website and is operated by us; no external consent service is used. Your choice is stored in the cookie "isl_consent" in your browser for 12 months so that we do not have to ask you again on every visit. To be able to prove your consent, we also record each decision on our server: a random consent ID, date and time, the version of the notice, your choice and the page on which you made it – without your IP address. These records are deleted after three years. Legal basis: Art. 6 (1) lit. c GDPR in conjunction with Art. 7 (1) GDPR, § 25 (2) No. 2 TDDDG. 10. Meta Pixel (only with consent) With your consent ("Marketing" in our cookie notice), we use the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta") to measure the success of our ads on Facebook and Instagram. The pixel transmits information about your visit (e.g. pages viewed, IP address, browser information) to Meta. It also sends this event data to a Meta Conversions API Gateway linked to our Meta advertising account, which runs on Google Cloud servers in the USA. The pixel sets the cookies "_fbp" (this website, 3 months), "_fbc" (this website, only if you arrive via one of our ads, 3 months) and "fr" (facebook.com, 3 months) and stores the entries "lastExternalReferrer" and "lastExternalReferrerTime" in your browser's local storage. Meta may transfer data to Meta Platforms, Inc. in the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. We and Meta are joint controllers for the collection and transmission of the data (Art. 26 GDPR); Meta is solely responsible for any further processing. More information: www.facebook.com/privacy/policy. Legal basis: Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG. If you withdraw your consent, the pixel stops immediately and we delete its cookies and entries on this website; the cookie "fr" on facebook.com can only be deleted in your browser settings. 11. Newsletter Sign-up Form (HubSpot) Our newsletter sign-up form (on the home page and the thank-you page) is part of this website. Displaying it does not connect your browser to HubSpot, and no cookies are set. Only when you submit the form does our web server forward your email address, your first name (optional), the page and the time of your sign-up to HubSpot Ireland Ltd., One Sir John Rogerson's Quay, Dublin 2, Ireland ("HubSpot"). Your IP address is not passed on. We do not use HubSpot tracking on this website. HubSpot stores this data and sends you an email to confirm your sign-up. We use the data to send you the Impact Sprint Lab newsletter and to be able to prove your sign-up, based on your consent (Art. 6 (1) lit. a GDPR). You can unsubscribe at any time via the link in every newsletter. To prevent misuse, our web server stores a check value derived from your IP address (hash) for one hour to block more than five sign-ups per hour (Art. 6 (1) lit. f GDPR). HubSpot processes the data on our behalf (Art. 28 GDPR). HubSpot may transfer data to HubSpot, Inc. in the USA; HubSpot is certified under the EU-U.S. Data Privacy Framework (see section 6). 12. Embedded Video Our home page contains our event video, which is hosted on cowos-berlin.com (also operated by Valuedfriends Workspaces GmbH, on the same server in Germany, see section 14). The video is only loaded after you have allowed "External media" in our cookie notice or clicked "Load video" on the video. Only then does your browser connect to the server of cowos-berlin.com, which receives your IP address. No cookies are set. Legal basis: Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG. 13. Overview of Cookies and Local Storage – isl_consent (cookie, this website, 12 months): stores your choice in the cookie notice – necessary – _fbp, _fbc (cookies, this website, 3 months each), fr (cookie, facebook.com, 3 months), lastExternalReferrer, lastExternalReferrerTime (local storage, this website): Meta Pixel, marketing – only with consent 14. Hosting and Server Log Files This website is hosted by Jusmann UG (haftungsbeschränkt) (ziczacmedia), Schwalbenweg 3, 68782 Brühl, Germany, which processes data on our behalf as a processor (Art. 28 GDPR). The server is located in a data centre of IONOS SE in Germany. Images, scripts and fonts of this website are delivered from this server; no external content delivery network is used. Each time you access the website, technical access data is automatically recorded in server log files: IP address, date and time of access, requested page/URL, referrer URL, HTTP status code, amount of data transferred, browser type and version, operating system, language settings and device type. This data is required to deliver the website and to ensure its stability and security (e.g. defence against attacks). Legal basis: our legitimate interest in a secure and functioning website (Art. 6 (1) lit. f GDPR). The log data is only stored as long as necessary for these purposes and is then deleted. You have the right to object to this processing (Art. 21 GDPR); however, the website cannot be provided without it. Last updated: October 2026