Privacy notice
Last updated 29 July 2026
The short version. If you apply, we keep what you typed into the form so we can read it and reply. Two people see it — Toshi and Kat. We don't share it with mentors or investors unless we ask you first. We set no cookies and run no analytics. Ask us and we'll delete it.
Who is responsible
Startup Bansko — the incubator programme run by Todor Lazov and Kat Stam in Bansko, Bulgaria — decides how the personal data described here is used, and is the data controller for it.
Reach us about anything on this page at hello@startupbansko.com.
What we collect, and when
Only what you deliberately send us. There is no sign-up, no account, and no profile built about you in the background.
When you submit the application form, we receive:
- Your name and email address
- Your startup or project name, if it has one
- Which cohort, track, stage and funding situation you selected
- The link you gave us to your pitch deck
- Your description of the idea and of the founding team
- Any additional links you chose to add
Your description of the team may name other people. Please only include details your co-founders are happy for you to share.
Why, and on what legal basis
| Purpose | To read your application, assess it, and reply to you — and if you join, to run the programme with you. |
|---|---|
| Legal basis | Your consent, given by ticking the box on the form (GDPR Article 6(1)(a)). You can withdraw it at any time. |
| Consequence of not consenting | We can't accept the application, because we'd have no lawful way to read it. You can always email us instead. |
Who sees it
Applications are read by Todor Lazov and Kat Stam. Nobody else.
We do not pass your application to mentors, partners or investors as a matter of course. If we ever think an introduction would help you, we will ask you first and let you decide.
Three service providers process data on our behalf in order to make the site and the form work:
| Cloudflare | Hosts the site and runs the form endpoint. Processes your IP address and request details in security and delivery logs. |
|---|---|
| Resend | Delivers your application to our inbox as an email. |
| Our email provider | Stores the resulting message in the inbox we read. |
Cloudflare and Resend are US-based, so your data may be processed outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses.
One third party loads on this site
The photographs on the landing page are served by
Unsplash (images.unsplash.com) rather than from our
own server. That means Unsplash receives your IP address and browser details when
the images load, as any image host would. We send them nothing else, and we don't
receive anything back about you.
Cookies, tracking and analytics
We set no cookies. There is no analytics, no advertising, no tracking pixels and no third-party scripts on this site — which is also why you haven't been shown a cookie banner.
If you use the light/dark toggle, your choice is saved in your browser's local
storage under sb-theme. That stays on your device and is never sent
to us or to anyone else.
How long we keep it
- If we don't take your application further: we keep it for up to 12 months after we tell you, so we can recognise you if you apply again and remember why we said no. Then we delete it.
- If you join a cohort: we keep it for the programme and for up to two years afterwards, so we can stay useful to you as an alumnus.
- If you ask us to delete it: we delete it, and we don't need a reason.
Your rights
Under the GDPR you can ask us to:
- Give you a copy of what we hold about you
- Correct anything that's wrong
- Delete it
- Stop or limit what we do with it
- Send it to you in a portable format
- Withdraw your consent — which stops any further use, though it doesn't undo what was lawful beforehand
Email hello@startupbansko.com and we'll act on it within one month. There's no form to fill in.
If we handle it badly, you can complain to the Bulgarian supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни), or to the authority where you live.
Children
The programme is for adults. We don't knowingly collect data about anyone under 16.
Changes to this notice
If we change how any of this works we'll update this page and change the date at the top. If the change is significant and we still hold your application, we'll email you about it.