Privacy Policy

The controller under the GDPR is:

ScalePoint Ventures Oy, Almavägen 26, 65610 Mustasaari, Finland.

Business ID / Y-tunnus: 3620767-9.

Further details: see Legal Notice.

For privacy requests (access, rectification, erasure, withdrawal of consent):

Email: markus@sdr-bootcamp.com

For general product inquiries: info@sdr-bootcamp.com

Depending on your interaction we process: contact details (first / last name, email, optional phone, LinkedIn), form content, suitability test answers and qualitative evaluation, waiting-list details, company inquiry data (company, role, request), technical server logs (IP address, browser type, timestamp), and consent status (required privacy acknowledgement, optional marketing consent), the locale (language) and the source page of the submission.

When you write to us via the contact form, we process your submission to answer your request and any follow-up question.

Legal basis: legitimate interest in answering your message (Art. 6(1)(f) GDPR); for contract-related questions Art. 6(1)(b) GDPR.

When you join the waiting list, we process your contact details to inform you about upcoming cohorts, available seats or matching partner opportunities.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by emailing the privacy contact address.

The Suitability Test / Sales-Fit Check is used for initial orientation and internal assessment. Based on the submitted answers and defined criteria, the evaluation may generate an initial category such as ‘Strong sales fit’, ‘Potential sales fit’ or ‘Needs more orientation’. This assessment is not a psychological diagnosis and not a final decision about participation, matching or contact. A final assessment is not made exclusively by automated means.

We process your self-reported answers, your responses to Likert and scenario questions, and the qualitative category derived from them. Numeric raw scores are not displayed publicly.

Legal basis: your consent (Art. 6(1)(a) GDPR).

For company inquiries (partner matching, training, coaching) we process your contact and company details and the request you describe, in order to scope and respond to it.

Legal basis: pre-contractual steps and contract performance (Art. 6(1)(b) GDPR) and legitimate interest in handling B2B requests (Art. 6(1)(f) GDPR).

We send transactional emails (confirmations, status updates) for handling your request. Marketing communication (e.g. notices about upcoming cohorts) is only sent based on separate consent and can be withdrawn at any time without giving reasons.

Art. 6(1)(a) GDPR – consent (waiting list, suitability test, optional marketing).

Art. 6(1)(b) GDPR – pre-contractual steps and contract performance (company inquiries).

Art. 6(1)(f) GDPR – legitimate interest (responding to contact messages, operating and securing the website).

You can withdraw any consent at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal.

Withdrawal can be sent informally by email to the privacy contact address in section 2.

For each submission we store the consent status (required privacy acknowledgement confirmed, optional marketing consent yes/no), the submission timestamp (server-side), the locale and the source page, to evidence the consent.

This website does not set cookies. We use only local browser storage (localStorage / sessionStorage):

• Necessary – localStorage ‘locale’: stores your preferred language (DE/EN) so you don’t have to select it again on every visit.

• Necessary – suitability test sessionStorage: stores your in-session progress so answers are not lost when moving between steps. Removed when the browser is closed.

• Necessary – localStorage ‘sdrb_consent_v1’: stores your privacy consent decision (version, timestamp, accepted categories, locale) so you don’t have to decide again on your next visit.

Optional technologies are loaded only after prior consent given through the consent banner, with separate categories (Necessary / Analytics / Marketing / External media):

• External media – Google Fonts (Inter, Manrope): loaded from fonts.googleapis.com / fonts.gstatic.com (Google Ireland Ltd., Google LLC) only when external-media consent is active. Without consent we use system fonts only and no font request leaves your browser to Google.

• Analytics: not currently used.

• Marketing: not currently used.

No tracking cookies, no marketing pixels and no other third-party embeds are used. You can change or withdraw your consent at any time via the “Privacy settings” link in the footer.

The website is operated on the Lovable Cloud infrastructure (EU region). When pages are loaded, technically necessary server logs (e.g. IP address, timestamp, requested resource, user agent) are processed.

Form submissions (waiting list, suitability test, company inquiries, contact) are stored in a PostgreSQL database operated by Supabase in the EU region. Access is constrained by Row Level Security; only submission (INSERT) is public, while review (SELECT/UPDATE) is restricted to authenticated admin roles.

A data processing agreement under Art. 28 GDPR is in place with Supabase.

A managed email service is used to send transactional confirmation and notification emails. Emails are sent only in response to your interaction (e.g. a form submission). Marketing emails are only sent based on separate consent.

This website currently uses no analytics or tracking tools.

Note: if an analytics tool is added in the future, it will only be activated after prior consent via the consent banner; this section will be updated accordingly.

This website is currently not connected to an external CRM. Requests are processed solely in our own database.

Note: if a CRM is introduced in the future, the provider, region and legal basis will be added to this section.

Recipients of personal data are exclusively the processors named in sections 12–16 and internally authorized personnel of ScalePoint Ventures Oy.

No data is transferred to ad networks, data brokers or social media platforms.

Database and hosting resources are operated in the EU. If a processor exceptionally transfers data to a third country, this is done on the basis of appropriate safeguards under Art. 46 GDPR (e.g. EU Standard Contractual Clauses).

Currently, no regular international transfers are foreseen.

We retain personal data only for as long as necessary for the stated purposes:

• Waiting list: up to 12 months after last interaction or until withdrawal.

• Suitability test: up to 12 months.

• Company inquiries: up to 24 months after the project ends.

• Contact messages: up to 6 months.

• Server logs: routinely deleted within a short period; longer retention only in case of security incidents.

Statutory retention obligations remain unaffected.

You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on Art. 6(1)(f) GDPR (Art. 21).

Any consent given can be withdrawn at any time with effect for the future.

You have the right to lodge a complaint with a data protection supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

No solely automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place.

The suitability test produces only a qualitative orientation category. Any recommendation, contact or matching always involves human review; numeric scores are neither shown publicly nor reused without review.

We update this privacy policy when our data processing or the processors we use change. The version published on this page applies.