Privacy Policy

Last updated: 10 October 2026

This notice explains how VentureOUT uses personal data. Sections 1 to 5 cover the website, the information session, earlier expressions of interest, enquiries and VentureOUT emails. Section 6 covers applications to the VentureOUT incubator. Sections 7 to 16 apply to everyone.

1. Who we are

VentureOUT is an initiative of Single Step Foundation. Single Step Foundation is the controller responsible for the personal data described in this notice.

Registered office: 12 Bratya Miladinovi Street, Sofia 1000, Bulgaria
Unified Identification Code: 177112828
Email: connect@ventureout.lgbt

2. Scope of this notice

This notice applies when you:

  • visit the VentureOUT website;
  • apply to the VentureOUT incubator (see Section 6);
  • register for or attend a VentureOUT online information session;
  • submitted an expression of interest through our earlier form, which is now closed;
  • contact us; or
  • receive VentureOUT emails.

3. Personal data we collect outside applications

Depending on how you interact with us, we may collect:

  • Expression of interest: your name, email address, organisation, role and country; an optional organisational website or social-media page; your relationship to VentureOUT, such as CSO representative, mentor, expert, funder, supporter or partner; if you represent a CSO, its approximate share of self-generated income and its principal barrier to generating or increasing such income; and your consent record;
  • Information session: the registration details you provide, such as your name and email address, and any questions you send us;
  • Enquiries: messages and other information you choose to send us;
  • Emails: your communication preferences, consent record and unsubscribe status;
  • Website use: referral or campaign source information contained in the link through which you reached the website, and limited technical and security information, such as request time, IP address, browser type, device type and security logs.

Outside the application form, we do not ask for information about your sexual orientation, gender identity, health, political opinions, religious beliefs or other special categories of personal data. Your relationship with an organisation does not tell us, and we will not infer, anything about your personal identity. Please do not send such information, confidential documents or information about other individuals by email or through our contact channels.

We collect this information directly from you, except for limited technical information, which is generated when your browser communicates with the website and its hosting and security services.

4. Why we use this data and our legal bases

Expressions of interest and VentureOUT emails

We use expression-of-interest information to record your interest, send the VentureOUT announcements and opportunities you asked for and conduct relevant follow-up. Our legal basis is your consent under Article 6(1)(a) of the General Data Protection Regulation (GDPR), which you gave by selecting the communication checkbox, which was not pre-selected, and submitting the form.

An expression of interest is not an application. We keep expression-of-interest records and their consent separate from applications and have not converted them into applications. To be considered for the incubator, you must submit the application form.

Information sessions

We use your registration details to send you the joining link, run the session and answer your questions. We may publish answers to common questions afterwards without identifying who asked them. Our legal basis is our legitimate interest under Article 6(1)(f) of the GDPR in informing potential applicants about VentureOUT. Registration is handled through Zoom, which also processes your information under its own privacy statement. Attending does not affect selection.

Responding to you

If you contact us, we use your information to answer your message and take any steps you request. Our legal basis is our legitimate interest under Article 6(1)(f) of the GDPR in communicating with people and organisations interested in VentureOUT.

Operating and protecting the website

We use limited technical information to deliver the website, prevent misuse, maintain security and diagnose technical problems. Our legal basis is our legitimate interest under Article 6(1)(f) of the GDPR in operating a secure and reliable website.

Aggregate website measurement

We use privacy-focused, cookie-free measurement to understand visits and website performance. We do not use this information to identify visitors, build profiles or track people across websites. To the extent that any of this information is personal data, our legal basis is our legitimate interest under Article 6(1)(f) of the GDPR in understanding and improving the website.

Legal obligations and claims

We may process information where necessary to comply with a legal obligation under Article 6(1)(c) of the GDPR, or, on the basis of our legitimate interest under Article 6(1)(f), to establish, exercise or defend legal claims.

5. VentureOUT email communications

If you have consented, we may email you about:

  • the opening and development of the VentureOUT programme;
  • participation opportunities, including calls for applications;
  • mentoring, expert, funding or partnership opportunities; and
  • closely related VentureOUT events and announcements.

This consent does not cover unrelated Single Step Foundation marketing. Applying to the incubator does not subscribe you to VentureOUT emails; the application form contains no marketing opt-in.

