Effective date: 20.10.2026

Version: 1.2

1 At a glance

This Privacy Notice explains how EIT Health InnoStars e.V. (InnoStars) processes personal data when you visit our website, contact us, subscribe to our communications, apply for membership, take part in programmes, calls, funding or procurement processes, join expert pools, or use our ecosystem, matchmaking and consortium-building services.

This notice covers the website at https://www.innostars.org, including its subdomains and language versions, and the membership, programme, call, FSTP/cascade-funding, procurement, expert-pool and ecosystem activities described below, unless a separate privacy notice is provided for a specific project, event, platform or programme.

We process data only on a defined legal basis (consent, contract, legal obligation, or legitimate interest), share it only where necessary, and keep it only as long as needed.

For data-protection enquiries or to exercise your rights, contact info@innostars.org. You may also lodge a complaint with a supervisory authority – for InnoStars, this is the Bavarian Data Protection Authority (BayLDA).

2 Who is responsible for your data

Controller: EIT Health InnoStars e.V.

Registered address: Mies-van-der-Rohe-Str. 1C, 80807 Munich, Germany

Privacy contact: info@innostars.org

3 How we process personal data

3.1 Website operation and security

When you visit our website, technical data are processed automatically so that the website can be delivered to your device, kept secure, and protected against misuse.

This may include:

• IP address
• date and time of access
• requested page or file
• referring page
• browser type and version
• operating system
• response status
• volume of data transferred
• server logs, error logs and security-event logs

We process this data to provide the website, maintain availability, diagnose errors, prevent misuse and protect the security of our systems.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in providing a secure, stable and functional website.

Our website is hosted by a professional hosting provider that provides hosting and related technical services to us and acts as our processor under Article 28 GDPR.

The provider may use authorised sub-processors for infrastructure, cloud, security, email-delivery, support and related technical services. A current list of sub-processors is available on request. Where personal data are transferred outside the European Economic Area, appropriate safeguards such as Standard Contractual Clauses or other permitted transfer mechanisms apply.

We may also use website security tools to protect the website against misuse, malicious requests, brute-force attacks and other security threats. These tools may process IP addresses, login attempt data, firewall data and related technical security logs. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in maintaining the security and integrity of the website.

Server logs are retained only for as long as necessary for website delivery, security, troubleshooting and abuse prevention, and are then deleted or anonymised unless longer retention is required to investigate a security incident or establish, exercise or defend legal claims.

3.2 Cookies and similar technologies

Our website uses cookies and similar technologies, such as local storage, pixels, tags and embedded third-party content. We use these technologies for the following purposes:

1. strictly necessary functions, such as website security, page loading, caching, form functionality, session management and remembering technical settings;
2. analytics and performance measurement, to understand how the website is used, which content is relevant, how users navigate through the site and where engagement drops; and
3. embedded third-party content, where you choose to load it, such as maps, videos or external media.

Strictly necessary technologies are used without your consent where they are required to provide the website or a feature requested by you. The legal bases are Section 25(2) TDDDG and Article 6(1)(f) GDPR: our legitimate interest in operating a secure and functional website.

Analytics, performance-measurement and embedded-content technologies are used only after you give your consent through our consent-management platform. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.

Depending on your choices and the technologies enabled, we may process technical and usage data relating to your visit and interactions, including identifiers and information about your device and browser, information derived from your network connection, information about how and when you interact with the website and its content, information about content you choose to load or play, and your consent status. The specific categories collected by each technology are listed in our Cookie Policy.

Some of these technologies may involve transfers of personal data outside the European Economic Area. Where this is the case, we rely on appropriate safeguards such as an adequacy decision of the European Commission, the EU-U.S. Data Privacy Framework where the recipient is certified, Standard Contractual Clauses and supplementary measures where required.

You can change or withdraw your consent at any time, with effect for the future, by clicking the consent-management icon in the website footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. We retain a record of your consent choices, including the relevant consent status, timestamp and consent identifier, in order to demonstrate compliance with Article 7(1) GDPR.

For further details, including the current list of cookies and similar technologies, providers, purposes, categories, retention periods, international-transfer mechanisms and any joint-controllership relationships where applicable, please refer to our Cookie Policy at https://innostars.org/cookie-policy/.

