Privacy Notice

Key things first

We use Umami, Vercel Web Analytics and Vercel Speed Insights to understand site usage and performance without tracking cookies. We run no advertising, nobody can register or log in, and our hosting provider keeps ordinary server logs for a short time.

We collect your e-mail address only if you ask for our newsletter, and you can leave with one click.

When you submit a startup, pitch a story or ask us to update a catalogue entry, we use what you give us to consider it and to reply, and we never publish anyone's private contact details.

Our news and stories name real people, because who builds a company is part of the story; that reporting is journalism, and Lithuanian law treats it differently from the rest of what we do.

Our main service providers are Vercel, which hosts the site and provides usage and performance metrics, Umami, which provides website analytics, and Google, which runs our e-mail and forms; a newsletter provider will join them once we start sending. Vercel is a US company, and Google serves us through its Irish company. If you want to ask about your data, write to jn@bygrid.io, and we will answer within a month. The rest of this notice fills in the detail.

Who is responsible

The controller of your personal data is Julia Nekhai, an individual operating under registered individual activity in Lithuania and publishing BYGRID. You can reach us at jn@bygrid.io. Publisher details are also set out in our Terms of Use

We do not have a data protection officer. The law does not require one for an outlet of our size, and in practice the person answering your e-mail is the person making the decisions.

The law we work under is the EU General Data Protection Regulation, known in Lithuania as BDAR, together with the Lithuanian Law on the Legal Protection of Personal Data. Where this notice says "GDPR", it means both.

Six ways we come across your data

Almost everything we do with personal data falls into one of six situations:

• you read bygrid.io,
• you write to us,
• you subscribe to our newsletter,
• you send us something through one of our three forms (Submit a startup, Pitch a story, Send a correction),
• you follow or message us on social media, or
• you are a founder, expert or other person we write about or interview.

Each situation has its own section below.

The startup catalogue, which our Contribute page also calls the BYGRID map, lists companies, not people. A catalogue entry shows the company name, stage, description, segment and website. Where a company name happens to identify its founder, the section on people we write about applies.

When you read the site

Reading bygrid.io does not require an account, and in fact there are no user accounts at all: nobody can register or sign in, and we keep no profiles of readers. If we ever introduce accounts, we will update this notice before registration opens. We use the analytics and performance tools described below, and we do not run advertising trackers. There are no embedded social media widgets; the share buttons under our articles are plain links that load nothing until you click them. In addition to delivering pages, the site sends technical usage and performance information to our analytics providers.

Our hosting provider, Vercel, records technical server logs: your IP address, browser type and version, the pages you request and the time of the request. We use these logs only to keep the site running and secure, for example to spot attacks or diagnose errors. Our legal basis is our legitimate interest in operating a working, secure website (Article 6(1)(f) GDPR). Vercel keeps these logs for a short period set by our hosting plan, currently up to 30 days, after which they are deleted. When the site is under attack, Vercel may put a short security check in front of pages; our Cookies and Browser Storage Notice explains how that works.

The site also stores a few settings in your browser: your chosen colour theme and your preferred language for news. These stay on your device, are not sent to us and do not identify you. Our editor keeps the catalogue up to date through an editing tool on the site, which saves its working copy in the editor's own browser and collects nothing about readers. The Cookies and Browser Storage Notice covers all of this in detail.

Stories and catalogue entries link to founders' profiles, company websites and other outside pages. Those sites have their own privacy notices, and this one stops at the edge of bygrid.io.

We use Umami Cloud, provided by Umami Software, Inc., to understand which pages people read and how they reach the site. Its standard analytics include page URLs, referring websites, browser and device information, language and approximate location. Umami does not use tracking cookies. IP addresses are processed to deliver requests, calculate visitor identifiers and derive approximate location; they are not stored as fields in standard analytics records. Umami and its infrastructure providers may keep separate operational and security logs. More detail is available in Umami's privacy notice.

