Legal
Privacy Notice — European Impact Map
Last updated: 2026-08-05
1. Controller
The controller responsible for the processing of personal data on this website is:
Public Value Hub gGmbH
Markgrafenstraße 2
04109 Leipzig
Germany
Email: contact@europeanimpactmap.com
Registered at Amtsgericht Leipzig, HRB 40944. Managing Director: Alexander Hertel. VAT ID: DE405409792.
Public Value Hub gGmbH has not appointed a Data Protection Officer. Enquiries about how we handle personal data, and requests to exercise your rights, can be sent to the address above.
2. Overview
The European Impact Map ("the Map") is a public directory of impact-focused ventures across Europe. Organisations submit their own listings, which we review before publication. This notice explains what personal data we process, why, on what legal basis, and what rights you have.
Most information in a listing relates to an organisation rather than an individual. However, some data — the name, email address and telephone number of the person submitting a listing, and technical data such as IP addresses — is personal data, and is covered by this notice.
3. What data we process
3.1 Listing data
Organisation name, website, country, legal form, registry number, purpose statement, Sustainable Development Goals addressed, category and subcategories, tags, description of beneficiaries and paying customers, whether the product is technical, year founded, team size band, working languages, and public organisational contact details.
This data is displayed publicly on the Map once approved.
3.2 Submitter contact data
First name, last name, email address, telephone number (optional), and your relationship to the organisation.
This data is not displayed publicly. It is processed only where you have given consent for us to contact you.
3.3 Consent and technical records
For each submission we record which consents were given, the timestamp of each consent, the version of the form used, and the IP address from which the submission was made. Timestamps and IP address are recorded server-side.
We keep these records to demonstrate that consent was validly obtained, as required by Art. 7(1) GDPR.
When a submission attempt fails, we also record a technical record of the failure: which fields were rejected, the error status, your browser and screen size, the version of the site and of the form, and the IP address of the attempt. No content you typed into the form is stored in that record. We use it only to find and fix faults in the submission form, on the basis of our legitimate interest in a working service (Art. 6(1)(f) GDPR).
3.4 Referral source
If you reach the submission form through a partner link, we record which partner referred you.
3.5 Newsletter data
If you subscribe to our newsletter, we process your email address, your confirmation status, and optionally the audience segment you select.
4. Purposes and legal bases
4.1 Publishing your listing
Purpose: Reviewing, verifying and publicly displaying your organisation's listing on the Map, including verification of your registry number against public registers.
Legal basis: Consent, Art. 6(1)(a) GDPR.
4.2 Contacting you about your submission
Purpose: Contacting you regarding your submission, the European Impact Map, and related Public Value Hub activities. Your contact details are stored in our customer relationship management system.
Legal basis: Consent, Art. 6(1)(a) GDPR. If you do not give this consent, your contact details are not transferred to our CRM system.
4.3 Transactional emails
Purpose: Confirming receipt of your submission, and notifying you when your listing is approved, requires revision, or is rejected.
Legal basis: Legitimate interests, Art. 6(1)(f) GDPR — keeping you informed about a submission you initiated.
4.4 Newsletter
Purpose: Sending you our newsletter with updates on the impact ecosystem, events and opportunities.
Legal basis: Consent, Art. 6(1)(a) GDPR. We use a double opt-in procedure: you are only added to the list after confirming via a link we email you. You can unsubscribe at any time using the link in every newsletter, or by emailing us.
4.5 Sharing with partner networks
Purpose: Sharing your organisation's listing information with selected ecosystem partners, to connect impact ventures with relevant opportunities and resources.
Legal basis: Consent, Art. 6(1)(a) GDPR. This is optional and separate from publishing your listing.
4.6 Demonstrating consent
Purpose: Retaining a record of the consents you gave, when, and to which version of the wording.
Legal basis: Accountability, Art. 5(2) and Art. 7(1) GDPR.
5. Recipients and processors
We use the following service providers, each engaged under a data processing agreement:
| Provider | Role | Location |
|---|---|---|
| Emilio Consulting AB | Development and maintenance of the platform, acting on our instructions | Sweden (EU) |
| Lovable | Hosting and application platform | EU |
| Supabase | Database, engaged via Lovable | EU (Ireland, eu-west-1) |
| Twilio SendGrid | Transactional and confirmation emails | EU / United States |
| HubSpot | Customer relationship management and newsletter distribution | EU / United States |
| Inluma | Internal analysis system operated by Public Value Hub | EU |
Lovable engages a number of its own sub-processors to provide infrastructure, AI, and analytics services. Lovable's current sub-processor list is available at trust.lovable.dev/subprocessors, and is updated by Lovable from time to time.
Where a provider processes data outside the European Economic Area, transfers are safeguarded as follows. Twilio Inc. (SendGrid) and HubSpot, Inc. are both certified under the EU-U.S. Data Privacy Framework, and transfers to them take place on the basis of the European Commission's adequacy decision of 10 July 2023. Where the Framework does not apply, transfers are safeguarded by the European Commission's Standard Contractual Clauses.
Beyond these providers, we share your data with partner networks only where you have given specific consent. Approved listing data is published publicly on the Map and is therefore accessible to anyone visiting the site.
6. Retention
- Published listing data: retained for as long as the listing remains published, and removed on request or when the listing is withdrawn.
- Submitter contact data: retained while your consent stands, and deleted when you withdraw it or when the listing is removed.
- Newsletter data: retained until you unsubscribe.
- Unsubscribed email addresses: retained on a suppression list so that we can ensure you are not added to the list again. We do this on the basis of our legitimate interest in honouring your unsubscribe request (Art. 6(1)(f) GDPR).
- Rejected submissions: deleted six months after the decision.
- Failed submission records: the technical failure records described in section 3.3, including browser and screen size and the IP address of the attempt, are retained for twelve months and then deleted.
- Consent records: retained for three years after the deletion of the underlying data, as proof that consent was validly obtained.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure of your data (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3))
To exercise any of these rights, or to request that your listing be edited or removed, email contact@europeanimpactmap.com.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for Public Value Hub gGmbH is:
Sächsischer Datenschutzbeauftragter
Devrientstraße 5, 01067 Dresden, Germany
8. Is provision of data required?
Providing your organisation's listing data is necessary if you wish to be listed on the Map — without it, we cannot publish a listing. Providing your personal contact details, subscribing to the newsletter, and consenting to partner sharing are all optional, and declining has no effect on whether your listing is published.
10. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Listings are reviewed by a person before publication.
11. Changes to this notice
We may update this notice as the service develops. The current version is always available at this address, with the date of the most recent update shown at the top.