Privacy statement

Who is responsible

The Data for Public Impact Network is responsible for your data (the controller). For any question or request, write to info@dpi.network.

What we collect, and why

• Your RSVP: your name and email address, whether you attend, your confirmation that you can attend in person and arrange your own travel, and whether you want to hear about future events. We need these to organise the event and to know who is coming. You can also RSVP on my.dpi.network. There we first email you a code, to make sure the address is yours; we keep only a scrambled form (a hash) of it and of your address, for at most a day. If you RSVP yes there, we make your account at the same time and sign you in.
• Your account on my.dpi.network: if you sign in, we keep your email address (the one you RSVP'd with), when you created your account and last signed in, and which of your RSVPs it belongs to. To sign in we email you a 6-digit code; we keep only a scrambled form (a hash) of it and of your address, for at most a day. Staying signed in uses a cookie on your device (or, in the app, a token); we keep only a hash of it, so even we cannot use it. You can only sign in with an address that RSVP'd yes to one of our events.
• Your profile, if you add one: for one event at a time, what you choose to show the others coming: your organisation, your field, a few lines about you, up to five skills or interests, a link to your LinkedIn and your GitHub profile, whether you are looking for a team and, if you choose, your DPIN certificates. Your name comes from your RSVP. You can take it down at any time, and it is deleted at once.
• Connections: when you and another participant both agree to connect, we keep that you are connected, so each of you can see the other's email address. Either of you can remove it at any time.
• Dietary needs: only if you fill them in, and only with your explicit consent. We use them for one thing: arranging food at this event.
• Your team: its name, its members and its ranking of the challenges. We use these to match teams to challenges. If you form your team on my.dpi.network, also the invites your team sends and the ones you get (who invited whom, and the answer).
• Your team's work: the pitch deck, memo and optional appendix you hand in. A memo counts up to 3 pages and an appendix up to 3; we remove the pages after that and keep only the rest. The judges of your challenge read them, and the pitch decks are put together into the slides shown at the event. If your team hands in its files on my.dpi.network, we also keep which of you handed in each file, and when, so your team can see it.
• Judging: judges score each team and may write feedback for it. Scores and feedback are about the team's work; the organisers read them and may pass the feedback on to your team.
• Your certificate: after the event, everyone in a team that worked on a challenge gets a certificate with their name, team, challenge, distinction (participant, finalist or winner, from the judges' ranking) and a number. It has its own page at a long random link, where anyone you share the link with can see that it is real, download it and add it to LinkedIn. On my.dpi.network you see your certificate once we have emailed it, with a link to its page.
• Emails: if you register your team, we email you a confirmation of the team and its challenge ranking, your team's upload page with the deadlines, and a confirmation when your team's files arrive. After the event, everyone in a team gets one email with their certificate and, if the organisers ask for it, a link to a feedback form. On my.dpi.network we email you a code when you ask to sign in or to RSVP (a sign-in code only if your address RSVP'd yes to one of our events); once when a team invites you, saying who invited you and to which team; and a receipt when you hand in a file. When your team hands in there, the organisers may email everyone in it where and by when. Our emails come from the event's address. Nothing else, unless you asked to hear about future events.
• The human check: the RSVP and team forms, and the RSVP page on my.dpi.network, use Cloudflare Turnstile to keep out automated sign-ups. It looks at technical signals from your browser, only for that purpose.

We use no tracking, advertising or analytics cookies. my.dpi.network uses one cookie, which only keeps you signed in; it is necessary for the service you asked for, and it ends when you sign out or after 30 days without use. Your browser may also remember a choice on this device (for example which team or judge you are) so you do not have to pick it again; that stays on your device.

On what basis

• Taking part in the event you signed up for: your RSVP, your account, your team (with its invites and its ranking) and your team's work (GDPR article 6(1)(b)).
• Your consent: dietary needs and hearing about future events (articles 6(1)(a) and 9(2)(a)). You can withdraw it at any time by emailing us; that does not affect what was done before.
• Your consent: your profile, your connections, and showing your certificates on your profile (article 6(1)(a)). You give it by adding them and withdraw it by taking them down or switching them off on my.dpi.network.
• Our legitimate interest in a fair and secure event: the human check and the judging (article 6(1)(f)).
• Our legitimate interest in proving that you took part: your certificate and its page (article 6(1)(f)). Ask us and we remove it.

Who can see your data

• The DPIN organisers of your event. They sign in, and see only the events they organise. They see that you have an account on my.dpi.network, not when you sign in, and they see your team and its ranking; they do not see profiles, connections or invites.
• Your account shows you only the events you RSVP'd yes to; nobody else sees it.
• Other participants see your name when they form a team, and only if you confirmed you attend. Your profile, and your certificates on it if you choose, are shown only to people who RSVP'd yes to the same event, and never in another event. Nobody sees your email address unless you both agreed to connect. Invites are seen by the team that sent them and the person invited.
• Everyone in your team sees your team's files and who handed each one in. The judges of your challenge see your team's name and the work your team hands in.
• Your certificate's page shows what is on the certificate to whoever has its link, and nothing else (not your email address). Search engines are asked not to index it.
• Cloudflare hosts the platform, stores the data and sends our emails, on our behalf and under a data processing agreement. The data is stored in the European Union.

We never sell your data, and never pass it to sponsors or challenge partners.

How long we keep it

Within 6 months after the event, we delete all personal data from the platform: participants' details, team memberships, uploaded files, written feedback and our activity log. Only anonymous results remain: team names and scores. Certificates are the exception: we keep them, without time limit, so that yours keeps working wherever you have shared it. A certificate holds only what is printed on it (no email address), and we remove yours whenever you ask. If you asked to hear about future events, we keep your name and email address for that until you tell us to stop.

Your account on my.dpi.network exists only while one of your events still has your RSVP: it is deleted, with every place you are signed in, at most a day after the last of those events' personal data is deleted, or straight away if you delete it yourself. Profiles, connections and invites are deleted with the event's other personal data, when you delete your account, or, for your profile, as soon as you take it down. Files your team handed in on my.dpi.network are your team's work: they stay with the event if you delete your account, and are deleted with the event's other personal data. Your team and its ranking stay with the event's results, like teams formed on the team sign-up form. Once an event's personal data is deleted, its certificates are no longer linked to you, so they leave your account and your profile; the certificates themselves stay online at their links, as above.

Your rights

On my.dpi.network you can yourself, at any time, delete your account, take your profile down, remove a connection, decline an invite and leave a team (while teams are forming). When you delete your account, your RSVPs stay with each event's organisers, until they delete them as above or you ask us to.

You can ask us to show you your data, correct it, delete it, limit how we use it, or give you a copy; and you can object to how we use it or withdraw your consent. Email info@dpi.network and we will answer within one month. You can also complain to a data protection authority, for example the one in the country where you live.

How we protect it

Every connection is encrypted. The organisers' part of the platform is behind a sign-in, every organiser sees only their own events, and the links for judges and teams contain long random keys that we can replace at any time. On my.dpi.network a sign-in code works once, for 10 minutes and a few tries, and we keep only hashes of codes and of the tokens that keep you signed in.

Changes

If we change how we handle your data, we update this statement and the date at the top. More about DPIN: dpi.network.