Vercel Web Analytics and Vercel Speed Insights provide aggregated usage and performance metrics without tracking cookies. We use these tools to understand readership and improve the site's usability, reliability and speed. We do not combine these statistics with newsletter addresses, form responses or correspondence, or use them for advertising.

When you write to us

If you e-mail us, or reply to a newsletter, we keep your message, your address and whatever else you chose to tell us, and we use them to answer you and to deal with whatever you wrote about. The same applies when we talk on the channel you named in a pitch form, such as Telegram or LinkedIn. Those messages are also held by the platform concerned, under its own privacy notice.

Our Contribute page invites two kinds of e-mail in particular. A news tip may become part of our research for a story, and from that point it is handled as journalism (see the section on people we write about). A message about working with Bygrid, such as a sponsorship or partnership proposal, is ordinary business correspondence; if it leads to an agreement, we keep what relates to that agreement for as long as the law requires business records to be kept. If your message is a complaint, we keep it while we handle it and for as long as we may need to show how we handled it.

If you give us information in confidence, we do not reveal where it came from. Article 8 of the Lithuanian Law on the Provision of Information to the Public gives journalists the right to keep their sources secret, and a court can order disclosure only in the narrow cases that article lists.

We rely on our legitimate interest in answering people who contact us and in running the publication (Article 6(1)(f) GDPR). Where your message is a request about your own data, dealing with it is also a legal obligation (Article 6(1)(c) GDPR). We keep ordinary correspondence for 24 months after the last exchange, and longer where a dispute or a legal claim makes that necessary. Our e-mail runs on Google Workspace.

When you subscribe to the newsletter

You can give us your e-mail address through the Subscribe form on the site, or by answering the optional question "Want to receive the BYGRID newsletter?" in one of our forms, where you leave your address in the field provided. We use it for one purpose: to send you the Bygrid newsletter, which is a digest of our news and stories and, now and then, news about Bygrid itself. We do not add addresses collected for other reasons, and we do not send the newsletter to anyone who has not asked for it. Sponsors and partners never receive the list.

The legal basis is your consent (Article 6(1)(a) GDPR and Article 81 of the Lithuanian Law on Electronic Communications). Giving us your address is voluntary; without it we simply cannot send you the newsletter. After you sign up we send a confirmation e-mail, and your subscription starts once you click the link in it. Every newsletter contains an unsubscribe link, and you can also withdraw consent by e-mailing us. Withdrawing does not affect anything we did before you withdrew.

We do not measure whether you open the newsletter or which links you click. Our newsletter provider records what any mail system has to record: that a message was sent, whether it bounced, and when you unsubscribed. If that ever changes, we will ask for your separate consent before switching any measurement on.

We keep your address until you unsubscribe. After that we keep a record of when you subscribed, which version of the consent text you saw and when you withdrew, for 3 years, so that we can show we had your permission if the question ever comes up. We keep that record on the basis of our legitimate interest in being able to demonstrate consent, as Article 7(1) GDPR requires (Article 6(1)(f) GDPR). Addresses left in one of our forms are stored with the other form answers in Google Drive. Addresses from the Subscribe form go to the server that runs bygrid.io. Once we start sending, all addresses move to our newsletter provider, named in the table further down. If the newsletter ever becomes a paid product, we will tell you before anything changes and ask for your consent again where the law requires it.

When you send us something through a form

We use several Google Forms, one for each option on our Contribute page. Before a form opens, our site shows a short page saying that it is hosted by Google. On Google's pages Google acts under its own privacy policy: it receives technical data about your visit, sets its own cookies and may offer to let you sign in to your Google account to save your progress. We see only the answers you submit, not your Google account. Filling in a form is voluntary, but the questions marked as required are the minimum we need to consider what you send and to reply to you. Without them we cannot do either.

