Privacy Policy

1. Controller

The controller responsible for personal data processed on this site is:

Pierre Jacob
c/o Autorenglück #58844
Albert-Einstein-Straße 47
02977 Hoyerswerda, Germany
Email: heidelberg.simulator@gmail.com

2. What data we collect

When you apply or register: full name, email address, phone number, city, university, study programme, optional bio, optional skills and interests, CV (PDF), optional profile photo, and your consent choices.

When you use the portal: account activity such as events you register for, mentor/startup connection requests, your messages to mentors and startups, and your participation in ventures.

Automatically: we collect minimal technical data needed to operate the service — your IP address (for rate limiting and abuse prevention) and authentication cookies set by our identity provider. We do not use third-party analytics or advertising trackers.

3. Why we process your data (and on what basis)

• To operate your account and the matching service (Art. 6(1)(b) GDPR — contract performance). Without this data we cannot connect you to mentors, startups, or events.
• To communicate with you about your application, account, events you registered for, and connection requests (Art. 6(1)(b) GDPR).
• To share your profile and CV with selected mentors or startups only after you (and they) consent to the specific connection (Art. 6(1)(a) GDPR — consent).
• To secure the service: rate limiting, authentication, audit logging of admin actions (Art. 6(1)(f) GDPR — legitimate interest in protecting members and the integrity of the platform).
• To comply with our legal obligations (Art. 6(1)(c) GDPR).

4. Who we share it with

We share your personal data only with:

• Mentors or biotech companies you have specifically agreed to be connected with. Your name and email (and, for mentor introductions, your CV) are shared with the other party only after mutual acceptance of the introduction request.
• Service providers acting as processors under GDPR Art. 28:
  • Supabase, Inc. (hosting, authentication, database, file storage)
  • Vercel Inc. (application hosting and content delivery)
  • Resend, Inc. (transactional email delivery)
  • OpenStreetMap Foundation / Nominatim (geocoding of voluntarily provided addresses, e.g. for event locations)

Where these providers process data outside the European Economic Area, we rely on the EU Standard Contractual Clauses and any additional safeguards required by the provider's terms.

5. How long we keep it

We keep your account data for as long as your account is active. If your profile is not updated for an extended period (currently seven months), we send reminder emails and may delete inactive accounts thereafter. You can delete your account at any time from your profile page; doing so anonymizes your profile and revokes sign-in access. Aggregate statistics (e.g. number of mentor connections) may be preserved in non-identifying form.

Audit logs of administrative actions are retained for up to two years, then automatically purged.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• request correction of inaccurate data (Art. 16);
• request erasure of your data (Art. 17);
• request restriction of processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest (Art. 21);
• withdraw any consent you have given, at any time, without affecting the lawfulness of earlier processing.

To exercise any of these rights, email us at heidelberg.simulator@gmail.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our controller is the Sächsische Datenschutzbeauftragte (www.saechsdsb.de).

7. Cookies

We use only strictly necessary cookies required to keep you signed in and to protect against abuse. We do not use marketing, analytics, or third-party tracking cookies. No consent banner is required for these strictly necessary cookies under the German TTDSG and ePrivacy Directive.

8. Security

We use industry-standard measures to protect your data: TLS for all traffic, hashed passwords, private storage buckets with short-lived signed URLs for sensitive files like CVs, role-based access controls, audit logging, and rate limiting. No system is perfectly secure; please report any suspected vulnerability to heidelberg.simulator@gmail.com.

9. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on this page and update the “last updated” date above. Material changes affecting active members will be communicated by email.