Founders Funding Summit Privacy Policy

Medigi Limited, company number 11953188, registered at 71-75 Shelton Street, London, WC2H 9JQ, is the founder and organiser of the Founders Funding Summit (we, us, our). We are committed to protecting the privacy of everyone who visits our website, applies for a ticket, registers for or attends the Founders Funding Summit, applies to speak, sponsors or hosts a Showcase Booth, buys from The Founders' Library, or otherwise contacts us. This policy explains what personal data we collect, why, how we use it, who we share it with, and the rights you have over it.

This policy applies to www.foundersfundingsummit.com, the Founders Funding Summit event, website accounts, and The Founders' Library eBook shop and downloads. It explains our processing under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended, including by the Data (Use and Access) Act 2025.

1. Who we are

1.1 We are the data controller for the personal data described in this policy.

• Data controller: Medigi Limited, company number 11953188, 71-75 Shelton Street, London, WC2H 9JQ.
• ICO registration number: ZC239977.
• Contact: helpdesk@foundersfundingsummit.com

1.2 If you have any questions about this policy or how we handle your personal data, please contact us using the details above.

2. Information we collect

2.1 Information you give us directly

• Contact details: name, email address, phone number, job title and company or organisation name.
• Ticket applications: what you tell us when you register interest in a ticket, such as your company, its stage and funding plans, or your investor profile, so we can assess your application. For Future Founders tickets, this includes your university email address so we can confirm student status.
• Booking information: details of your ticket, and what you provide when registering to attend, sponsor, host a Showcase Booth or speak.
• Payment information: processed securely by Shopify and its payment partners. We do not see or store full card details.
• eBook orders and library access: books purchased, order reference, amount paid, account ID, email-confirmation status and ticket-based or individual-purchase entitlements. Personalised PDFs include your name, email address and a unique copy reference, and we record downloads to provide access and protect copyright.
• Speaker applications: biography, headshot, company information, your proposed session and any other content you submit, and your acknowledgement that sessions are recorded.
• Correspondence: anything you send us by email, contact form or social media.
• Contact form messages: your name, email, optional phone number, topic and message when you use our Contact us form.
• Delegate directory preferences: whether you have opted in to the pre-event delegate directory.
• Dietary requirements and accessibility needs: provided voluntarily so we can accommodate you at the Event. This may include information about a disability or health condition, which is "special category data" under the UK GDPR. We only collect and use it with your explicit consent, and only to arrange catering and access at the venue.
• Marketing preferences: whether you have opted in or out of hearing from us about future events.
• Photography preferences: whether you have objected to appearing in Event Media.

2.2 Information we collect automatically

• Usage data, with your analytics consent: pages visited, time spent, referring website, device and browser type, and approximate location (via IP address), collected using Google Analytics and our own visitor statistics.
• Advertising data, with your marketing consent: collected using the Meta Pixel, as described in section 5.4.
• Cookies and similar technologies: see section 5.

2.3 Information from third parties

• From Shopify and its payment partners, to confirm your order and that payment has been made (we do not receive your full card details).
• From publicly available sources (for example, LinkedIn or your employer's website) if you are invited to speak, so we can accurately describe your role.
• From event partners, sponsors or co-organisers, where you have agreed to your details being shared with us.

3. How we use your information and our legal basis

Under the UK GDPR we must have a valid legal basis to process your personal data. The list below sets out our main purposes and the legal basis we rely on for each.

• To assess ticket applications and decide who to invite to book, so each Event has a balanced mix of founders and investors: steps taken at your request before entering into a contract (Article 6(1)(b)) and our legitimate interests in running a well-balanced Event (Article 6(1)(f)).
• To process your booking, ticket purchase or speaker application: performance of a contract with you (Article 6(1)(b)).
• To process eBook purchases, link paid orders to your confirmed account, supply personalised PDFs and administer library access: performance of a contract (Article 6(1)(b)). To investigate misuse of copies and protect copyright: legitimate interests (Article 6(1)(f)), balanced against your rights. Purchase and accounting records: legal obligation (Article 6(1)(c)). Buying a book does not automatically subscribe you to marketing.
• To communicate essential event information (schedule changes, venue details, joining instructions): performance of a contract and our legitimate interests in running the Event properly.
• To send you marketing about future events: your consent where you have opted in, or, where you previously booked with us and did not opt out, our legitimate interests under the PECR soft opt-in (see section 4).
• To improve our website and understand how it is used: your consent for analytics cookies, and legitimate interests for any resulting analysis.
• To measure our advertising: your consent for marketing cookies.
• To accommodate dietary or accessibility requirements: explicit consent (special category data).
• To photograph, film and record our Events and use Event Media to promote them: our legitimate interests in promoting our Events (Article 6(1)(f)), subject to your right to object. We ask for your separate, explicit consent in the cases listed in section 12.3.
• To share your details with a sponsor, including at a Showcase Booth: only where you choose to, for example by letting them scan your badge.
• To include you in the pre-event delegate directory shared with other attendees: your consent, given by opting in when you apply. You can withdraw it at any time.
• To comply with our legal and regulatory obligations, including tax, accounting and fraud-prevention requirements: legal obligation.
• To establish, exercise or defend legal claims: legitimate interests.

