Datenschutz

1. Introduction

This Privacy Policy governs how sprintd GmbH (“sprintd”, “we”, “us”) collects, uses, stores, and discloses personal data across all three of our surfaces: this website (sprintd.org), the sprintd platform (where you create a builder account, publish a profile, join teams, and apply to events), and sprintd events themselves.

Events on the sprintd platform are run by two different kinds of organizer. Some are sprintd’s own, and for those we are the organizer. Most are run by independent organizers who use the platform as infrastructure. For those, the organizer is a separate, independent controller of the participant data we make available to them, and their own privacy notice applies to what they do with it. Every event page names its organizer.

This Policy is governed by the Swiss Federal Act on Data Protection (“revFADP”, in force since 1 September 2023) and, where applicable, the EU General Data Protection Regulation (“GDPR”). The lawful basis for each processing activity is set out in this Policy and is one of: your consent (Art. 6(1)(a) GDPR), the performance of a contract or pre-contractual measures (Art. 6(1)(b)), compliance with a legal obligation (Art. 6(1)(c)), or our legitimate interest in operating sprintd (Art. 6(1)(f)).

We have not appointed a Data Protection Officer. sprintd is not legally required to do so at its current scale.

2. What we collect and process

We collect personal data through forms on sprintd.org, when you apply to or participate in sprintd events, and automatically through the technical operation of our website.

Form submissions on sprintd.org

• Newsletter: your email address.
• Partner / sponsor inquiries: name, email, company name, and the contents of your message.
• Builder inquiries: name, email, and (optional) your role.
• Mentor inquiries: name, email, and the contents of your message.

Your sprintd platform account

When you create an account and complete your builder profile, we collect:

• Account: email address, and a password or the identifier from the provider you signed in with (Google, LinkedIn, GitHub).
• Profile: handle, first and last name, headline, bio, location, country, skills, technical skills, interest areas, languages, current status, job title, university or employer, avatar, links (website, GitHub, LinkedIn, X), and your open-to preferences.
• Identity: date of birth (we verify you meet the minimum age: 16 to hold a platform account, and whatever minimum the event you apply to has set, which is 18 unless its organizer states otherwise), gender, and nationality.
• Documents: a CV, if you upload one.
• Activity: your applications, teams, clubs, submissions, messages, questions, votes, judging ballots, and results.

Event participants (when you apply to or take part in a sprintd event)

• Personal identification: name, contact data, nationality, employment history.
• Application materials: motivation letters, CVs, diplomas, references, links to your work.
• Submission data: ideas, prototypes, code, and any other materials you submit during a sprintd event. Intellectual property in your submissions is governed by separate Event Terms & Conditions, which you accept at the point of application, and is not governed by this Privacy Policy.
• Event content: photographs and video recordings taken at sprintd events for documentation and marketing purposes (event recaps, sprintd.org, social media).
• Alumni and community data: ongoing contact details and (where you choose to share it) employment information for community communications and future event invitations.

Technical data

IP address, access timestamps, browser and operating system information. This data is collected automatically by our hosting provider (Cloudflare) for the safe operation and security of the site.

Sensitive personal data

To run events safely we ask for information that counts as special-category personal data under Art. 5(c) revFADP and Art. 9 GDPR: dietary needs, allergies, and accessibility needs. Dietary information can also indicate religious belief. We also collect an emergency contact, which is personal data about someone else.

All of it is optional, is processed only on the basis of your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), and is used for one purpose: catering, safety, and accessibility at the event you are attending. It is visible only to the organizing team of that event. It is never shared with partners or sponsors, never published, and never used for selection decisions. You can remove it from your account at any time, and withdrawing it does not affect your participation.

If you volunteer other sensitive information in a free-text field, for example in a motivation letter, it is processed only on the basis of your consent and only for the purpose for which you provided it.

3. Cookies and analytics

The two surfaces differ, so we describe them separately.

sprintd.org (this website)

This website sets no cookies, neither for analytics nor for marketing. It uses only essential technical state, such as your language preference, which is not a tracking cookie under the EU ePrivacy Directive or its Swiss equivalents.

The sprintd platform

The platform sets essential cookies that keep you signed in. Without them the platform cannot work, so they are set without consent.