3.3 Contact enquiries

If you contact us by email, through a contact form, or by using contact details published on the website, we process the information you provide to respond to your enquiry.

This may include:

• name
• organisation
• role or function
• email address
• telephone number, if provided
• message content
• correspondence history

We process this data to respond to your enquiry, communicate with you, understand your organisation’s interests, and follow up where appropriate.

The legal basis is Article 6(1)(b) GDPR where your enquiry relates to a possible contract, collaboration or service request, and Article 6(1)(f) GDPR where we have a legitimate interest in responding to professional enquiries and maintaining stakeholder relationships.

Enquiry data are retained for as long as needed to handle the enquiry and any follow-up, and then deleted or archived according to our internal retention rules, unless a longer period is required for legal, contractual or legitimate business reasons.

3.4 Newsletter and updates

If you subscribe to our newsletter or updates, we process your email address and any information you provide, such as your name, organisation, role, country or areas of interest.

We may also process technical and administrative information connected with your subscription, such as the date and time of subscription, the source of the subscription, consent status, double opt-in confirmation status where used, unsubscribe status and information needed to demonstrate that consent was obtained.

We use this information to send you InnoStars newsletters, ecosystem updates, event invitations and opportunity alerts and related communications.

The legal basis is Article 6(1)(a) GDPR: your consent.

We use a double opt-in process: after you submit the signup form, we send you a confirmation email with a verification link. You are added to the distribution list only after you click that link.

You can withdraw your consent at any time by clicking the unsubscribe link in any newsletter email. You may also contact us at info@innostars.org if you need assistance with unsubscribing. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We use a professional newsletter service provider that acts as our processor under Article 28 GDPR. The provider processes newsletter subscriber data on our behalf under a data-processing agreement. The provider may process subscriber data outside the European Economic Area and may use affiliates and sub-processors. Where this is the case, we rely on appropriate safeguards such as an adequacy decision of the European Commission, the EU-U.S. Data Privacy Framework where the recipient is certified, Standard Contractual Clauses and supplementary measures where required. A current list of our newsletter service provider and its authorised sub-processors is available on request.

We use newsletter performance analytics – open, click, bounce, unsubscribe and engagement data – to understand how our newsletters are used and to improve our communications. Where this involves tracking pixels, tracked links or similar technologies that store information on or access information from your terminal equipment, we use them on the basis of your consent in accordance with Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time by unsubscribing.

Subscriber records are kept until you unsubscribe or withdraw your consent. After you unsubscribe, we keep a limited suppression record – your email address and unsubscribe status – to ensure that we do not send you newsletters again by mistake. The suppression record is the minimum data necessary for that purpose and is retained for up to 3 years, unless a longer period is required to establish, exercise or defend legal claims. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in respecting your opt-out.

We also retain newsletter consent records, such as form submission timestamp, IP address, confirmation status and the consent text shown at the time, for as long as necessary to demonstrate compliance with Article 7(1) GDPR – typically 3 years from withdrawal of consent – unless a longer period is required for legal claims or compliance reasons.

3.5 Membership or prospective membership

If your organisation is a current, former or prospective member of InnoStars, or if you act as a contact person, representative, delegate, employee, expert, adviser or other person connected with a member or prospective member, we may process personal data relating to you in connection with membership management and member engagement.

This may include:

• name;
• organisation;
• role, function or job title;
• professional contact details;
• membership status and membership history;
• information provided in membership enquiries, applications, onboarding forms or renewal processes;
• information about participation in meetings, working groups, committees, events, consultations or other InnoStars activities;
• communication history;
• invoicing, payment, accounting and administrative information, where relevant;
• records relating to governance, voting, mandates, representation, eligibility, declarations, conflicts of interest or compliance checks, where relevant;
• photographs, recordings or speaker/profile information, where you participate in events or public-facing activities, subject to the relevant event notice or consent where required.

