GDPR Compliance
Last updated: 2026-10-13This page explains how to exercise privacy rights at Startup Valleys. Swiss data-protection law applies; the GDPR applies additionally where its territorial scope is met. The Privacy Policy describes our processing in detail.
1. Data Controller
2. Our Commitment
- We process the minimum personal data needed to operate the Service.
- We never sell or rent personal data, and we do not run cross-site advertising trackers.
- Sensitive submission data (HR contacts, private fields) is never exposed through the public API.
- All traffic is encrypted (HTTPS/TLS); passwords are hashed with argon2id.
- International transfers require the protections applicable to the recipient and country, as described in the Privacy Policy.
3. Lawful Bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Displaying the Swiss startup map and public content | Legitimate interest (Art. 6(1)(f)) |
| Operating your account | Contract (Art. 6(1)(b)) |
| Requested submissions, applications, RSVPs | Contract / pre-contractual steps (Art. 6(1)(b)) |
| Optional consent-based activities | Separate consent (Art. 6(1)(a)); Terms acceptance is not blanket consent |
| Payment processing (Stripe) | Contract (Art. 6(1)(b)) |
| Security logging & fraud prevention | Legitimate interest (Art. 6(1)(f)) |
4. Your Rights as a Data Subject
You may exercise the following rights subject to the applicable law and its conditions:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion (“right to be forgotten”)
- Restriction — limit how we use your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — for any processing based on consent
- Lodge a complaint — with the Swiss FDPIC or your local EU/EEA data protection authority
We assess each request under the applicable law. Retention duties or legal claims can limit immediate deletion; if a request is restricted, we explain the reason.
5. How to File a Request
Email [email protected] with the subject line “GDPR request”. Include the email address associated with your account (if any) and the right you wish to invoke. We respond within the statutory deadline, generally one month or 30 days. Any lawful extension is explained. You do not need to use a particular subject line, and we may request proportionate identity verification.
6. International Transfers
Data processed by Startup Valleys may be transferred to providers outside Switzerland (including Stripe, Resend, Mapbox and Anthropic in the USA). The Privacy Policy identifies relevant countries and protections. A Data Privacy Framework certification applies only to a provider covered by it; recognised contractual safeguards must include necessary Swiss adaptations where applicable.
7. Supervisory Authorities
- Switzerland (lead authority for our operator): Federal Data Protection and Information Commissioner (FDPIC) — edoeb.admin.ch
- EU/EEA users: your national data protection authority. The full list is at edpb.europa.eu.
8. Related Documents
- Privacy Policy — what data we collect, why, and for how long
- Cookie Policy — cookies and local storage we use
- Terms of Use
- Imprint
9. Contact
For any GDPR or data-protection question: [email protected]