You can withdraw your consent at any time by using the unsubscribe link in any VentureOUT email or by contacting connect@ventureout.lgbt. Withdrawal does not affect processing that took place before withdrawal. After you unsubscribe, we may still respond to messages you send us, contact you about an application you have submitted, or contact you where required by law.

6. VentureOUT Application Privacy Notice

This section applies when you apply to the VentureOUT incubator through the application form at /apply/, take part in a shortlisting interview and, if you are selected, take part in the programme, mentoring and Demo Day. Single Step Foundation is responsible for your personal data. A previous expression of interest does not count as an application.

6.1 Information we collect

  • Eligibility: your answer to whether you identify as part of the LGBTI+ community;
  • About you: your first and last name, pronouns, email address and role in your organisation;
  • About your organisation: its registered name, legal form, website, social-media page, organisation type, whether it is displaced, its countries of registration, current base and origin, the eligible countries whose communities it serves, and its earned-income stage;
  • Your application: your answers to the five questions, your answers about participation in English, programme commitment and organisational backing, any optional context you provide, the confirmations you tick and the submission time;
  • Optional self-identification: any answers you choose to give about your sexual orientation, gender identity and whether you identify as trans, including any term you enter yourself;
  • Selection: reviewers’ scores and comments, interview notes and selection decisions;
  • If you are selected: your availability, attendance, programme work, mentoring records and Demo Day proposal and results; and, if you apply for a scholarship, the information needed to assess it and reimburse travel and accommodation costs, such as receipts and payment details; and
  • Support and adjustments: any support needs or requests for an accessible way to apply or take part that you choose to tell us.

Fields marked as required must be completed to submit an application. We use pronouns to address you appropriately, not to assess you; you may enter “Use my name” or “Prefer not to say”.

6.2 How we use it and our legal bases

Assessing applications and running the programme. We use your contact details, organisational information, application answers and interview notes to check eligibility, assess your application, select participants, communicate with you and, if you are selected, deliver the programme, mentoring and Demo Day. Our legal basis is our legitimate interest under Article 6(1)(f) of the GDPR in administering a fair selection process and delivering the incubator. We send a receipt email when you submit; it does not include your narrative answers.

LGBTI+ eligibility question. VentureOUT is open to leaders who identify as part of the LGBTI+ community, so this question is required. Your answer reveals information about your sexual orientation or gender identity, which the GDPR treats as a special category of data. We process it on the basis of your explicit consent under Articles 6(1)(a) and 9(2)(a) of the GDPR, which you give when you confirm your consent on the form and submit it. We use the answer only to confirm eligibility; it is not scored. If you answer “No”, the form cannot be submitted and we do not receive your answer. You may withdraw this consent at any time, but we will then no longer be able to consider your application.

Optional self-identification. The self-identification questions are optional. With your explicit consent under Articles 6(1)(a) and 9(2)(a) of the GDPR, given by ticking the separate consent box, we use these answers to understand applicant diversity and report on it only in aggregate, without identifying anyone. They are excluded from merit scoring and kept separate from merit-review materials. You may skip any question, or withdraw consent by email at any time, without affecting your application. Withdrawal does not affect earlier lawful processing.

Optional context and support requests. Optional context is used only where final scores are equal and is kept out of merit-review materials. Please describe your organisation’s environment and the communities it works with, rather than sensitive details about yourself or other identifiable people. Requests for support, such as “Yes, with support”, and any support or accessibility needs you tell us about are used only to discuss and arrange that support. They are kept out of merit-review materials. Where they reveal information about your health, we use them only with your explicit consent under Article 9(2)(a) of the GDPR.

Scholarships and reimbursements. If you are selected and apply for a scholarship, we use the information you provide to assess your request and reimburse eligible costs, on the basis of our legitimate interest under Article 6(1)(f) of the GDPR in administering scholarships fairly and, once a scholarship is agreed, to perform that arrangement under Article 6(1)(b). We keep financial records as required by Bulgarian accounting and tax law under Article 6(1)(c).

Please avoid including sensitive personal information in your other answers. Applications are not used for marketing.

