Open Spark Challenge - Privacy Policy

SYSTRA’S data privacy policy – open spark 2026

Personal data

SYSTRA, headquartered is the data controller responsible for processing the personal data provided by participants.

Respectful of the rights and privacy of individuals, SYSTRA undertakes to process your personal data with diligence, in accordance with applicable rules, in particular the General Data Protection Regulation (RGPD) adopted by the European Union.

You will find below information concerning the processing carried out by SYSTRA to collect, use and protect your personal information in relation to this Challenge and the rights you have with regard to your personal data.

SYSTRA has appointed ARTEFACT Open Innovation (14 rue de Castellane, 75008 Paris) as its strategic and technical partner to manage the OPEN SPARK 2026 program. In this capacity, Artefact acts as a Data Processor on behalf and under the instructions of SYSTRA.

1. For what purposes are your personal data processed?

The personal data provided by participants will be used for the following purposes:

To facilitate the administration and organization of the Challenge.
To identify participants and communicate with them regarding their participation.
To evaluate and assess project submissions.
To interact with applicants regarding their submission, technical questions, and organization of pitch sessions.
To announce the winners and share their projects within the organization.
To comply with legal or regulatory obligations.

2. Legal Basis for Data Processing

The legal basis for processing personal data is the participant’s explicit consent given during the application process and by accepting the present data privacy policy, which is prepared in compliance with applicable regulation

Application Form:

By filling out the contact form submitting your information, personal data and project (the “Information”), you agree to the terms outlined in this policy and authorize Systra and Artefact to use this Information in relation to the Spark Challenge.

Personal data may be freely provided by you or, in the case of usage data, collected automatically when you use this website. Unless otherwise stated, all data requested by this contact form is mandatory, and failure to provide it may make it impossible to allow your participation to the Spark Challenge.

In cases where this contact form specifies that certain personal data is not mandatory, you are free not to provide it without any consequences for the availability or operation of the service.

3. What categories of data are processed?

The application file must be submitted through the mandatory template available on the website operated by Systra accessible through the front page (https://www.systra.com/en/open-spark-challenge/). Applications will be collected via Microsoft Forms. The application Forms collects the following data from participants during the submission of projects for the Challenge:

Identification: Name, email address, LinkedIn profile of the contact person;
Company data: Pitch decks, financial data, and technical descriptions.

4. Who are the recipients of your data?

The following parties may have access to your personal data:

SYSTRA: The internal team responsible for managing the Challenge, and internal jury members involved in the selection process.
Artefact Open Innovation: An external service provider who assists with the organization of the Challenge and processing data, including access to participant submissions and personal information. Artefact is bound by confidentiality agreements and is required to process personal data only for the purposes specified by SYSTRA.

5. Method and Location of Personal Data Processing

Processing Methods:

We take appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of data. Data processing is carried out using computers or IT tools, following procedures and organizational methods strictly related to the stated purposes.

In some cases, data may be accessible not only to us but also to certain types of people responsible for the management of or involved in the management of the Spark Challenge (e.g., administration, TOP directorate team, legal department).

Data may also be accessible to external parties that we have designated, where applicable, as data processors, such as Artefact.

An up-to-date list of these parties can be requested from us at any time by contacting us using the contact details provided in this document.

Location of Processing

Data is processed at our headquarters and in all other locations where the parties involved in the processing are located. Depending on your location, data transfers may result in your data being transferred to a country other than your own. For more information about where this transferred data is processed, please see the section detailing the processing of personal data.

6. Where are stored your data, duration of the retention period

Personal data will be retained for a period of three months following the conclusion of the Challenge, after which it will be deleted, except for the data of the winners.
Data related to the winners will be retained for a longer period to facilitate the announcement and any rewards or recognition related to the Challenge and the support to be provided afterwards.

7. What are the purposes for which we use your personal information?

We may use your personal information to allow XXX

No unexpected or incompatible purposes: We won’t process your personal information for unexpected purposes, or for purposes incompatible with the purposes originally disclosed, without your consent.

8. What commitments regarding your data?

SYSTRA undertakes to collect only personal data that are necessary and proportionate to the purposes mentioned in point above. To ensure the protection of your data, SYSTRA applies technical and organizational measures to guarantee the security and confidentiality of your personal data. Data are processed in a transparent manner by SYSTRA and are registered in SYSTRA’s register of processing activities.

To consult this register or for any question regarding your personal data, please contact SYSTRA’s person in charge: [email protected].

9. What are your rights regarding your personal data?

You have rights regarding your personal data in compliance with the General Data Protection Regulation (or any other applicable regulations, depending on your location).

You can exercise certain rights concerning the data we process. In particular, you have the right to do the following, to the extent permitted by law:

Withdraw your consent at any time. You have the right to withdraw your consent if you have previously consented to the processing of your personal data.
Object to the processing of your data. You have the right to object to the processing of your data if the processing is carried out on a legal basis other than consent.
Access your data. You have the right to know whether we process data, to obtain information on certain aspects of the processing, and to obtain a copy of the data being processed.
Verify and obtain rectification. You have the right to verify the accuracy of your data and request that it be updated or corrected.
Restrict the processing of your data. You have the right to restrict the processing of your data. In this case, we will only process your data for storage purposes.
Have your personal data deleted or erased. You have the right to have your data erased from us.
Retrieve your data and have it transferred to another data controller. You have the right to receive your data in a structured, commonly used, and machine-readable format and, where technically feasible, to have it transmitted to another data controller without hindrance.
Lodge a complaint. You have the right to lodge a complaint with your competent data protection authority (see infra).
Know the reason for data transfers. You also have the right to know the legal basis for data transfers to any foreign country.
Know the security measures. You have the right to know the security measures we take to protect your data.

Since the processing of data related to the contact form/media space and cookies is based on your consent, you may decide to withdraw your consent at any time.

How to exercise these rights?

Any request to exercise your rights can be sent to us. You will find our full contact details at the beginning of this document.

These requests can be made free of charge, and we will respond as soon as possible, providing you with the information required by law. We will communicate any rectification or erasure

We will communicate any rectification or erasure of personal data, or any restriction of processing, to each recipient to whom the personal data has been disclosed, where applicable, unless this proves impossible or involves disproportionate effort.

For more information or to exercise your rights, please contact SYSTRA’s person in charge: [email protected].

You also have the right to file a complaint with the competent supervisory authority (see https://edpb.europa.eu/about-edpb/board/members_en).

By submitting your application to participate in the Challenge, you acknowledge that you have read this policy and explicitly consent to the processing of your data.

11. Change to the present policy

SYSTRA reserves the right to modify this policy at any time. Any changes will be communicated to participants and updated on the platform where the Challenge is being held.