We process this data to assess and manage membership applications, administer current and former memberships, maintain member records, communicate with members and their representatives, organise member activities, support governance and participation, manage membership-related payments and records, and develop the InnoStars community and ecosystem.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a membership-related agreement or to perform a membership-related agreement with you. Where the member or prospective member is a legal entity and we process data of its representatives, contact persons or staff, the legal basis is Article 6(1)(f) GDPR: our legitimate interest in managing membership relationships, communicating with member organisations and operating InnoStars as a member-based association. Where processing is necessary to comply with a legal obligation imposed on InnoStars by Union or German law, including applicable tax, accounting or association-law requirements, the legal basis is Article 6(1)(c) GDPR. Where audit or compliance requirements arise from an agreement or funding arrangement rather than directly from law, we rely on Article 6(1)(b) GDPR where you are a party to the relevant agreement, or Article 6(1)(f) GDPR for representatives, contact persons and staff of legal entities, based on our legitimate interest in administering and evidencing the relevant relationship. Where we use your data for optional publicity, photographs, recordings, testimonials or similar purposes and consent is required, the legal basis is Article 6(1)(a) GDPR.

Membership-related records are retained for as long as necessary to manage the membership relationship, handle follow-up, maintain governance and association records, comply with legal, tax, accounting, audit or grant-related obligations, and establish, exercise or defend legal claims. Where the membership relationship ends or a prospective membership does not proceed, we retain relevant records only for as long as necessary for these purposes, unless a longer period is required by law or by applicable funding, audit or compliance requirements.

3.6 Programmes, calls, funding applications, FSTP applications, procurement and expert pools

If you apply for, participate in, evaluate or otherwise interact with an InnoStars programme, call, funding opportunity, FSTP/cascade-funding scheme, procurement or tender process, expert pool, mentoring activity, training activity, acceleration programme, innovation programme or similar initiative, we process personal data necessary to administer that activity.

This section applies both to individual applicants, such as expert-pool applicants, mentors, evaluators or independent experts, and to legal-entity applicants, bidders or suppliers, such as companies, universities, research organisations, healthcare organisations, start-ups, SMEs, associations or other institutions. Where an applicant, bidder or supplier is a legal entity, we process personal data relating to its contact persons, legal representatives, project leads, team members, beneficial owners where required, financial or administrative contacts and other persons named in the application or related documentation.

Depending on the relevant programme, call or application process, this may include:

• name;
• organisation;
• role, function or job title;
• professional contact details;
• country, region or place of work;
• CV, biography, professional profile, qualifications, expertise, skills, publications, previous experience or track record;
• information about the applicant organisation, project team, consortium, partners, shareholders, ownership or legal representatives, where relevant;
• application content, proposal documents, project descriptions, pitch decks, budgets, work plans, milestones, deliverables, declarations and supporting documents;
• eligibility information and information required to assess compliance with call conditions;
• conflict-of-interest declarations, independence declarations, confidentiality acknowledgements and other compliance declarations;
• evaluation comments, scores, ranking information, selection decisions and related correspondence;
• due-diligence information, financial, tax, banking, grant-management, anti-fraud, sanctions, audit or reporting information, where required by the relevant call, agreement, funder or law;
• information about participation in interviews, hearings, events, trainings, mentoring sessions, review meetings or project-monitoring activities;
• communication history and records of support requests, complaints, appeals or clarification questions.

Where InnoStars conducts a procurement or tender process, we may also process bidder or supplier contact details, bid or quotation documents, pricing and commercial information, bank and tax details, ownership or beneficial-ownership information where required, eligibility or exclusion information, conflict-of-interest declarations, evaluation records, award decisions, contract-administration records, invoices and payment information. We use these data to manage the procurement, evaluate bids or quotations, select and contract with suppliers, administer contracts and payments, and meet applicable audit, anti-fraud, funding and record-keeping requirements.