The platform also uses PostHog for first-party product analytics: which pages are used, where flows break, and which errors occur. This lets us fix the product. PostHog stores an identifier in your browser via cookies and local storage. Our PostHog instance is hosted in the European Union. When you are signed in, we associate these events with your user ID and email address so we can debug problems you report. We do not use PostHog for advertising, we do not build marketing profiles, and we do not share this data with advertising networks.

The legal basis is our legitimate interest in operating and improving the platform (Art. 6(1)(f) GDPR). You can prevent this collection with your browser’s do-not-track or tracking-protection settings, which PostHog honours, or with any standard content blocker. To object or ask us to delete your analytics data, write to alexandros@sprintd.org.

If we ever add advertising or cross-site tracking, we will update this Policy and ask for your consent before setting anything non-essential.

4. Why we collect personal data

We process personal data for the following purposes:

• To respond to your inquiries submitted through our forms (partner, builder, mentor, general contact).
• To send you sprint news, new events, and platform updates, if you have subscribed to our newsletter.
• To operate the sprintd platform: create and secure your account, publish your builder profile, run teams, clubs, applications, submissions, judging, and results.
• To keep the platform working and improve it, including product analytics and error tracking (see section 3).
• To process applications to sprintd events.
• To run sprintd events: participant communications, logistics, mentor matching, judging, and post-event follow-up.
• For documentation and marketing of sprintd events through photography and video.
• To send you community updates, alumni communications, and newsletters about sprintd events and the sprintd platform, where you have opted in.
• For safety, security, and fraud prevention on our website and at our events.
• To comply with Swiss legal and accounting record-keeping obligations.
• To establish, exercise, or defend legal claims.

5. How we share your personal data

We do not sell your personal data. We share your data only with the following categories of recipients.

Subprocessors

Services that process your data on our behalf, under data processing agreements.

Event organizers

When you apply to an event, the organizer of that event receives your builder profile, your contact email, your application, and anything you provided for logistics (dietary needs, allergies, accessibility needs, emergency contact, shirt size). They need it to select participants and run the event safely.

For events sprintd does not organize, that organizer is an independent controller, not our processor. We require them by contract to use your data only to run their event and not to sell it or use it for unrelated marketing, but their own privacy notice governs what they do with it. The organizer is named on every event page.

Event partners and sponsors

With your consent, given when you apply, we share your builder profile and your contact email with the partners and sponsors of that event, so they can reach the builders who worked on their case. The exact scope is shown in the consent text at the point you accept it, and we record which version you accepted with your application.

Partners receive this data as independent controllers and are bound by contract to use it for the purposes of that event only. We never share dietary needs, allergies, accessibility needs, or your emergency contact with partners or sponsors. That information stays with the organizing team.

Other recipients

Our legal counsel, accountants, banks, and government authorities, where required by law or to establish, exercise, or defend legal claims.

6. International data transfers

Some of our subprocessors (in particular Resend, and potentially Cloudflare and Google Workspace) may transfer your personal data outside Switzerland and the EU/EEA, including to the United States. Such transfers are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission and recognized by the Swiss Federal Data Protection and Information Commissioner (“FDPIC”), or by other recognized transfer mechanisms such as the EU-U.S. Data Privacy Framework adequacy decision.

7. Your rights

You have the following rights regarding your personal data:

• The right to access the personal data we hold about you.
• The right to have your data corrected or completed.
• The right to erasure (“right to be forgotten”).
• The right to restrict processing.
• The right to data portability.
• The right to withdraw consent at any time, including unsubscribing from any newsletter or community communication.
• The right to object to processing based on legitimate interest.
• The right not to be subject to a decision based solely on automated processing. The platform computes a builder ranking and some verification signals automatically from your activity and results. These are informational and assist organizers. No decision to accept or reject an application is taken by automated means alone; a human organizer decides every application. If that ever changes we will update this Policy and tell you.
• The right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, if you are in the EU/EEA, with your local data protection authority.

To exercise any of these rights, contact us at alexandros@sprintd.org. We may ask you to verify your identity. We may decline a request to the extent permitted by law (for example, where statutory retention obligations apply or where our overriding interests prevail).

