Privacy Policy
BIU Network (“the Service”, “we”) is a private directory and messaging tool for members and alumni of Build It Up. It is an independent initiative and is not operated by ESCP Business School. This policy explains what personal data we process, why, and what your rights are under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is Matteo Paglia, a member of Build It Up who built and operates the platform for the Build It Up community, based in Rome, Italy. For anything about your personal data write to privacy@biu-network.org; for general questions, hello@biu-network.org.
2. What data we process, and why
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Name, email address, profile photo, LinkedIn user ID | LinkedIn, when you sign in | Create and secure your account; identify you to other members | Contract (Art. 6(1)(b)); legitimate interest in account security (Art. 6(1)(f)) |
| Batch, role, company, city, university, country, sectors, functions, bio, LinkedIn URL, phone (optional) | You, in your profile | Show you in the member directory according to your visibility settings | Consent (Art. 6(1)(a)), given at onboarding and withdrawable at any time |
| Status signals (looking for a co-founder, hiring, open to work) and their notes | You | Signal board; audience for broadcasts | Consent (Art. 6(1)(a)) |
| Visibility and email preferences | You | Apply your choices | Contract (Art. 6(1)(b)) |
| Messages and broadcasts you send; delivery status of messages sent to you (delivered, bounced, unsubscribed) | You; our email provider | Deliver messages, enforce sending limits, respect opt-outs, protect deliverability | Contract; legitimate interest in preventing abuse (Art. 6(1)(f)) |
| Membership review data: claimed batch, the person who can vouch for you, approval decision and reviewer | You; batch captains and administrators | Verify that members belong to Build It Up | Legitimate interest in keeping the community restricted (Art. 6(1)(f)) |
| Technical logs (IP address, browser, timestamps, errors) | Automatically | Security, debugging, abuse prevention | Legitimate interest (Art. 6(1)(f)); kept up to 30 days |
We do not process special categories of data, do not profile you, and make no automated decisions with legal effect.
3. Who can see your profile
Only approved members can access the directory. For every profile field you choose one of three levels: visible to the whole community, visible to your batch only, or hidden. Your name, photo and batch are always visible to approved members, because a directory cannot function without them. A hidden field can still be used to match broadcast filters (for example, “members open to work”), but it is never displayed. Nothing is visible to the public internet.
4. Emails we send
Account emails (sign-in, approval) are necessary to provide the Service. Broadcasts from other members and the monthly digest are optional: you can switch each category off in Settings, and every broadcast contains a one-click unsubscribe link. When a member contacts you directly, the email is sent by us with the sender’s address in Reply-To; your address is not disclosed unless you reply.
5. Processors and where data is stored
We use the following providers. Supabase, Vercel and Resend act under data-processing agreements. Member data is hosted in the European Union unless stated.
- Supabase (database, authentication, file storage) — Frankfurt, Germany.
- Vercel (application hosting) — primary region Frankfurt; edge network worldwide for request routing.
- Resend (email delivery) — EU region.
- Cloudflare (DNS, email forwarding for our contact addresses).
- Google (Gmail) — only the emails you choose to send to our contact addresses, which are forwarded to the operator’s mailbox.
- LinkedIn / Microsoft (sign-in only). We receive your name, email and photo; we do not post on your behalf and do not access your connections. LinkedIn’s own privacy policy governs your LinkedIn account.
Where a provider transfers data outside the EEA (for example, edge routing), it does so under the EU Standard Contractual Clauses or an adequacy decision.
6. How long we keep data
- Your profile: for as long as your account exists.
- Inactive accounts: we review accounts with no sign-in for 24 months and contact you before removing them.
- Messages you sent: the text and delivery totals for 12 months; the per-recipient delivery records are deleted automatically 12 months after sending.
- Bounce and unsubscribe records: kept while your account exists, so we never email an address that asked us not to.
- Service emails (welcome, approval and similar) that could not be sent because of a temporary limit of our email provider: queued and retried daily for up to 14 days, deleted as soon as they are sent or at the latest after 14 days, and immediately if you delete your account.
- Technical logs: up to 30 days.
7. Your rights
You can, at any time and free of charge:
- Access and export your data — Settings → “Export my data” gives you a JSON file.
- Correct it — edit your profile.
- Withdraw consent — set fields to hidden, switch signals off, or delete the account.
- Erase it — Settings → “Delete my account” removes your profile, photo, signals and message history immediately. Emails already delivered to other members’ inboxes cannot be recalled.
- Object to processing based on legitimate interest, and restrict processing, by writing to privacy@biu-network.org.
- Complain to a supervisory authority. In Italy: Garante per la protezione dei dati personali (garanteprivacy.it). You may also contact the authority of your own EU country.
We answer requests within one month.
8. Cookies
We use only the strictly necessary cookies that keep you signed in. There are no advertising or third-party analytics cookies, so no cookie banner is shown.
9. Age
The Service is for members and alumni of Build It Up and is not intended for anyone under 18.
10. If the Service changes hands
If the operation of the Service is transferred to another person or organisation (for example, to an association that runs the community), your data will be transferred only so that the Service keeps working for the same purpose, under this policy. We will email you at least 30 days before the transfer, and you can export your data or delete your account before it happens. Your data will never be sold separately from the Service or used for advertising.
11. Changes
If we change this policy in a way that affects you, we will email you before the change takes effect. Previous versions are available on request.