Submit a startup is how a company gets into the catalogue. It asks for the company name and website, a short description of the problem it solves, its sector and stage, for early-stage companies some sign of outside validation (users, a pilot, an accelerator, a grant or an investment), the names and LinkedIn profiles of the founders, which of the founders have Belarusian roots. We need these answers to decide whether the company belongs in the catalogue. We use the answers to decide whether the company meets our inclusion criteria, to check them against public sources and to write the catalogue entry. The entry shows the company, not the founders: their names and profiles are there for us to check the submission and do not appear in the catalogue. If you ask to be featured, we treat that part as a story pitch. Our legal basis is our legitimate interest in compiling an accurate catalogue (Article 6(1)(f) GDPR).

Anyone can submit a startup, so the person filling in the form is often not a founder. If someone else named you as a founder, we received your name and LinkedIn profile from them, and this notice is how we tell you. We use them only to check the entry, and you can object or ask us to delete them at any time.

A word about the Belarus question. Bygrid covers startups where at least one founder has a publicly visible connection to Belarus: they were born or grew up there, studied or worked there, built an earlier company there, or have said so themselves in public. The form asks which founders have Belarusian roots because that connection is our criterion for inclusion. We read the answer as a statement about a connection the founder has made public, not as information about anyone's ethnic origin. If that connection were ever treated as revealing ethnic origin, we would rely on the founder having made it manifestly public (Article 9(2)(e) GDPR), which is why we record only a connection we can find in the founder's own public statements. If being publicly linked to Belarus could put you or people close to you at risk, tell us and we will take the link out of our records and the catalogue. We check it against what the founder has published about themselves, and in the catalogue it appears only as the reason the company is listed; the entry does not say which founder the connection belongs to or what it consists of.

Pitch a story is for founders, experts and anyone else with a story, an experience or a professional perspective to share. It asks for your name and role (your company or project and what you do), your LinkedIn profile, what you would like to talk about and why it would interest others, and how you prefer to be contacted: e-mail, Telegram, LinkedIn or another channel. The newsletter question is optional. We use the answers to decide whether to take the story further and to get in touch through the channel you chose. If we go ahead, the next section describes how we work with you. We rely on our legitimate interest in finding stories and contributors (Article 6(1)(f) GDPR).

Send a correction is how a company asks us to update its catalogue entry. It asks for the company name, a link to the entry, what should change (description, website, stage or something else), your role at the company and a work e-mail address, which we may use to check that you are entitled to ask. The newsletter question is optional. We use the answers to verify the request, to update the entry where the change is justified, and to reply. If you want the company taken out of the catalogue altogether, choose "Other" in the form or write to jn@bygrid.io; we decide such requests on the grounds in section 4.4 of our Terms of Use. Corrections to articles and stories go by e-mail and are covered in section 5 of the Terms of Use. The legal basis is legitimate interest again: keeping the catalogue accurate and answering people who write to us (Article 6(1)(f) GDPR). If your request is in fact about your own personal data, we handle it under the section on your rights below.

Two things to bear in mind when you fill in a form. If you tell us about someone else, make sure you are entitled to share their details. And please do not send us identity documents or information about anyone's health, political views, religion or other sensitive matters. Our forms do not ask for it, and if it arrives we delete it unless it is the subject of a story we are working on.

Form responses are stored in Google Forms and Google Drive. We keep correction requests for 12 months after we close them, story pitches we take forward for 24 months from receipt, and startup submissions for as long as the company is listed or a story about it is in our archive. Submissions and pitches we decline are deleted 12 months after the decision.

When we work on a story with you

If we take up a pitch, or approach you ourselves, we get in touch on the channel you prefer. An interview may take place by video or phone call, in person or in writing. We take notes and, if you agree at the start, record the conversation so that we can quote you accurately. We do not run recordings through automatic transcription services. Notes and recordings are for our own use and are never published. We delete them 12 months after the piece comes out, or once any dispute about it is closed, whichever is later. Material we gather but do not use is deleted on the same schedule, and if a piece is never published, we delete its notes and recordings 12 months after we drop it.

Where time allows, we send you your quotes, or the passages about you, to check the facts before publication. That check is about accuracy; the editorial decisions stay with us. Photographs, logos or texts you send us for the piece are Contributions under section 6 of our Terms of Use, which sets out the licence you give us.

All of this is part of preparing journalism, so the Lithuanian rules described in the next section apply from the first conversation, and not only from the moment a piece is published.

When we write about you

Bygrid publishes news and stories about startups and the people behind them. Those pieces contain personal data: names, roles, locations, career histories, photographs, quotes. It comes from you, from your company or whoever pitched you, from other people we interview, and from public sources such as your company website, LinkedIn, conference programmes or earlier press coverage. Photographs come from you, your company or public profiles, and we credit the source where the source asks us to.

This is journalistic processing. Under Article 85 GDPR and Article 4 of the Lithuanian Law on the Legal Protection of Personal Data, most of the GDPR's information and individual rights provisions (Articles 12 to 23, among others) do not apply to personal data processed for journalistic purposes. Lithuanian law does this to protect freedom of expression and the public's access to information. Supervision of this part of our work sits with the Inspector of Journalist Ethics rather than the State Data Protection Inspectorate.

We still think you should know how we work. We publish what is relevant to the story and of interest to our readers: who founded a company, what it does, where it operates, what its founder has said. We do not publish home addresses or private contact details, and we leave out private matters that have nothing to do with the story. Information that the law treats as sensitive, such as health or political views, appears in a piece only where the person has made it public or where it is the subject of the piece. Published pieces stay in our archive indefinitely, because an archive that quietly loses articles is not much of a record.

If we have got a fact wrong, tell us and we will check it and correct it. If you believe something we published damages your honour, dignity or reputation, Lithuanian media law gives you a right of reply and a right to demand a refutation; section 5 of our Terms of Use explains how to ask. If you would prefer not to be mentioned at all, or want a piece or your name taken down, you can object. We decide such requests on the grounds set out in section 5.4 of the Terms of Use: whether the piece is accurate, your role in the company it concerns, whether it still deals with that role or has drifted into private life, how much time has passed, the harm you describe, and whether a lesser step such as an update or a note would meet your concern. We answer within a month, in writing, with our reasons. Removing a published piece, or your name from it, is the exception rather than the rule, and if that is our answer we will say so plainly. Complaints about journalistic processing go to the Inspector of Journalist Ethics; details are in the complaints section below.

Our social media pages

Bygrid has pages on LinkedIn and Instagram. When you follow, like, comment on or message those pages, the platform processes your data under its own privacy notice and is the main controller of it. We see what the platform shows every page owner: public reactions and comments, direct messages sent to the page, and aggregated statistics about who follows and reads us. We use the statistics to understand what our readers find useful, and we do not combine them with any other data we hold.

For those page statistics we and the platform may be joint controllers, as the Court of Justice of the EU held for Facebook fan pages (C-210/16 Wirtschaftsakademie). Where a platform offers a joint controller arrangement, such as LinkedIn's Page Insights addendum, we can send you its essence on request (Article 26(2) GDPR). You can exercise your rights against either of us, though the platform is the one that holds and can change the underlying data. Messages you send to a page are handled like e-mail under the section on writing to us. The links to the platforms' privacy notices are on our pages themselves.

Who else handles your data

We do not sell personal data or pass it to anyone for their own use. A few service providers process data on our behalf, under contract and only to provide their service to us.

Where our providers let us choose a location, we keep data on servers in the European Union, but not every part of their services can be limited to the EU. Vercel Inc. is a US company, and Google Ireland Limited belongs to a group headquartered in the United States, so staff or sub-processors in the United States may access data, for example to provide support or keep the service secure. Such access is covered by the EU-US Data Privacy Framework, under which both groups are certified and which the European Commission has recognised as providing adequate protection, with the European Commission's standard contractual clauses as a fallback. Google processes our e-mail and form data as our processor under the Google Workspace data processing terms (Cloud Data Processing Addendum). You can ask us for more detail on these safeguards.