8. How long we keep your data

Retention is determined by purpose and legal requirements:

• Platform accounts: retained until you delete your account. You can do that yourself at any time from your account settings.
• Newsletter subscribers: retained until you unsubscribe.
• Form inquiry data: retained for as long as needed to respond to your inquiry and for a reasonable follow-up period, then deleted or anonymized.
• Event applications (rejected): deleted no later than six months after the event.
• Guardian consent forms and the guardian contact details that go with them: retained until three years after the event, or until the participant deletes their account, whichever comes first. Deleting the account erases the signed form as well.
• Event applications (accepted) and alumni data: retained with your consent for community programs and future opportunities. You may request deletion at any time.
• Accounting and statutory records: retained for the periods required by Swiss law (typically 10 years for accounting records).

What happens when you delete your account

Our principle is: erase the person, keep the work. When you delete your account we erase your profile, your applications, your votes and judging ballots, your memberships, your notifications, and your private messages.

The record of the events themselves remains, because it belongs to everyone who took part and to the organizers who ran them. Projects that were submitted stay in the event record but are no longer linked to you: a project you submitted alone is shown as “Anonymous Builder”, a team project keeps the team’s name, and public questions you asked are shown as “Former builder” so the conversations still make sense. None of this identifies you.

One condition: if you are the only member of an organizer, or the only president of a club that still has members, hand that role over first, so the organization is not left without an owner.

Backups are overwritten on a rolling basis, so a copy may persist there briefly after deletion. Records we must keep by law, such as accounting records, are retained for their statutory period.

9. Security

We apply appropriate technical and organizational measures to protect your personal data, including transport encryption (HTTPS), restricted access to internal systems, hosted databases with provider-level encryption at rest, and regular review of access permissions. No system is perfectly secure. If a personal data breach occurs we will notify affected users and the relevant supervisory authority as required by applicable law.

10. Third-party websites

sprintd.org may contain links to external websites. We are not responsible for the privacy practices or content of those sites.

11. Participants under 18

The minimum age to hold a sprintd platform account is 16. We do not knowingly collect personal data from anyone under 16, and if we become aware that we have, we delete it.

Each event sets its own minimum age, measured on the first day of the event. That is 18 unless the organizer has opened the event to 16 and 17 year olds, and the event page always states which. Where an event is open to them, a participant who will be under 18 on the first day, or under the age of majority where they live, must submit a completed and signed parent or guardian consent form before their place can be confirmed.

What we collect from a parent or guardian

Their name, their relationship to the participant, their email address, their phone number, and the signed form itself. This is personal data about a third party, which the participant provides to us, in the same way as the emergency contact described in section 2.

• Why: to establish that valid consent exists for a participant who cannot give it alone, and so that the organizing team can reach the guardian, including to verify the consent is genuine and in an emergency during the event.
• Lawful basis: the consent itself (Art. 6(1)(a) GDPR), and our legitimate interest in running an event safely and lawfully (Art. 6(1)(f)).
• Who can see it: only the organizing team of that specific event. It is never shared with partners or sponsors, never published, and never included in any export.
• How long: see section 8.

A parent or guardian can withdraw their consent in writing at any time before the event begins, which ends the participant’s place at it, and can exercise all of the rights in section 7 in respect of their own data. Contact alexandros@sprintd.org.

Under Swiss law a person aged 16 or 17 who has capacity of judgement gives their own consent to the processing of their personal data, and under Art. 8 GDPR the threshold for information society services is at most 16. The guardian consent above therefore covers taking part in the event and the obligations that come with it, not the data processing described in the rest of this Policy, which the participant consents to themselves.

12. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top of this Policy reflects the most recent change. Where changes are material, we will communicate them through an appropriate channel (for example, by email to subscribers).

13. Acceptance of this Policy

By using sprintd.org or participating in sprintd events, you acknowledge this Privacy Policy. If you do not agree with it, please do not use our website or participate in our events.

14. Contact

For any question about this Policy or how we handle your personal data:

sprintd GmbH
c/o Christoph Kohler
Brohegasse 53
4126 Bettingen
Switzerland

alexandros@sprintd.org