Privacy Notice
Last template update: 24 August 2026. This notice must be completed with your final controller details and processing inventory before launch.
1. Controller
European Startup Hub, Add registered business address before launch. Contact: [email protected]. VAT: Add VAT number before launch.
2. Data we may process
Depending on the features used, ESH may process account details, contact information, startup and organisation profile data, course enrolment information, programme applications, communications, transaction references, preferences, event registrations, support requests, security logs and information voluntarily submitted to platform services.
3. Purposes and legal bases
Processing may be necessary to provide requested services and perform contracts; to comply with legal obligations; for legitimate interests such as platform security, fraud prevention and service improvement where those interests are not overridden by individual rights; and on consent where consent is required, including certain optional analytics or marketing technologies.
4. AI and recommendations
Where AI-enabled features are introduced, information submitted to those features may be processed to provide the requested output. ESH will identify AI interactions and describe material uses in the AI Transparency Standard. Do not submit confidential third-party information unless authorised.
5. Sharing
Data may be shared with contracted service providers required to operate hosting, email, payments, security, analytics, customer support or programme delivery; with other users when you intentionally publish a profile or request an introduction; and with authorities where legally required. A final launch version should name or categorise actual processors and international-transfer mechanisms.
6. Retention
Data should be retained only for as long as necessary for the relevant purpose, contractual obligations, dispute handling, security and applicable legal retention duties. Final retention periods should be documented in the production processing register.
7. Your rights
Where applicable, individuals may have rights including access, rectification, erasure, restriction, objection, portability and withdrawal of consent. Requests can be sent to the contact address above. Individuals may also complain to the competent supervisory authority.
8. International transfers
If personal data is transferred outside the EEA, ESH should use an applicable transfer mechanism and safeguards required by data-protection law.
9. Children and young users
Because ESH may offer youth learning programmes, launch configuration must implement age-appropriate notices, parental/guardian workflows where required, and avoid behavioural advertising to children.
10. Security and changes
ESH uses technical and organisational measures designed to protect data. No system can guarantee absolute security. This notice may be updated as services and legal requirements evolve.