Privacy policy for applications to the Public Value Academy

Version: 2026-11-11

1. Controller

Public Value Hub gUG (haftungsbeschränkt)
Karl-Liebknecht-Straße 107
04275 Leipzig, Germany
Email: contact@publicvaluehub.com

Data protection questions, access, withdrawal and erasure: academy@publicvaluehub.com. We are not required to appoint a data protection officer.

2. Why we process your data

We process the information in this form to review your application for the Public Value Academy, make a selection, contact you about it and – if you are accepted – run the programme with you.

3. Which data

• What you enter in the form: first and last name, email address, phone number (optional), the founding team's LinkedIn profiles (optional), the startup's name, website and team size, the partner programme you choose, your answers about your idea, business model and expectations, and the pitch deck you upload (PDF).
• Your consent: when you gave it and the version of this policy.
• Technical data: to prevent abuse and mass submissions we count submissions per IP address and per email address. We store both only as a keyed hash and delete it after one day. Our server logs requests (IP address, time, page) for security and troubleshooting; these logs are deleted after 14 days at the latest.

The “I'm not a robot” check runs in your browser against our own server; no data is sent to third parties. Fonts, images and scripts come only from our own server. We use no analytics or tracking tools and make no automated decisions.

Cookies: the form sets only one technically necessary cookie that protects against forged requests (CSRF). Staff who log in also get a session cookie.

4. Legal bases

Processing your application is based on your consent (Art. 6(1)(a) GDPR). Abuse protection and the server logs are based on our legitimate interest in running the service securely (Art. 6(1)(f) GDPR).

5. Who receives the data

Only the Public Value Academy staff who handle applications see your application. After you submit it, you receive a confirmation email, and the team is notified of the new application by email.

We use these processors, each under a contract according to Art. 28 GDPR:

• STACKIT GmbH & Co. KG (Neckarsulm, Germany): servers, database, file storage for pitch decks and backups, in data centres in Germany.
• Scaleway SAS (Paris): sending the emails, data centre in France.

Your data does not leave the European Union.

6. How long we keep the data

• If you are not accepted: 6 months after the application.
• If you are accepted: 6 months after you leave the programme; without a recorded end date, 18 months after the application.

After that we delete your personal data, the pitch deck and internal notes automatically. Only information about the startup without reference to you remains (e.g. the startup's name, partner programme, status, date) for our statistics. Backups are deleted with a delay: database backups after 32 days at the latest, deleted files after 30 days.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw your consent at any time without giving reasons, with effect for the future: an email to academy@publicvaluehub.com is enough. We then delete your personal data.

You can lodge a complaint with a data protection supervisory authority; the one responsible for us is: Die Sächsische Datenschutz- und Transparenzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany.