Privacy notice for speakers

Who is responsible for your data

• Antoine Marc Thomas Wenmacker, operating the project Papoty.
• Email: hello@papoty.eu
• Postal address: on request, by email
• Papoty is not a registered company or association. Until it is, I am personally the data controller, which means I am personally accountable for everything in this notice.

What I hold about you

• Only what applies to you, from this list.
• In the speaker tracker (a spreadsheet on my own laptop):
  • your name
  • the link to your LinkedIn profile
  • your school, and the year you left it (your bac year)
  • your university, your programme and your field of study
  • your email address, if you give it to me
  • where things stand: contacted, replied, yes or no, filmed, published, with the date of each step
  • which of my two first messages you received, or that you signed up on the website instead
  • who referred you, if another speaker gave me your name
  • short notes, such as topics you are happy to cover, or "not now"
  • how and when I checked your studies before a clip of yours goes out, for example "LinkedIn, 6 October 2026". If you showed me a document for this, I looked at it and deleted it: I keep no copy
• If you record a clip:
  • the video files you send me, and the edits I make from them
  • your signed participation note, or your written "I agree"
  • your publishing choices, and the links to your published clips
  • a short record of the facts I checked in your clip against your university's own pages, and what came out of it
  • your certificate (the image and PDF I send you) and its line in my certificate register: credential ID, your first and last name, school, programme, university, the date and link of your clip, its language, and the date the certificate was issued
• I do not hold your address, your date of birth or your grades, and I do not ask about your health, beliefs or background. If you send files by WhatsApp I see your phone number there, but I do not copy it anywhere. What you say on camera is up to you: if something in your clip turns out more personal than you want public, tell me and I cut it.

Where I got it

• One of six ways, and my first message to you says which:
• Your school's alumni page on LinkedIn. A school's LinkedIn page lists the people who have put that school on their own profile. I read public profiles there, one by one, by hand.
• A LinkedIn search. LinkedIn's own search, filtered on your school, lists the people who have put that school on their profile, with their name, headline and profile link. My assistant (Claude, see below) runs that search for me at a slow pace and reads only those results; I check each name before anyone is written to.
• A LinkedIn search on your studies or your job. LinkedIn's own search, by programme, university or job title, or a university's alumni page, lists people with their name, headline and profile link. The same rules apply: my assistant runs it slowly, and I check each name before anyone is written to.
• My own LinkedIn connections.
• Another speaker. When someone who recorded a clip suggests a name, I write to that person and tell them in my first message who suggested them.
• You. If you signed up at papoty.eu/en/speak, you gave me your details yourself.
• Nothing was taken from a private profile, nothing was bought, and no profile was copied in bulk. I am telling you this because GDPR Article 14 requires it when data comes from somewhere other than you.

Why I hold it, and on what legal basis

• To write to you once, to ask whether you would take part, and to follow up once if you do not answer. Legal basis: legitimate interests, Article 6(1)(f). The interest is giving secondary school students an honest account of university and work from people who are living it. The data is minimal and professional, and you can object at any time, in which case I stop the same day.
• Everything after you say yes. Legal basis: your consent, Article 6(1)(a). Keeping you on the speaker list, sending you the questions, contacting you about future clips or sessions, and sending you a certificate all happen only because you said yes. The same applies if you signed up on the website: the box you ticked is your consent, and your private recording page is made at that moment so you can film straight away. You can withdraw it at any time without giving a reason.
• Your clip, and publishing it. Legal basis: the participation note, which is an agreement between us and contains the copyright licence for what you film (Article 6(1)(b)), together with your consent to the use of your image, which Belgian law requires separately. Nothing is published until you have approved the cut, and only where your publishing choices allow. You can withdraw your consent at any time, and the clip comes off the Papoty site and accounts within thirty days.
• Comparing my two first messages. Until mid January 2027 I send one of two versions of my first message. Which one you get depends on the number of your row in the tracker, not on anything about you. I then count, for each version, how many people said yes and how many recorded a clip. Only those totals are used, never anyone's name. Legal basis: legitimate interests, Article 6(1)(f): the interest is writing to fewer people for the same result.
• I do not use your data for anything else. No advertising, no profiling, no selling, and no automated decisions about you.
• You do not have to give me anything. No law or contract requires it. If you would rather not give something, the only consequence is that I may not be able to include you.

Who else sees it

• Nobody outside the project. Your details are not sold, and not passed to your school, to parents, to students or to other alumni. If another speaker referred you, I do not tell them what you answered.
• Some services handle your data for me, or because you chose them:
• Google (Gmail, Drive and Forms) stores my email and the video files you upload, as a service provider working for me.
• LinkedIn is where I found you and where I write to you. LinkedIn is not working for me: it decides its own purposes for your data under its own privacy policy, as it did before I contacted you.
• Vercel hosts papoty.eu and counts its page views (not on your private recording or preview page), and Supabase, in the EU (Frankfurt), stores what people type into the speaker signup form, the videos you send from your private recording page until I copy them to my computer (usually within a day, then they are deleted there), and your preview. Both work for me as service providers.
• Resend sends the site's emails: the welcome with your recording link when you sign up on papoty.eu, and the short notices that tell me when you sign up or send something. It sends from its EU region (Ireland) and works for me as a service provider.
• WhatsApp and WeTransfer, only if you choose one of them to send me your files. Each carries them under its own terms.
• TikTok, Instagram, YouTube and LinkedIn, once a clip of yours is published there. Each decides for itself what it does with public content on its platform, under its own privacy policy. A public clip can also be watched, downloaded and shared by anyone, which is why nothing goes out without your approval.
• Anthropic, whose assistant Claude helps me draft replies. Once a day it reads my LinkedIn and email conversations with alumni, and the tracker, and prepares draft answers and tracker updates. It also runs the LinkedIn searches described above. If we are connected on LinkedIn, it may also read the list of my connections that LinkedIn shows me when I invite people to follow the Papoty page, and suggest whom to invite. Every message and invitation is one I have decided on: the assistant either prepares it for me to send, or sends it from my account after I have approved it. It never writes to anyone on its own initiative. I use Claude on a personal plan, so for this Anthropic is not my service provider: it handles what the assistant reads under its own privacy policy (anthropic.com/legal/privacy), as a separate controller, which for people in Europe is Anthropic Ireland, Limited. I have switched off the setting that lets Anthropic use these conversations to train its models.
• A cloud editing tool, if I use one to edit your footage. It would process the footage for me as a service provider (a processor).
• Partner accounts, only for a joint post you have agreed to. The account I collaborate with (a student creator or an orientation account) publishes the post as well, and decides for itself what it does with it on its platform.
• A school, a parents association or a funder, who may be shown a clip of yours to explain what Papoty does, within what your participation note allows. They never see anything from the tracker.
• Gandi, which registers papoty.eu and passes on email sent to hello@papoty.eu.
• Some of these providers are based in the United States or process data there. Where your data leaves the EU, the transfer is covered by the standard contractual clauses in that provider's terms.
• If you would rather the assistant did not read our conversation, tell me. I will keep your record offline and handle your messages entirely by hand.

How long I keep it

• No reply: deleted twelve months after the last message I send you. If you never accepted my LinkedIn connection request, and so never received my first message, deleted within a month.
• You say no: deleted immediately, except your name, your profile link and the fact that you declined, kept only so that I do not contact you again by accident. Tell me to delete that too and I will, though I then cannot promise I will not come across your profile again on LinkedIn.
• You ask to be removed, at any stage: the same day, your details are deleted and you are off the list. I keep only your profile link on a do not contact list, so Papoty never contacts you again. Anything of yours that is published comes down within thirty days.
• You say yes: kept while you are on the speaker list, and for twelve months after the last clip or session you took part in. While a clip of yours is published, I keep your name and contact details so that we can reach each other about it.
• Raw footage (the files you send): deleted twelve months after your clip is published, or as soon as you withdraw. Footage that is never published is deleted twelve months after I received it.
• Published clips (live sessions are never recorded): kept online as long as you are happy with that. Withdraw your consent and they come off the Papoty site and accounts, and are deleted, within thirty days.
• Your participation note or written "I agree": kept as long as any clip of yours is published, and for twelve months after, as the record of what you agreed to.
• Your certificate: its line in the register, with the image and PDF kept alongside it, is kept for as long as I can confirm certificates, so that the ID on yours keeps meaning something. Ask and I delete the line and both files together; your certificate then can no longer be confirmed.
• The comparison of my two first messages: only totals are kept, with no names. The note of which version you received goes with your tracker row and follows the rules above.

If you are a collaboration partner or a school contact

• Collaboration partners (student creators and orientation accounts). I hold your name, your handle, the platform, your follower count, where our conversation stands, and the results of any joint post. I write to you once, under legitimate interests (Article 6(1)(f)): a joint post helps students find honest accounts of university. My first message says where I found you and links to this notice. If you agree to work together, what follows rests on your consent (Article 6(1)(a)). Kept while we are in touch, and for twelve months after our last joint post or message; deleted the same day you ask.
• School and parents association contacts. I hold your name, your role, your work email and our conversation, to discuss sharing Papoty with students. Legal basis: legitimate interests, Article 6(1)(f). Kept while we are in touch, and for twelve months after our last exchange; deleted the same day you ask.
• The rights below apply to you in the same way.

Your rights

• You can ask me to:
  • show you everything I hold about you, and give you a copy
  • correct anything wrong
  • delete all of it
  • stop using it, or restrict what I do with it
  • hand it over in a portable format
  • stop the legitimate interests uses described above (your right to object)
• Email me, or simply reply to any of my messages. I act within thirty days, usually the same week, and I delete the same day. There is no charge and you do not have to explain why. I may ask you to confirm it is you, normally by replying from the account I wrote to.
• Where I rely on consent, withdrawing it is always as easy as giving it, and withdrawing does not make anything I did beforehand unlawful.

If you are not happy with how I handle it

• Tell me first, and I will try to fix it. If that does not resolve it, you can complain to the Belgian Data Protection Authority: Autorité de protection des données / Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be.
• If you live in another EU country, you can complain to the authority there instead.

If Papoty becomes an association

• Papoty may become a non profit association (an ASBL under Belgian law). If it does, the ASBL becomes the controller of your data in my place. I will tell everyone on the speaker list before the ASBL takes over, update this notice, and you can leave the list at that point if you prefer. The participation note v2 lets your licence pass to a Papoty ASBL; if you signed v1, I will ask you to agree to v2 first. If anything else in this notice changes in a way that affects you, I will tell you, rather than only change this page.

Contact

hello@papoty.eu