Privacy policy - Smart Region Application

Privacy policy for the application process of the Scaleup4EuropeSmart Region Lab program, led by XPRENEURS Incubator at UnternehmerTUM GmbH

We would like to inform you below about the processing of personal data in connection with your application to participate in the Scaleup4Europe Smart Region Lab program.

Purpose of the processing

Your personal data is required to apply for the Scaleup4EuropeSmart Region Lab program.

We use the platform "AcceleratorApp" to collect and process applications for the ScaleUp4Europe Smart Region Lab (hereinafter: "Smart Region Application Process"). "AcceleratorApp Ltd" is a service which is based in Canada. The European Commission has adopted a so-called adequacy decision for Canada. This means that it has determined that personal data in Canada enjoys adequate protection comparable to European data protection law. Thus, personal data may be transferred without further authorization.

We have concluded an order processing agreement with the provider of "AcceleratorApp" that complies with the requirements of Art. 28 GDPR.


The data controller for data processing directly related to the conduct of "Smart Region Application Process" is:

UnternehmerTUM GmbH
Lichtenbergstr. 6
85748 Garching

Note: If you access the "AcceleratorApp" website, the provider of the "AcceleratorApp" is responsible for data processing. Use of this website is necessary for submitting your application for the Smart Region Lab & for participating in the evaluation process.

What data is processed?

Various types of data are processed when using the "AcceleratorApp". The scope of the data also depends on the data you provide during the "Smart Region Application process".

The following personal data are subject to processing:

User details:

First name, last name, position/responsibility at the startup, time/engagement at the startup, e-mail address, telephone number, password (if "single sign-on" is not used).

Co-founder details: (Required for all co-founders of the startup) First name, last name, position/responsibility at startup, time/engagement at the startup, e-mail address (optional).

In order to participate in the "Smart Region Application Process", you must at least complete all required questions in the application form which includes details about your co-founders and your startup.

Scope of the processing

We use the "AcceleratorApp" to collect and manage the "Smart Region Lab Application Process".

In order to submit your application for the Smart Region Lab you must register on the “AcceleratorApp” with your startup name, first name, last name, email address and password ("single sign-on" with Google is also available).

Legal basis for data processing

Article 6 I lit. a GDPR serves as our legal basis for processing operations in which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, the processing is based on Article 6 I lit. b GDPR. The same applies to processing operations that are necessary for the implementation of pre-contractual measures. If we are subject to a legal obligation by which the processing of personal data becomes necessary, such as for the fulfilment of tax obligations, the processing is based on Art. 6 I lit. c GDPR.

Finally, processing operations could be based on Art. 6 I lit. f GDPR. Processing operations which are not covered by any of the aforementioned legal bases are based on this legal basis if the processing is necessary to protect a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject are not overridden. Such processing operations are permitted to us in particular because they were specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (recital 47, sentence 2 of the GDPR).

Recipients / passing on of data

Personal data processed in connection with participation in the "Smart Region Application Process" will in principle not be disclosed to third parties unless they are specifically intended for disclosure. By way of derogation, the Scaleup4Europe partners listed below will receive access to the Smart Region Lab applications and use them for the above purposes.

  • UnternehmerTUM GmbH
  • Berchtesgadener Land Wirtschaftsservice GmbH
  • Pioneers Innovation GmbH
  • Pomurski tehnološki park d. o. o.
  • Chamber of Commerce and Industry of Serbia (Privredna komora Srbije)

Please note that content from the "Smart Region Application Process" is part of a partner project called ScaleUp4Europe and is therefore intended to be shared among these partners in order to manage the project and implement the "Smart Region Application Process".

Other recipients: The provider of the "AcceleratorApp" necessarily receives knowledge of the above-mentioned data insofar as this is provided for in the context of our order processing agreement with the "AcceleratorApp".

Data Protection Officer

We have appointed a data protection officer.

You can reach him as follows:

RA Alexander Stolberg-Stolberg
SVF Lawyers
Oberanger 30
80331 Munich

Your rights as a data subject

You have the following rights:

  • Right to information according to Article 15 GDPR
  • Right to rectification under Article 16 of the GDPR
  • Right to erasure under Article 17 of the GDPR
  • Right to restriction of processing under Article 18 GDPR
  • Right to object under Article 21 of the GDPR; and
  • Right to data portability under Article 20 of the GDPR.

With regard to the right to information and the right to erasure, the restrictions pursuant to Sections 34 and 35 BDSG (German Data Protection Act)  apply. In addition, there is a right of appeal to a competent data protection supervisory authority (Article 77 GDPR in conjunction with & 19 BDSG). You can revoke your consent to the processing of personal data at any time. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.

Data deletion

We generally delete personal data when there is no need for further storage. A requirement may exist in particular if the data is still needed to fulfil contractual services, to check and grant or ward off warranty and, if applicable, guarantee claims. In the case of statutory retention obligations, deletion is only considered after the expiry of the respective retention obligation.

Right of appeal to a supervisory authority

You have the right to complain about our processing of personal data to a data protection supervisory authority.

Amendment of this data protection notice

We revise this data protection notice in the event of changes to data processing or other occasions that make this necessary. You will always find the current version on this website.