We process this data to publish and manage calls, receive and review applications, verify eligibility, organise evaluation and selection processes, communicate with applicants and participants, perform due diligence, manage expert pools, appoint experts, mentors or evaluators, prepare and conclude agreements, award and manage funding, select and contract with suppliers, administer projects and programmes, monitor implementation, process payments where applicable, meet reporting, audit, grant-management and compliance obligations, prevent fraud and misuse of funds, handle complaints or appeals, and establish, exercise or defend legal claims.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into an agreement or to perform an agreement with you, for example where you apply as an individual expert, evaluator, mentor or participant. Where an applicant, participant, bidder or supplier is a legal entity and we process data of its representatives, staff, team members or contact persons, the legal basis is Article 6(1)(f) GDPR: our legitimate interest in administering the programme, assessing applications, communicating with applicants and participants, managing funding and operating fair, transparent and accountable selection or procurement processes. Where processing is necessary to comply with a legal obligation imposed on InnoStars by Union or German law, including applicable tax, accounting, sanctions or statutory reporting requirements, the legal basis is Article 6(1)(c) GDPR. Where audit, monitoring, grant-management, public-funding or reporting requirements arise from a funding, programme, procurement or other contractual agreement rather than directly from law, we rely on Article 6(1)(b) GDPR where you are a party to the relevant agreement, or Article 6(1)(f) GDPR for personal data relating to representatives, staff and other persons connected with participating legal entities, based on our legitimate interest in administering and evidencing compliance with the relevant relationship. Where a specific optional processing activity is based on consent, such as optional promotional use of a testimonial, image, recording or public profile, the legal basis is Article 6(1)(a) GDPR.

Application, programme and procurement data may be reviewed by InnoStars staff and by persons involved in the relevant programme, call or procurement process, such as external evaluators, reviewers, jury members, mentors, coaches, experts, programme partners, funding bodies, auditors, payment providers, IT and application-platform providers, professional advisers and public authorities where required. External evaluators, reviewers and experts are required to handle application information confidentially and only for the purposes of the relevant evaluation, review, mentoring, monitoring, procurement or programme activity.

Where required by the applicable call, funding agreement, procurement documentation or law, limited information concerning selected, funded or contracted recipients may be disclosed to the relevant granting authority, monitoring or audit bodies, or entered in or published through an official funding, transparency, State-aid, de minimis or procurement system. The relevant call, tender or project-specific privacy notice will identify the information concerned, the applicable legal basis, the recipients or publication channel and the relevant retention or publication period.

We do not intentionally request special-category personal data, such as health data, patient data, genetic data, biometric data, political opinions, religious beliefs, trade-union membership or similar sensitive information, through general application forms unless this is expressly required for a specific activity and covered by a separate notice, legal basis and safeguards. Applicants should not include patient-level data, personal health data or other sensitive personal data in applications unless the relevant call documents expressly request this and explain how it will be handled. Criminal-conviction or offence data are not requested through general application or procurement channels; where a specific funding or procurement process requires such data, they will be processed only where permitted by Article 10 GDPR and applicable law, with specific privacy information and safeguards.

Programme, call, application, procurement, expert-pool and funding records are retained for as long as necessary to administer the relevant activity, complete evaluation and selection, manage participation or funding, comply with contractual, legal, grant-management, audit, reporting, accounting, anti-fraud and public-funding requirements, handle complaints or appeals, and establish, exercise or defend legal claims. Specific retention periods may be set out in the relevant call or tender documents, programme terms, funding or procurement agreement, or project-specific privacy notice. Where no specific period applies, unsuccessful application records are normally retained only for as long as necessary for evaluation, communication, complaints, audit and accountability purposes. Funded-project, expert-pool, payment, audit and grant-management records may be retained for longer where required by the applicable agreement, funder, law or audit rules.

Providing the personal data requested in membership, programme, call, expert-pool, funding application, procurement or tender processes is generally necessary in order to assess the application, manage the relationship, administer the programme or comply with applicable requirements. If the required information is not provided, we may not be able to process the application, admit the member, include the person in an expert pool, award funding, select or contract with a supplier, conclude an agreement, process payment or allow participation in the relevant activity.

3.7 Ecosystem database, matchmaking and consortium-building

As part of our role as a life sciences innovation cluster, we maintain internal stakeholder, member, applicant, beneficiary, expert and ecosystem records in order to understand the organisations and people active in our network and to support collaboration across the health and life sciences ecosystem.

This may include entity-level information and professional contact information relating to current and prospective members, applicants, beneficiaries, project participants, experts, mentors, evaluators, speakers, investors, funders, challenge owners, healthcare organisations, research organisations, public-sector bodies, start-ups, SMEs, corporates, service providers and other ecosystem stakeholders.

