HAUS OF STARTUPS

Privacy Policy

Last updated: August 2026

1. Controller

The controller responsible for data processing on this website is:

DGH Deutsche GründerHilfe gGmbH
Alt-Moabit 19, 10559 Berlin, Germany
Managing Director: Constantin Schmutzler
Email: info@berlinstartupschool.com
Phone: +49 (0) 30 609 888 251

2. What data we collect

We collect the data that is necessary to operate the platform: a directory of startup programs, communities, and member benefits in Germany. We also use Google Analytics to understand how the site is used. We do not use advertising pixels or sell personal data.

2.1 Account and authentication

You can create or access an account with a magic-link email (passwordless sign-in) or with LinkedIn (OpenID Connect via Supabase). We use authentication to verify that you are a real person, to protect abuse-sensitive actions, and to associate your account with listings you manage, reviews you submit, and member-only benefit details you unlock. Depending on the method, we may process your email address, display name, and LinkedIn identity data provided by the identity provider. Session cookies set by Supabase are required for signed-in use.

2.2 Program reviews

To submit a review, you must sign in with email (magic link) or LinkedIn. We use your account only to verify that you are a real person and to limit abuse. Published reviews remain anonymous: we do not display your name, profile, or LinkedIn identity on the site. We store your Supabase user ID with the review for moderation and abuse prevention; the review content you provide (role, ratings, feedback) is what may appear publicly after approval. LinkedIn sign-in is marked as verified; email sign-in is still moderated before publication.

2.3 Program submissions and claims

When you submit a program for listing, we collect institution and program details, plus - optionally - your email address so we can follow up with questions. If you claim or manage a program listing (including co-owner invites), we process the contact and account data needed to verify ownership and send related transactional messages.

2.4 Community submissions and claims

When you submit a community for listing or claim an existing community page, we collect the community details you provide and the contact or account information needed to confirm the submission, moderate it, and notify you of approval or rejection.

2.5 Benefits submissions and member access

When you submit a benefit offer for listing, we collect partner and offer details and the contact information needed to process the submission. Viewing full member benefit details (such as discount codes and claim links) requires signing in. Public pages may show a summary; gated content is available only to authenticated members.

2.6 Emails and claim outreach

We send transactional emails through Brevo (for example submission confirmations, claim status updates, co-owner invites, and similar operational messages). Where we invite program or community contacts to claim a listing, we may send claim-outreach messages that include a personalised invite link. Those messages are marketing-style claim invites: you can opt out at any time via the link in the email or our opt-out page. We also may add contacts to Brevo contact lists used for operational messaging related to the platform.

2.7 Cookies

We use a strictly necessary cookie (haus_admin) to authenticate administrators. When you sign in, Supabase sets session cookies that are required for that authentication. Google Analytics may also set cookies or use similar identifiers to measure site usage. We do not set advertising cookies.

2.8 Server logs and rate limiting

Your IP address may be read server-side to enforce rate limiting on sensitive actions (for example review submissions) to prevent spam. IP addresses used for rate limiting are held in memory only for the duration of the rate-limit window and are not stored permanently or shared with third parties for advertising.

2.9 Analytics

We use Google Analytics 4 (measurement ID G-ZWLQ9QFYWE) to understand how the site is used, including pages viewed, approximate location, device and browser type, and referral source. Google Ireland Limited / Google LLC processes this data on our behalf. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on.

3. Legal basis

  • Art. 6(1)(a) GDPR - Consent: When you voluntarily create an account (magic link or LinkedIn), submit a review, submit or claim a program or community, submit a benefit, unlock gated member benefit content, or where we rely on consent for optional follow-up contact.
  • Art. 6(1)(f) GDPR - Legitimate interest: For the operation and security of the website (including rate limiting, the admin authentication cookie, and aggregated usage analytics), and for claim-outreach messages to publicly available or submitted contact details of listing operators, with a clear right to object and opt out.
  • Art. 6(1)(b) GDPR - Contract / pre-contractual steps: Where processing is necessary to provide account features you request (for example managing a claimed listing or receiving transactional status emails).

4. Data processors

  • Supabase Inc. - Database hosting and authentication (EU region, Frankfurt). Processes and stores accounts, submissions, reviews, claims, benefits metadata, and related platform data on our behalf.
  • Vercel Inc. - Website hosting and edge delivery. Processes HTTP requests including IP addresses for content delivery.
  • Brevo (Sendinblue SAS). - Email delivery and contact lists. Processes recipient addresses and message content for transactional emails and claim-outreach invites, including delivery and unsubscribe handling.
  • Google Ireland Limited / Google LLC. - Google Analytics. Processes usage data such as pages viewed, device information, and approximate location to help us understand how the site is used.

These processors maintain appropriate data processing agreements and technical safeguards. We do not sell personal data. Claim-outreach and similar operational emails are sent via Brevo; you can opt out of claim outreach as described below.

5. Opting out of claim outreach

If you receive a claim-invite or similar outreach email, you can opt out using the link in that message (including one-click unsubscribe where supported) or by opening the opt-out page linked from the email. After you opt out, we will not send further claim-outreach messages of that kind to that contact. Transactional messages that you have requested (for example confirmation of a submission you made) may still be sent when necessary to operate the service.

6. Data retention

Account data, submissions, reviews, claims, and related records are retained for as long as they are relevant to operating the platform or as required for security and moderation. You may request deletion of your data at any time by contacting us at the address above. Outreach opt-out preferences are retained so we can honour your choice.

7. Your rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Request erasure of your data
  • Restrict or object to processing
  • Data portability
  • Withdraw consent at any time (without affecting the lawfulness of prior processing)
  • Object to claim outreach and other processing based on legitimate interest

To exercise any of these rights, email us at info@berlinstartupschool.com.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin
www.datenschutz-berlin.de