4. Marketing communications

4.1 We will only send you marketing emails about future events if you have opted in, or where permitted under the "soft opt-in" rule in regulation 22 of PECR because you previously booked a ticket with us and were given a clear opportunity to opt out.

4.2 You can withdraw your consent or unsubscribe at any time by clicking "unsubscribe" in any marketing email, or by emailing helpdesk@foundersfundingsummit.com. You will still receive service messages about your application, account and bookings.

5. Cookies and similar technologies

Our website uses cookies and similar technologies (such as pixels and local storage) to make the site work, understand how it is used and, where you consent, to support marketing.

5.1 What are cookies?

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work more efficiently and to provide information to the website owner.

5.2 Our legal position

Regulation 6 of PECR requires clear information and prior consent for storage and access technologies unless a statutory exception applies. Strictly necessary technologies can support a service you request, such as a basket, login or secure checkout. The Data (Use and Access) Act 2025 also introduced limited exceptions subject to conditions; these do not provide a blanket exemption for advertising or tracking. Our website continues to require your opt-in for analytics and marketing, rather than relying on the statistical exception. Consent must be freely given, specific, informed and unambiguous: browsing, pre-ticked boxes or buying a book are not consent. Rejecting is as easy as accepting, and you can shop without optional cookies. Where personal data is involved, we rely on consent for optional tracking (Article 6(1)(a)), contract for requested account and checkout functions (Article 6(1)(b)), or legitimate interests for proportionate security (Article 6(1)(f)).

5.3 Cookies and similar technologies we use

"Local storage" and "session storage" are covered by the same device-storage rules as cookies. Strictly necessary items do not require prior consent; analytics items require analytics consent and marketing items require marketing consent. Our cookie banner also has a functional category, but we do not currently use any functional cookies; if we add any, we will list them here and set them only with your consent. The duration of provider cookies can change or restart on a later visit.

Shopify checkout and Shop Pay cookies

Shopify hosts checkout for tickets and eBooks. The following names, purposes and lifetimes are documented in Shopify's Cookie Policy, checked on 8 October 2026. These are cookies Shopify may use on its checkout or Shop domains, not cookies set by this website. Their presence depends on the checkout, region, consent choices and whether you choose Shop Pay or Login with Shop. This list is a provider disclosure, not confirmation that every cookie was observed in our checkout.

Third-party apps or payment options at checkout can use additional technologies, described in their own notices if you select them.

5.4 What data these technologies collect

• With analytics consent: a random visitor ID, pages viewed, time of visit, the website or ad that referred you, campaign tags (UTM), ad click IDs (Google, Meta, TikTok), and actions such as viewing tickets, starting a form or starting checkout. Google Analytics also receives your IP address, device, browser and approximate location. If you later apply, register or buy a ticket, we may link this history to your contact record so we understand which of our channels work.
• With marketing consent: Meta (Facebook and Instagram) receives the pages you visit and the Meta browser IDs, so we can measure our ads and send conversion events (such as a completed registration) from our servers to Meta. Withdrawing marketing consent stops this, and we record the withdrawal.
• Without consent: only your cookie choice, your basket, your login session and the reCAPTCHA spam check on forms. We do not use these to profile you.

Google and Meta may process data outside the UK. They rely on the UK Extension to the EU-US Data Privacy Framework or the ICO's International Data Transfer Addendum. See Google's Privacy Policy and Meta's Privacy Policy.

5.5 Managing and withdrawing consent

When you first visit our website, a cookie banner asks you to accept, reject or manage cookies by category (analytics, marketing and functional). You can change or withdraw your choice at any time via the "Cookie Settings" link in the website footer. When you withdraw analytics consent, we delete the visitor ID, campaign and click-ID data stored in your browser. You can also block or delete cookies in your browser settings; blocking strictly necessary items may stop the basket or login working. We keep a record of your consent choice (and the version of the notice you saw) for up to 12 months, then ask again.

Our website's cookie choice is not automatically transferred to Shopify checkout. Use the privacy or cookie controls offered on the checkout or Shop domain separately. Withdrawing consent here cannot delete cookies on another domain; use that service's controls or your browser to remove them. Withdrawal does not make earlier lawful processing unlawful. Payment does not require agreement to optional tracking. For the current UK rules, see the ICO guidance on storage and access technologies.