Depending on the relationship and context, this may include:

• name;
• organisation;
• role, function or job title;
• professional contact details;
• country, region or place of activity;
• sector, technology area, expertise, capabilities, interests, needs or challenges;
• organisation profile, project profile, solution profile, pitch or high-level description;
• membership, application, programme, expert-pool or event participation history;
• communication history and relationship-management notes;
• publicly available professional information;
• information about potential collaboration interests, consortium-building opportunities, funding interests, service needs, investment interests, mentoring needs or matchmaking relevance;
• preferences, objections, opt-outs and other information needed to respect your communication choices.

We process this data to maintain and develop our innovation ecosystem, identify relevant collaboration opportunities, support matchmaking, consortium-building and partner search, connect organisations with relevant experts, mentors, investors, funders, challenge owners, healthcare stakeholders, service providers or potential project partners, identify suitable profiles for specific needs, support follow-on engagement after programmes or calls, and develop future projects, services, funding applications and ecosystem initiatives.

Where the information relates to a legal entity, we may create and maintain an entity profile describing the organisation’s activities, capabilities, needs, expertise, project interests, programme participation and potential collaboration relevance. Where the profile contains information relating to identifiable individuals, such as contact persons, representatives, experts or team members, we process that information as personal data.

Where we obtain professional personal data about you from another source rather than directly from you, the source may include your organisation, an InnoStars member or partner, a project or event partner, a professional referral, or a publicly accessible professional or project source, where applicable. We provide the information required by Article 14 GDPR within a reasonable period and at the latest within one month after obtaining the data; where we use the data to communicate with you, at the latest at the time of our first communication; or, where disclosure to another recipient is envisaged, at the latest when the data are first disclosed, unless an exception under Article 14(5) GDPR applies.

The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating InnoStars as a life sciences innovation cluster, providing membership and professional networking services, maintaining professional stakeholder relationships, supporting collaboration between ecosystem actors, building consortia, identifying relevant opportunities and providing innovation-support services. Where processing is necessary to perform or prepare an agreement with you, the legal basis is Article 6(1)(b) GDPR. Where processing is necessary to comply with a legal obligation imposed on InnoStars by Union or German law, the legal basis is Article 6(1)(c) GDPR. Where audit, grant-management, reporting or compliance requirements arise from an agreement or funding arrangement rather than directly from law, we rely on Article 6(1)(b) GDPR where you are a party to the relevant agreement, or Article 6(1)(f) GDPR for representatives, contact persons and staff of legal entities, based on our legitimate interest in administering and evidencing the relevant ecosystem, project or funding relationship. Where we ask for consent for a specific optional activity, the legal basis is Article 6(1)(a) GDPR.

We may share limited profile and professional contact information with relevant ecosystem actors where this is appropriate for a specific matchmaking, consortium-building, funding, service, expert, mentoring, investment, project or collaboration opportunity. These recipients may include members, programme partners, consortium partners, challenge owners, funders, investors, experts, mentors, evaluators, service providers, healthcare organisations, research organisations, public-sector bodies or other relevant stakeholders.

We do not disclose full application files, confidential proposal materials, evaluation comments, scores or non-public supporting documents to third parties for general matchmaking purposes unless this is necessary for the relevant programme, call, funding process, evaluation, agreement, audit, reporting or compliance obligation, permitted by the relevant call terms or agreement, required by law or funder rules, or separately authorised.

You may object at any time to the processing of your personal data for ecosystem database, matchmaking, consortium-building or similar legitimate-interest purposes by contacting us at info@innostars.org. If you object, we will stop using your personal data for these purposes unless we demonstrate compelling legitimate grounds or need to retain the data to establish, exercise or defend legal claims. You can also ask us to update, correct or remove professional profile information relating to you.

Ecosystem, matchmaking and entity-profile records are retained for as long as they are relevant for the relationship, opportunity, programme, membership, expert-pool, project, funding, audit, reporting, compliance or legitimate ecosystem-development purpose, unless a longer period is required by law, agreement, funder rules or legal-claims reasons. We periodically review these records and delete, anonymise or update information that is no longer necessary.