6.3 Who sees your application

Access is limited to authorised programme staff, selection reviewers and interviewers, who are bound by confidentiality, and the service providers that host the form, deliver email and provide video conferencing for interviews. If you are selected, your mentors and the Demo Day jury receive only the information they need for their role. Self-identification answers are accessible only to designated programme staff. Applications are not published, sold or shared with funders, mentors, partners or other organisations for their own purposes. Selection decisions are made by people.

6.4 How long we keep application data

  • Unsuccessful applications, including interview notes, are kept for 12 months after final decisions.
  • Self-identification answers from all applicants are kept for 12 months after final decisions, or deleted sooner if you withdraw consent.
  • Selected participants’ other records are kept for 12 months after programme completion, including mentoring.
  • Scholarship and reimbursement records are kept for the period required by accounting and tax law.
  • Records needed for other legal obligations or specific legal claims may be kept longer.

You may withdraw your application at any time by emailing connect@ventureout.lgbt. Your rights, including the right to complain, are set out in Sections 12 and 13.

7. Who receives your data

Access is limited to people who need the information for the purposes described in this notice. Recipients may include:

  • authorised Single Step Foundation personnel and contractors;
  • for applications, the reviewers, interviewers, mentors and Demo Day jury described in Section 6.3;
  • providers of website hosting, content delivery and security services;
  • providers that operate the forms, email delivery and unsubscribe functions;
  • video-conferencing providers used for information sessions and interviews;
  • privacy-focused analytics and technical-support providers;
  • professional advisers, such as accountants and lawyers, where necessary; and
  • public authorities where disclosure is required by law.

Service providers may process personal data only on our instructions and under applicable data-protection obligations.

We do not sell or rent your personal data. We do not publish expression-of-interest records or applications. We will not give identifiable data to funders, mentors, partners or other organisations for their own purposes unless we first explain the proposed sharing and have a valid legal basis.

8. International data transfers

Some technology providers may process information outside the European Economic Area. We transfer personal data outside the EEA only where permitted by data-protection law: either to a destination covered by a European Commission adequacy decision, including, for certified US organisations, the EU–US Data Privacy Framework, or under appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. You may contact us for details of the safeguards relevant to your data.

9. Cookies and similar technologies

VentureOUT does not use advertising, profiling or non-essential analytics cookies. We may use strictly necessary security technologies and cookie-free aggregate website measurement. External services you choose to visit from our website, such as the Zoom registration page, apply their own cookie policies. Please read the separate Cookie Notice for details.

10. How long we keep other data

Retention periods for applications are set out in Section 6.4. For other data:

  • expression-of-interest data is kept for up to 24 months from submission, unless you withdraw consent earlier;
  • information-session registration details are kept for up to three months after the session;
  • enquiries are kept for as long as needed to deal with them and any follow-up;
  • technical security logs are normally kept for no more than 90 days, unless they are needed to investigate an incident or establish a legal claim;
  • incomplete or abandoned form content is not intentionally retained;
  • after you unsubscribe, we keep the minimum information needed to record your choice and prevent further VentureOUT emails, normally for up to five years; and
  • information needed for a legal obligation or claim may be kept for the applicable legal period.

At the end of the relevant period, information is deleted or irreversibly anonymised.

11. Security

We use appropriate technical and organisational measures designed to protect personal data, including encrypted transmission, restricted access, separation of sensitive application data from merit-review materials, and service-provider controls. No online service can guarantee absolute security.

12. Your rights

Subject to the conditions in the GDPR, you may:

  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of your data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • request data portability where applicable;
  • withdraw consent at any time, without affecting processing carried out before withdrawal; and
  • lodge a complaint with a supervisory authority.

To exercise a right, contact connect@ventureout.lgbt. We may ask for information needed to confirm your identity. We normally respond within one month.

13. Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve them. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
Sofia 1592, Bulgaria
Email: kzld@cpdp.bg
Website: https://cpdp.bg

You may also complain to the supervisory authority in the EU or EEA country where you live or work.

14. Automated decisions

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. Application selection involves human review.

15. Adults and professional use

The website, application form and information sessions are intended for adults acting in a professional or organisational capacity and are not directed at children.

16. Changes and contact

We may update this notice when the website, forms, programme or legal requirements change. The current version and its update date will remain available on this page.

Questions about this notice or our use of personal data may be sent to connect@ventureout.lgbt.

Powered by
Scroll to Top