Privacy
Last updated: 6 October 2026
We collect only what Build It Summit genuinely needs. Your data stays with us and our subprocessors, used only on our behalf. This notice explains what we collect, why, on what legal basis, for how long, and the rights you have over it.
Data controller
BUILD IT SUMMIT, a French simplified joint-stock company (SAS) with a share capital of €5,000, registered with the Paris Trade and Companies Register under no. 107 007 239, registered office at 229 rue Saint-Honoré, 75001 Paris, France, represented by Clément Garrigue.
One exception: the sale of a ticket. We do not sell tickets and we do not collect payment. For the sale, the invoice and the payment, APIDAYS, INC. is the data controller. See "Buying a ticket" below.
For any question about your personal data, write to privacy@builditsummit.com or use the contact form. We answer every request.
What we process, why, and on what legal basis
We process personal data for distinct purposes, each with its own legal basis under the GDPR.
Updates and pre-registration (newsletter)
What: your email address and, if you give it, your first name.
Why: to keep you informed about the event, the program, the dates, and when key forms open.
Legal basis: your consent. Subscription relies on your consent, given by ticking the box on the form. You can withdraw your consent at any time using the unsubscribe link in every email.
Partner, speak, press, ecosystem, crew, ambassador and contact forms
What: the details you enter in the form (such as your name, email, organization, and your message).
Why: to handle your request, review your application, and get back to you.
Legal basis: our legitimate interest in responding to a request you initiated, or pre-contractual steps taken at your request before a possible agreement. We only ever use what you submit for the request you sent.
Professional contacts
What: your name, work email, organization and role, and our exchanges with you.
Where it comes from: from you (an exchange, a form, a meeting), from your organization, or from public professional sources and professional data providers.
Why: to tell you about Build It Summit when it relates to your role (speaking, partnering, sponsoring, attending), and to manage our relationship with your organization.
Legal basis: our legitimate interest in building the event with the professionals it concerns (GDPR, Article 6(1)(f)); once an agreement is signed, its performance (Article 6(1)(b)).
How long: up to 3 years after our last exchange; for an agreement, its duration plus the legal limitation period.
Your rights: you can object at any time. Every email has a one-click unsubscribe link, and we then stop for good. See Your rights below.
Buying a ticket
Who does what: tickets are sold and invoiced by APIDAYS, INC., which operates FOST Paris. Build It Summit is the organiser of the event. Checkout and payment happen on the FOST platform, never on this site.
The sale: for the sale itself, the payment, the invoice and its own tax and accounting obligations, APIDAYS is an independent data controller. That processing is covered by its own privacy policy.
Your registration: the fields we ask for in the checkout flow, such as your role, seniority, company size, country, postal code and the days you are joining, are collected for us, so we can organise the event and get in touch with you. For this part we are the data controller and APIDAYS acts as our processor, on our written instructions.
Legal basis: performance of your participation in the event and our legitimate interest in organising it. The optional boxes, such as sharing your details with our sponsors, rely on your consent alone and are never pre-ticked. You can withdraw that consent at any time.
Proof of status: the Student, Job Seeker and Impact & Civic passes are checked after purchase. How, and what we keep: see Proof of status.
Proof of status (Student, Job Seeker and Impact & Civic passes)
Some passes are reserved for specific profiles (terms of sale, Article 6). To check that you are eligible, Build It Summit SAS uses your name, email address, pass and order date and, depending on the pass:
- Student: your school or university email address. We compare its domain with a public list of academic domains, then send a confirmation link to that address. If your school is outside that list, a member of our team asks you for a document proving your status instead.
- Job Seeker: a document proving your status, such as a France Travail certificate or its equivalent in your country.
- Impact & Civic: the registration number of your organization (RNA or SIREN), checked in the French State's public registers, and your organization's email address: we check that it is a work address, then send a confirmation link to it. If something does not match, a member of our team takes a look and may ask you for a document.
What we keep: the result of the check (status, dates, method and a short note), never the content of your document. Documents, and any email address given only for the check, are deleted within 7 days of our decision, results on 31 March 2027. We accept no health documents: if one reaches us, we delete it at once.
Who decides: an automatic check can only accept. Any refusal is decided by a member of our team.
Legal basis: performance of the contract (GDPR, Article 6(1)(b)).
Service providers, all established in the European Union: n8n (automation), Baserow (database), Brevo (emails), Scaleway (document storage).
Visa invitation letters
What: the details you send us to request the letter: your identity, nationality, passport number and dates, and your postal address.
Why: to write the invitation letter you asked for, for your visa application.
Legal basis: steps taken at your request (GDPR, Article 6(1)(b)).
Who receives it: you alone. You pass the letter on to the consulate.
How long: until the letter is sent, and no later than 2 January 2027 (30 days after the event). Once the letter is sent, we delete the copy of your passport and the emails that contain it, and keep a single follow-up line: your name and the date of the letter, without your passport number.
Your rights: see Your rights below.
One-time email to contacts from another organization
What: your email address, and your name if that organization had it.
Where it comes from: the contact base of the organization named in the email, which passed it on to us.
Why: to ask you once whether you want to receive news from Build It Summit.
