Privacy Policy

This Privacy Policy (the "Policy") sets out how "SABAH Academy" LLC, TIN 1406019771, as the organizer of the Baku ID innovation event (the "Organizer", "we", "us" or "our"), collects, processes, stores, discloses, protects and deletes personal data through https://bakuid.com/, event registration and attendance, startup and partner applications, ticket sales, newsletters and other activities related to Baku ID.

This Policy is prepared under the Law of the Republic of Azerbaijan “On Personal Data” and other applicable legislation. The EU General Data Protection Regulation (GDPR), the UK GDPR and other foreign data protection rules are taken into account only where they are mandatorily applicable to the relevant processing activity.

1.1. This Policy applies to website visitors, event attendees, ticket purchasers, startup founders and representatives, investors, partners, sponsors, speakers, judges, mentors, media representatives, newsletter subscribers and other persons who interact with Baku ID.

1.2. By completing and submitting a relevant form, registering, purchasing a ticket, subscribing to a newsletter or sending us an inquiry, you confirm that you have read this Policy and consent to the processing of the data you provide for the purposes described in it.

1.3. To record consent or submission, we may retain the type of form, date and time of submission, the contact details used, the version of the Policy accepted and necessary technical records.

1.4. Where applicable law requires separate consent, including for sharing startup contact details and pitch decks with investors, direct marketing and the use of non-essential cookies, the relevant choice will be presented separately and clearly.

1.5. If you provide data about another person, you must be authorised to do so and must inform that person about this Policy.

2.1. Depending on the service you use and the application you submit, we may collect your name, surname, email address, telephone number, country, city, citizenship, language preference and other contact details.

2.2. We may process professional details such as your job title, the company or organisation you represent, sector, LinkedIn profile, biography, photograph, professional interests and networking preferences.

2.3. A startup application may include the startup name, country, website, sector, team details, problem and solution description, product stage, customer, user and revenue metrics, funding raised and sought, valuation, reasons for participation, correspondence, selection outcome and pitch deck.

2.4. Partner, sponsor, investor, speaker, mentor, judge and media applications may include company, role, contact details, proposal, investment and partnership interests, biography, presentation materials, event participation and necessary contract details.

2.5. Ticket and registration data may include ticket type, order and payment status, purchaser and attendee details, information required for invoicing, invitation and discount codes, QR code or barcode, badge information and event access records.

2.6. When you use the website, technical data may be generated automatically, including IP address, device and browser details, language, pages viewed, time of use, cookie identifiers, consent preferences, error logs and security records.

2.7. Photographs, video, audio, livestreams, stage and session recordings, interviews and general images of the event venue may be recorded during the event.

2.8. We do not request sensitive or special category data during the standard registration process. Where such data is necessary for accessibility, dietary, travel or safety purposes, it is processed only to the necessary extent and on an appropriate legal basis.

3.1. Ticket payments may be completed through the secure infrastructure of a third-party ticketing and payment service provider.

3.2. We may receive the transaction reference, amount, currency, payment and refund status and limited billing information.

3.3. We do not collect or store full payment card numbers, CVV or CVC codes, PIN codes or online banking credentials. Processing carried out by a ticketing or payment provider for its own services is governed by that provider’s privacy rules.

4.1. We obtain data directly from you through forms, ticket and registration processes, newsletter subscriptions, correspondence and your participation in the event.

4.2. Your company, employer, team lead, inviting person or ticket purchaser may provide data on your behalf. That person must be authorised to do so and must inform you.

4.3. Third-party service providers for ticketing, payments, hosting, email, registration, security, access control, event technology and other services may provide us with data necessary to deliver those services.

4.4. Where permitted by law, we may obtain limited information from company websites, LinkedIn and other manifestly public professional sources to verify an application or establish professional contact.

5.1. We use data to manage event registration, issue and validate tickets, manage attendance and access, organise the event and send programme, operational and safety notices.

5.2. Startup, partner, investor, speaker and other application data is used to verify eligibility, assess and select applicants, organise meetings and the programme and communicate results.

5.3. We may use data to respond to inquiries, provide technical support, manage payment and refund matters, prevent fraud and misuse, protect legal rights and comply with legal obligations.

5.4. With your consent, we may use data to send newsletters and marketing information about future Baku ID events, programmes and related updates.

5.5. We may use anonymised or aggregated information to analyse and improve the website and the event.

6.1. Startup applications may be reviewed only by authorised staff, judges, experts and advisers for assessment and event organisation.

6.2. Where the application form clearly states that the startup profile will be shared with attending investors, by completing and submitting the form you confirm your consent to the disclosure of the information identified in that form to the stated category of recipients.

6.3. Founder contact details, a full pitch deck and other non-public information are shared only to the extent and for the purpose stated in the form or a separate notice. Where disclosure to another recipient or for another purpose requires separate consent, that consent will be obtained separately.

6.4. If a startup is selected, its name, logo, website, country, sector, founder name, approved short description and participation status may be published on the website, in the event programme, on social media and in press materials. Non-public financial information and the full pitch deck are not made public without separate consent.