4 Special-category data

Please do not send health data, patient data, clinical data, genetic data, biometric data, trade-union data, political opinions, religious beliefs or similar sensitive information through general website channels unless we have expressly requested it under a separate notice and secure process.

If a future project or website feature requires the processing of special-category data, we will provide separate privacy information and apply the additional safeguards required for that activity.

5 Recipients, processors and partners

We share personal data only where necessary for the purposes described in this notice.

Recipient categories may include:

• website hosting provider;
• IT support and website security providers;
• cookie-consent management provider;
• analytics and performance-measurement providers;
• embedded-content providers, where you choose to load maps, videos or external media;
• email and communications providers;
• newsletter providers;
• professional advisers, where necessary;
• auditors, statutory advisers and tax advisers, where engaged by us;
• successor organisations or legal entities involved in a restructuring, merger, transfer of activities or change of legal form, where necessary;
• public authorities, where required by law;
• CRM, stakeholder-management, membership-management, and association-administration providers;
• programme, call-management, application-management, procurement-management and evaluation-platform providers;
• external evaluators, reviewers, jury members, experts, mentors and coaches;
• members, programme partners, consortium partners, challenge owners, funders, investors, experts, mentors, evaluators, service providers, healthcare organisations, research organisations, public-sector bodies and other ecosystem stakeholders, where relevant for a specific programme, funding, matchmaking, consortium-building, expert, service, investment, project or collaboration opportunity;
• payment, banking and financial-administration providers, where payments or funding are involved;
• auditors, monitoring bodies, anti-fraud bodies, granting authorities, public authorities and other bodies where required by law, funding rules, audit obligations or grant-management requirements.

Where a programme, call, procurement or project is operated with other organisations, the relevant privacy information will identify whether InnoStars and those organisations act as independent controllers, joint controllers or processors for the relevant processing activities. Where joint controllership under Article 26 GDPR applies, the essence of the joint-controller arrangement and an appropriate contact point for exercising data-subject rights will be made available.

6 International transfers

We aim to use providers located in the European Economic Area or in countries recognised as providing an adequate level of data protection.

Some of our service providers or their sub-processors may process personal data outside the European Economic Area. This may include transfers connected with analytics, performance measurement, embedded content, website security, hosting support, newsletter distribution, email communications, membership management, CRM, application management, programme administration, procurement administration, evaluation platforms, expert-pool management, funding administration or related technical services.

Where personal data are transferred outside the European Economic Area, we use appropriate safeguards such as adequacy decisions, the EU-U.S. Data Privacy Framework where the recipient is certified, Standard Contractual Clauses, supplementary measures or other mechanisms permitted by data-protection law. Where a transfer is based on Standard Contractual Clauses or another safeguard under Article 46 GDPR, you may request information about, or a copy of, the applicable safeguards by contacting info@innostars.org.

7 Retention

We keep personal data only for as long as necessary for the purposes for which they were collected, unless a longer period is required for legal, tax, accounting, grant, audit, reporting, dispute or enforcement, contractual, security or legitimate-interest reasons.

The main retention rules are:

• website and security logs: retained only as long as necessary for security, troubleshooting and abuse prevention;
• necessary cookie and technical-setting data: retained only for as long as needed to provide the relevant website function, maintain security or remember essential technical settings;
• contact enquiries: retained for as long as needed to handle the enquiry and any reasonable follow-up;
• cookie consent records: retained as long as necessary to demonstrate compliance with Article 7(1) GDPR, in line with the retention period stated in our Cookie Policy;
• newsletter records: retained until you unsubscribe or withdraw your consent, with a limited suppression record (email and unsubscribe status) retained for up to 3 years to respect your opt-out;
• newsletter consent records: retained for as long as necessary to demonstrate compliance with Article 7(1) GDPR – typically 3 years from withdrawal of consent – unless a longer period is required for legal claims or compliance reasons;
• membership records: retained for as long as necessary to manage the membership relationship and related governance, communication, accounting, audit, legal and association-administration obligations;
• prospective-member records: retained for as long as necessary to assess and follow up on the membership enquiry or application, unless a longer period is required for legal, audit, contractual or legitimate-interest reasons;
• programme, call, application and procurement records: retained for as long as necessary to administer the relevant programme, call or procurement, complete evaluation and selection or award, handle complaints or appeals, meet audit, reporting, grant-management or legal obligations, and establish, exercise or defend legal claims;
• funded-project and FSTP records: retained for the period required by the relevant funding agreement, programme rules, audit obligations, accounting rules or applicable law;
• ecosystem, matchmaking and entity-profile records: retained for as long as relevant for the relationship, opportunity, programme, membership, expert-pool, project, funding, audit, reporting, compliance or legitimate ecosystem-development purpose, and periodically reviewed for deletion, anonymisation or update;
• expert-pool records: retained for as long as the person remains in the expert pool and for a reasonable period afterwards for audit, accountability, conflict-management, payment, contractual or legal-claims purposes.