Legal basis: our legitimate interest in asking you that single question (GDPR, Article 6(1)(f)).
How long: if you sign up through the link, "Updates and pre-registration" above applies. If you do not, we delete your address within 30 days of the email.
Who sends it: Mailjet (see Subprocessors).
Your rights: you can object at any time, and the email has a one-click unsubscribe link. See Your rights below.
Audience measurement (Plausible)
What: aggregated, non-identifying usage statistics (such as page views and referring sites).
Why: to understand how the site is used and improve it.
Legal basis: Plausible is active. It is cookieless, hosted in the European Union, and measures each visit within this site alone, keeping the data aggregate and anonymous. Under CNIL guidance, this kind of measurement is exempt from consent, so you browse straight through.
Cookies and trackers
In short: this site keeps to functional storage only, with cookieless audience measurement and clear of advertising or tracking cookies. You therefore browse it straight through.
Cookieless audience measurement
We use Plausible Analytics (hosted in the European Union), a cookieless audience-measurement tool that collects aggregate, non-identifying usage data. Under CNIL guidance, this measurement is exempt from consent. The data serves audience measurement alone.
First-party only
Everything the site loads is first-party: analytics, fonts and assets are served from our own domain.
Functional local storage
To remember your display preferences, the site stores a little information in your browser (local storage), strictly functional and kept clear of tracking or profiling:
- bis-discovery: your choice in the "Take a tour" guide and the personalized action it sets.
This information stays on your device, remains yours alone, and is reversible at any time (the "Reset" button in the "Find your place" block, or by clearing your browser storage).
Ticketing
Tickets are bought from APIDAYS, INC., which sells them and operates the FOST Paris platform (external link). Any cookies and trackers set at that step are theirs, on their domain, and fall under their own privacy policy and consent banner.
Changes
If we ever add a third-party service that sets non-essential cookies (for example an embedded video or a marketing tool), we will put a consent mechanism in place beforehand.
How long we keep your data
We keep your data only as long as needed for the purpose it was collected for. The periods below are our retention rules, currently being finalized with our counsel.
- Updates, pre-registration, prospects: up to 3 years after your last contact with us.
- Form requests (partner, speak, press, ecosystem, crew, ambassador, contact): up to 3 years after our last exchange, unless a relationship begins, in which case for its duration plus the legal limitation period.
- Participant and ticketing data: the duration of the event plus 12 months.
- Speaker submissions we set aside: deleted after the edition closes.
- Photos and video from the event: kept for promotional use, with removal available on request (see the recording section).
- Proof of status: documents, and email addresses given only for the check, within 7 days of our decision; the result of the check until 31 March 2027.
- One-time email to contacts from another organization: deleted within 30 days of the email, unless you sign up.
- Visa invitation letters: passport details until the letter is sent, and no later than 2 January 2027; then a follow-up line (name, date of the letter).
After these periods, your data is deleted or anonymized.
Subprocessors
We work with a small set of subprocessors who act on our behalf, under contract, and only on our instructions. We chose them for keeping data in Europe and for being reversible, in line with our commitment to a sovereign European stack. Each uses your data on our behalf alone.
- n8n (European Union): runs our form automation pipeline.
- Baserow (European Union): stores form submissions, open source and self-hostable.
- Plausible (European Union): cookieless audience measurement.
- Proton (Switzerland and European Union): our email service for correspondence.
- Brevo (France and European Union): sends our emails, such as form confirmations and proof-of-status emails.
- Mailjet (France, European Union): sends some of our information emails.
- Scaleway (France, European Union): stores the documents sent as proof of status, deleted within 7 days of our decision.
- APIDAYS, INC. (United States): runs the ticketing platform. It is our processor for the registration data collected in the checkout flow on our behalf, and an independent controller for the sale itself.
Switzerland is recognized by the European Commission as providing an adequate level of data protection. Every service we chose ourselves keeps your data within the European Union or an adequate country, and every setup stays reversible. The ticketing platform is the exception: it is run from the United States by the company that sells the tickets, so the registration data collected there is transferred outside the European Union, under the safeguards set out in our agreement with them.
Embedded video: the FOST film on the About page loads from youtube-nocookie.com only when you click play. Until that click, the player stays clear of YouTube (Google). Once you play it, YouTube's own privacy terms apply.
Your rights
Under the GDPR, you have the right to access your data, to have it corrected, to have it erased, to restrict its processing, to object to its processing, and to data portability. To exercise any of these, write to privacy@builditsummit.com or use the contact form. We answer every request.
You can also lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
Every email we send includes an unsubscribe link.
Photography and filming at the event
Build It Summit is photographed and filmed. We do this to document the event and to promote it and future editions, on stage, in the Builders Village, and around the venue.
Why and on what basis: we capture the event under our legitimate interest in documenting and promoting it. We inform you in advance, here and with signage on site, so you know what to expect before you come.
How to object: to stay out of frame, you can tell us before the event (write to privacy@builditsummit.com), avoid filmed zones on site, or tell our crew during the event. If you appear in an image after the event and want it removed, write to privacy@builditsummit.com and we will act on your request. Where an image features you individually and prominently, we will seek your agreement before using it.
Changes to this notice
We may update this notice. The current version is always the one on this page.