Privacy Policy

The controller responsible for the processing described here is:

START Global
Unterstrasse 6, 9000 St. Gallen, Switzerland
UID: CHE-456.973.974

Privacy and data-protection inquiries can be sent to info@startglobal.org.

When you register and use the Platform, we collect:

• Account data: name, email address, password (hashed) or Google sign-in identifier.
• Volunteer profile: phone number, university (optional), date of birth (optional), T-shirt size, emergency contact name and phone number.
• Preferences and assignments: task preferences, shift preferences, lead-role interest and motivation, your assigned team and shifts, check-in records.
• Accommodation requests (optional): arrival and departure dates, reason for the request, and any notes you submit.
• Technical data: session cookies required for authentication, IP address and user agent recorded with your session. We do not run third-party analytics, advertising, or tracking scripts.
• Communications: messages you send through the in-app contact form or to our support address.

• To run the volunteer programme. Reviewing applications, building teams, assigning shifts, on-site check-in, and coordinating accommodation. Legal basis: performance of the volunteer agreement you enter into when registering (Art. 6(1)(b) GDPR; Art. 31 Swiss FADP).
• Emergency contact information is processed so we can reach a designated person if something happens to you during the event. Legal basis: your consent, given during registration, and our legitimate interest in volunteer safety (Art. 6(1)(a) and (f) GDPR).
• Account security and abuse prevention. Session metadata is kept to detect and mitigate unauthorised access. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Communications. We use your email to send registration confirmations, password-reset emails, and operational updates about the event. Legal basis: contract performance.

Access inside the Platform is role-based:

• You can always see and edit your own profile (until the registration deadline).
• Your team lead sees the roster of their team: names, T-shirt size, accommodation flag, email, emergency contact, and check-in status. This access is necessary to run the team on event days.
• Platform administrators (a small group of START Global organisers) can see all volunteer data in order to manage applications, assignments, and accommodation.
• Other volunteers on your team see only your name and team membership, not your contact details or emergency contact.

We do not sell personal data and we do not share it with advertisers or external partners for marketing purposes.

We rely on the following service providers, each contractually bound to process data only on our instructions:

• Hetzner Online GmbH: hosting of the Platform and database (servers located in Germany / the EU).
• Resend: transactional email delivery (registration, password reset, contact-form messages).
• Google LLC: optional Google sign-in (only if you choose to sign in with Google).

Where a provider may transfer data outside Switzerland or the EU/EEA, the transfer is covered by Standard Contractual Clauses and appropriate safeguards under Art. 46 GDPR.

• Active accounts: kept for the duration of the volunteer programme.
• After the event: volunteer profiles, assignments, and check-in records are retained for up to six (6) months for wrap-up, certificate issuance, and internal reporting, then deleted or fully anonymised.
• Accommodation requests and emergency contacts: deleted within 30 days after the end of the event.
• Sign-in sessions: expire automatically and are deleted when expired.

Under the GDPR and the Swiss Federal Act on Data Protection (FADP) you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data (right to be forgotten);
• request restriction of processing or object to processing;
• request a copy of your data in a portable format;
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal;
• lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the supervisory authority in your country of residence.

To exercise any of these rights, contact info@startglobal.org. We respond within 30 days.

Passwords are stored as salted hashes. The Platform is served over HTTPS, and database access is restricted to authorised administrators. We follow the principle of least privilege for role-based access described in section 4.

The Platform sets a single first-party session cookie (prefixed volunteer-auth) that is strictly necessary to keep you signed in. No analytics, advertising, or third-party tracking cookies are used, so we do not show a cookie banner.

We may update this Privacy Policy if our processing changes materially. The “Last updated” date at the top of this page reflects the most recent version. Significant changes will be announced via the Platform or email before they take effect.

For privacy or legal inquiries: info@startglobal.org.
For general volunteer questions: volunteer@startsummit.ch.

See also our Terms and Imprint.