Where a specific project, event, platform or programme requires different retention rules, those rules will be explained in the relevant notice.

8 Provision of personal data

Providing personal data through the website is generally voluntary. However, certain technical data are processed automatically when you access the website because they are necessary to deliver and secure it. If you contact us and do not provide the information needed to respond, we may not be able to handle your enquiry. If you subscribe to our newsletter, providing your email address and country is necessary to receive it. Any additional profile or preference information is voluntary.

If you apply for membership, participate in a programme, apply to a call, submit a funding or FSTP application, join an expert pool, participate in a procurement or tender process or act as a representative or contact person for an applicant or member organisation, providing the requested information is generally necessary for us to assess the application, manage the relationship, administer the programme, process payments where applicable, meet funder or audit requirements and comply with legal obligations. If required information is not provided, we may not be able to process the application, admit the member, include the person in an expert pool, award funding, select or contract with a supplier, conclude an agreement or allow participation in the relevant activity.

If you provide information in connection with membership, a programme, call, expert-pool application, funding process, event, matchmaking request, consortium-building activity or ecosystem opportunity, certain information may be necessary for us to assess the request, manage the relationship, identify relevant opportunities, create or update an entity or stakeholder profile, make appropriate introductions, administer the programme or comply with legal, audit, funding or reporting requirements. If required information is not provided, we may not be able to process the application, maintain the profile, make a relevant introduction, include you or your organisation in a consortium-building activity, award funding, select or contract with a supplier, conclude an agreement or provide the requested support.

9 Your rights

Under GDPR, you have the following rights:

• Right of access (Article 15) — you can ask us to confirm whether we process your data, and to provide a copy;
• Right to rectification (Article 16) — you can ask us to correct inaccurate data;
• Right to erasure (Article 17) — you can ask us to delete your data, where one of the grounds in Article 17(1) applies;
• Right to restriction (Article 18) — you can ask us to restrict processing, where one of the grounds in Article 18(1) applies;
• Right to data portability (Article 20) — where the processing is based on consent or contract and is automated, you can ask us to provide your data in a structured, commonly used, machine-readable format;
• Right to object (Article 21) — you can object at any time to processing based on legitimate interests, including profiling; for direct marketing, your right to object is unconditional;
• Right to withdraw consent (Article 7(3)) — you can withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact info@innostars.org. We will respond within one month of receipt of the request, in accordance with Article 12(3) GDPR. We may extend this period by a further two months where necessary, taking into account the complexity and number of requests. We may need to verify your identity and clarify your request before responding.

You may lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

The supervisory authority currently identified as competent for InnoStars is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany – https://www.lda.bayern.de

10 Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

11 Updates

We may update this Privacy Notice to reflect changes in our website, website features, systems, service providers or legal requirements. Material changes will be communicated through the website and, where appropriate, by direct notice. The current version will be published on this page with an effective date.

11.1 Change log

Version	Date	Description
v1.0	10.05.2026	Initial publication
v1.1	26.06.2026	Added newsletter and updates section; added newsletter provider to recipients list; added newsletter retention rules; added newsletter to international-transfers section; minor consistency improvements.
v1.2	20.10.2026	Expanded scope to membership, funding/FSTP, procurement, expert pools, and ecosystem activities, with related updates to lawful bases, recipients, retention, and international transfers.