Beyond our providers, a few other recipients are possible. Our legal advisers see personal data when we need advice on a request or a complaint, and they are bound by professional secrecy. Courts and public authorities receive it where the law requires, for instance a supervisory authority looking into a complaint. If Bygrid moves from its current publisher to a company set up for the purpose, or is taken over by another publisher, the data moves with the publication; we would update this notice and tell subscribers before that happened.

If you ask us to recommend someone, a lawyer or an investor for instance, we give you their contact details. We pass your details to them only if you ask us to.

How we protect your data

Bygrid is a small outlet, and its security is mostly the security of the tools it uses. The site is served over HTTPS. Form responses, the subscriber list and correspondence sit in accounts that only the editor, and anyone helping on a particular story under a duty of confidentiality, can open, protected by two-factor authentication. Vercel and Google secure their infrastructure themselves and are audited for it, and their backup copies of our data are deleted on their own schedules, which may lag a little behind ours. We do not keep copies on other services or devices beyond the editor's own computer.

If a security incident affects personal data, we will report it to the State Data Protection Inspectorate unless it is unlikely to put anyone at risk, and if it is likely to put you at high risk, we will also tell you directly (Articles 33 and 34 GDPR).

How long we keep data

The periods are set out in each section above. In short: server logs for up to 30 days, correspondence for 24 months after the last exchange, newsletter addresses until you unsubscribe plus a 3-year consent record, form responses for 12 to 24 months or for as long as the related entry or story is live, interview notes and recordings for 12 months after publication, and published editorial content indefinitely. Where a dispute or a legal claim is open, we keep what it concerns until it is closed. When a period ends, we delete the data or remove anything that identifies a person.

Your rights

For everything we do outside journalism, which means correspondence, the newsletter, the forms, the server logs and our social media pages, you have the rights the GDPR gives you. You can ask what data we hold about you and get a copy. You can ask us to correct it, to delete it, or to restrict what we do with it while a question is being resolved. You can object to processing based on our legitimate interests, and where we rely on legitimate interest you can ask us to explain how we weighed it against your interests. For data you gave us under consent, you can ask to receive it in a machine-readable format, and you can withdraw that consent at any time without affecting what was done before.

To use any of these rights, e-mail jn@bygrid.io. Tell us which right you want to exercise and which data it concerns. If we cannot tell from your e-mail address alone that you are who you say you are, we may ask for something that confirms it; we will not ask for more than we need. We will reply within one month. If your request is complicated or we receive several at once, we may take up to two months longer, and we will tell you why before the first month is over. We do not charge for this.

Requests about published editorial content are handled under the section on people we write about, because Lithuanian law treats them differently. If you are not sure which category your request falls into, write to us and we will work it out.

We do not make automated decisions about anyone and we do not build reader profiles. Bygrid is written for adults working in and around startups. Under Lithuanian law a child can consent to online services from the age of 14; we do not knowingly collect personal data from anyone younger, and if we learn that we have, we delete it.

Where to complain

You can complain to a supervisory authority at any time, though we would rather hear from you first and put things right ourselves.

For correspondence, the newsletter, the forms, the server logs, our social media pages and anything else that is not journalism, the authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, Vilnius, ada@ada.lt, vdai.lrv.lt.

For the way we report on people in our news and stories, the authority is the Inspector of Journalist Ethics (Žurnalistų etikos inspektorius), Gedimino pr. 60, Vilnius, zeit@zeit.lt, zeit.lt.

If you are not sure which one to contact, write to either of them; each can tell you whether the matter belongs with the other. You can also bring a claim in court, in Lithuania or in the EU country where you live.

Changes to this notice

We will update this notice when something changes: a new provider, a new feature such as user accounts, a paid newsletter, a change in who publishes Bygrid. The date at the top tells you which version you are reading. For significant changes we will say so on the site or in the newsletter.

This notice is written in English. If we publish a translation, the English version prevails. It works together with our Terms of Use and our Cookies and Browser Storage Notice, both linked in the footer.