6. Who we share your information with

We do not sell your personal data. We share it only where necessary, with:

• Shopify and its payment partners: hosted ticket and eBook checkout, payment, fraud prevention and order fulfilment. Shopify receives basket items, your name and email, our account-linking reference, the payment and billing information you enter, and technical information such as IP address and browser. We receive order and payment status and order details, not your full card details. Shopify acts as our processor for services supplied on our behalf and can act as an independent controller for its own services, including Shop and Shop Pay. See Shopify's Privacy Policy and Data Processing Addendum.
• Website hosting, database and account providers that run our website, member accounts and The Founders' Library on our behalf.
• Customer relationship management (CRM) systems that we use to manage applications, enquiries and contacts. These include our own CRM built and hosted on our website platform and, where we use it, HubSpot.
• Email service providers that send our service emails and, where you have opted in or the soft opt-in applies, our marketing emails.
• Google (Analytics, with your consent; reCAPTCHA, for spam protection) and Meta (Pixel, with your marketing consent).
• Photographers and filmmakers we engage to capture Event Media.
• The Event venue, to arrange your attendance, catering, access requirements and security.
• Event sponsors, including those hosting Showcase Booths, only where you choose to share your details, for example by letting them scan your badge at the Event or opting in when you apply or book.
• Other attendees, only if you opt in to the pre-event delegate directory (your name, organisation, stage and sector). You can opt out at any time by emailing helpdesk@foundersfundingsummit.com.
• Professional advisers (accountants, solicitors, insurers) where necessary.
• Law enforcement or regulators, where required by law.
• A buyer, if we sell or transfer all or part of our business.

7. International data transfers

7.1 Some of the third parties listed above may store or process data outside the UK (for example, in the United States or the EU). Where this happens, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on UK adequacy regulations.

7.2 Shopify is a global provider and may process checkout and order data in Canada, the United States and other countries. Its Data Processing Addendum describes its subprocessors and transfer safeguards. Contact us using section 14 to request information about the safeguards that apply to your data.

8. How long we keep your information

8.1 We keep personal data only for as long as necessary for the purposes it was collected, typically 24 months after the Event, unless a longer period is required by law (for example, financial records are usually kept for six years for tax purposes). Ticket applications that do not lead to a booking, and speaker and sponsor enquiries not taken further, are deleted or anonymised within 24 months.

8.2 Dietary and accessibility information is deleted within three months after the Event.

8.3 If you object to appearing in Event Media, we keep a record of your objection so we can respect it at future Events.

8.4 For individually purchased eBooks, we keep the account-to-purchase link while it is needed to provide continuing access. Ticket library access lasts 12 months from ticket purchase; downloaded copies may be kept under The Founders' Library: Terms and Conditions. Download and copy-reference records are kept only as needed to administer access, investigate misuse or handle legal claims; accounting records may need to be kept for six years even if your account is deleted. A watermark already embedded in a downloaded copy cannot be removed remotely. Shopify's own retention for independently controlled services is explained in its Privacy Policy.

8.5 You can ask us to delete your data sooner (see section 10).

9. How we protect your information

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, including restricted access to personal data, secure storage with reputable third-party providers, and staff awareness of data protection obligations. No system is completely secure, and we cannot guarantee the absolute security of information transmitted over the internet.

10. Your rights under the UK GDPR

10.1 You have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your data in certain circumstances.
• Right to restrict processing: ask us to limit how we use your data.
• Right to data portability: receive your data in a portable format, or ask us to transfer it to another organisation.
• Right to object: object to processing based on legitimate interests, including the use of Event Media (see section 12), and to direct marketing at any time.
• Rights related to automated decision-making: we do not carry out any automated decision-making, including profiling, that produces legal or similarly significant effects. Ticket applications are assessed by people.
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.

10.2 To exercise any of these rights, contact us at helpdesk@foundersfundingsummit.com. We will respond within one month, as the UK GDPR requires.

10.3 Complaints. If you are unhappy with how we have handled your personal data, please complain to us first at helpdesk@foundersfundingsummit.com. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

11. Children's privacy

The Founders Funding Summit is intended for business professionals aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Photography, filming and recording at our Events

12.1 Our Events are photographed, filmed, recorded and sometimes livestreamed. We use Event Media, including images in which you can be identified, for post-event reporting and to promote our Events, as set out in section 5 of the Founders Funding Summit Terms and Conditions. We rely on our legitimate interests in promoting our Events, not on your consent, for general Event Media.

12.2 How to object. You can object at any time:

• before the Event, by saying so in your ticket application, replying to your approval or ticket email, or emailing helpdesk@foundersfundingsummit.com;
• at the Event, by wearing the no-photography lanyard available at registration or telling the photographer; or
• afterwards, by emailing helpdesk@foundersfundingsummit.com with the image or video concerned.

Once you object, we will stop using that Event Media in new marketing and will remove or blur you on channels we control within 30 days where reasonably practicable. We cannot recall materials already printed or distributed, or content already shared by others, and wide crowd shots where you are not the focus may remain.

12.3 When we will ask for your consent. We will get your separate, explicit consent, which you can withdraw at any time, before we publish a testimonial or quote attributed to you outside the recording of your session, feature you as the main subject of a paid advertisement or case study, use any image or recording of a person under 18, or publish anything revealing health information.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The "last updated" date at the top of this policy shows when it was last revised. We will tell account holders about significant changes by email.

14. Contact us

If you have any questions, concerns or requests relating to this policy or your personal data, please contact us at:

Medigi Limited, 71-75 Shelton Street, London, WC2H 9JQ helpdesk@foundersfundingsummit.com