6.5. If a pitch deck contains data about other persons, you must have permission to provide that data and should remove personal data that is not necessary for assessment.

7.1. A ticket, badge, barcode or QR code may be used to verify event admission, ticket validity and access to specific areas.

7.2. If you voluntarily allow your badge or QR code to be scanned at a sponsor, partner or exhibitor point, the data identified in the short notice may be disclosed to that party. The recipient may then act as a separate controller for its further processing.

7.3. Attendance at the event alone does not constitute consent to provide the attendee list to sponsors or partners for marketing purposes.

8.1. Baku ID is a public-facing event. Official photographers, videographers, media partners and livestream teams may record the event. Notice may be provided during registration and at the venue.

8.2. General venue images, stage presentations and crowd scenes may be used to report on, archive and promote the event and future editions.

8.3. Where required by law, interviews, testimonials, focused portraits and advertising content centred on an identifiable person will be based on separate consent or an applicable participation agreement.

8.4. You may contact the registration desk or the contact channel set out in this Policy if you have a reasonable concern about recording. It may not always be possible to fully recall a livestream, material already published, independent media coverage or material shared by third parties.

9.1. When you subscribe to the newsletter, your email address and subscription record may be used to send Baku ID news, speaker and programme announcements, future event information and related updates.

9.2. You may unsubscribe from marketing at any time through the unsubscribe option in the message or by contacting us.

9.3. Unsubscribing from marketing does not stop service communications about a ticket, application, programme change, safety or other operational matters.

10.1. The website may use cookies and similar technologies for security, core functionality, remembering language and preferences, analysing usage and measuring advertising results.

10.2. Where required by law, non-essential analytics and advertising cookies are activated only after your choice. You may manage cookies through the website control panel and your browser settings.

10.3. Disabling necessary cookies may affect the proper operation of some website functions.

11.1. We do not sell personal data.

11.2. Data may be disclosed, to the extent necessary, to ticketing and payment providers and to third-party service providers for hosting, email, registration, analytics, security, audiovisual and other technical services.

11.3. Startup, networking and partnership data is shared with investors, judges, mentors, sponsors, partners and other relevant persons only as described in this Policy, the relevant form or a separate notice.

11.4. Data may be provided to courts, law enforcement and other competent authorities where required by law, and to professional advisers where necessary to protect legal rights.

11.5. Where volunteer or supervisor recruitment is carried out by a separate organisation, that organisation’s privacy rules apply to the recruitment process. If limited data is provided to Baku ID for accreditation, scheduling, safety or event coordination, it is used only for those purposes.

12.1. Personal data may be transferred outside Azerbaijan where hosting, email, analytics, event technology or other service provider infrastructure is located abroad.

12.2. Cross-border transfers are carried out in accordance with Azerbaijani law, with your consent where required, and with appropriate measures to protect the data.

12.3. Where the GDPR or another mandatory foreign law applies, any additional transfer mechanism and safeguard required by that law will also be used.

13.1. Personal data is retained for as long as necessary for the purpose for which it was collected and subject to applicable statutory retention requirements.

13.2. Ticket, payment, invoice and contract data may be retained for the period required for accounting, tax, dispute management and protection of legal rights. Application data is retained for the period necessary for the selection process and reasonable future event relations.

13.3. Marketing data is retained until consent is withdrawn or another legal basis no longer exists. Event photo and video archives may be retained while the lawful purpose of event documentation and promotion continues.

13.4. When the purpose and legal basis end, data is deleted, destroyed or anonymised. Deletion from backup systems may take additional time in accordance with the technical backup cycle.

14.1. We use technical and organisational measures appropriate to the nature and risk of the data to prevent accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access.

14.2. These measures may include access restrictions, authentication controls, security logs, backups and confidentiality obligations for staff and service providers.

14.3. If a data security incident occurs, we investigate it, take measures to limit its impact and notify relevant persons where required by law.

15.1. Under applicable law, you may request information about the existence and processing of your personal data, access the data, correct inaccurate or outdated data and, where a legal basis exists, request deletion or cessation of processing.

15.2. You may withdraw consent to consent-based processing at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

15.3. Where the GDPR or another mandatory foreign law applies, you may have additional rights, including, in certain cases, objection to processing, restriction of processing and data portability.

15.4. To exercise your rights, contact us through the channels set out in this Policy. We may request additional information to verify your identity and prevent unauthorised access to another person’s data. Requests are handled in the manner and within the period required by applicable law.

15.5. You may apply to a competent authority or court if you believe your rights have been violated.

16.1. Personal data relating to a minor is processed in accordance with applicable law and, where required, with the consent of a parent, guardian or other legal representative.

16.2. If we determine that a minor’s data was provided without the required consent, we may stop processing and take steps to delete the data.

17.1. We may update this Policy when the website, event, processing activities or applicable law changes.

17.2. The updated Policy will be published on the website with the date of the latest update. Where a new purpose, data category or recipient requires separate consent, the relevant consent will be obtained separately.