Privacy notice

Version 2026-08-22. Advisory Commons is a pilot programme; we may update this notice as it develops, and will change the version above when we do.

Who is responsible for your data

The controller is UNICEF Office of Innovation, St. Eriksgatan, Stockholm, Sweden. For any privacy question or to exercise your rights, contact Gerben Kijne, gkijne@unicef.org.

This notice explains how the Advisory Commons advisory programme collects and uses the personal data of the people who take part in it — advisors, members of a startup's own team, and observers who join a challenge group.

What we collect

• Your profile, which you provide when you sign up: name, email, headline or bio, areas of expertise, sectors, interests, timezone, availability, LinkedIn URL, and organisation.
• Your contributions to the group chat: the content of the messages you send in your challenge's linked group chat (Telegram or Slack). We only ingest and store messages from consented advisors and startup participants. Observers' messages, and messages from anyone who has not consented, are discarded and never stored or summarised.
• Participation records: which group you're in, your role, your acceptance status, and a record of the consent you gave (date and version).

How we use it, and our lawful basis

Our lawful basis is your consent, which you give when you sign up and when you connect your account to the group chat. You can withdraw it at any time (see Your rights). On that basis we use your data to:

1. Run the programme — match you into a multidisciplinary group, coordinate the sprint, summarise the group's progress using AI, and produce a report that we share with the startup.

2. Learn from the programme — produce anonymised and aggregated insights, case studies, and reporting for UNICEF and its programme partners about how this model works and the impact it has.

3. Stay in touch — contact you about the programme, your group's results, and future cohorts.

We do not sell your data, we do not use it to train AI models, and we do not use it to build unrelated products.

How the AI summarisation works

Before any message is sent to our AI provider for summarisation, it is pseudonymised (you appear as "Advisor 1", "Startup team", and so on — never by name) and stripped of personal identifiers (names, emails, phone numbers, handles). Our AI provider processes this under terms that prohibit training on the data.

Who we share it with

• The final report for each challenge is shared with the startup, the participants in that group, and the UNICEF Office of Innovation team running the programme.
• Service providers that process data on our behalf, under data-processing agreements: Amazon Web Services (hosting, database and programme email), AWS Bedrock running Anthropic's Claude models (AI summarisation — pseudonymised, redacted text only), Slack or Telegram (group-chat transport), and Auth0 (sign-in for the UNICEF staff who operate the programme — this does not process advisor or participant data).

Where your data is processed

Everything we control is processed in the EU (Frankfurt, eu-central-1): the database, the application, programme email, and AI summarisation, which runs on a European inference profile so the text never leaves the region.

The exception is the group chat itself, which is hosted by Slack or Telegram under their own terms and may be processed outside the EEA. Where any transfer outside the EEA occurs it is covered by appropriate safeguards such as the EU Standard Contractual Clauses.

How long we keep it

• Group chat content and interim (progress) summaries are kept for the sprint and then deleted within 30 days after your group gives its final presentation. After that, only the final report is kept.
• The final report is retained by the UNICEF Office of Innovation as a record of the programme.
• Your profile is kept while you take part in the programme. We delete it on your request, or when the pilot ends.

Your rights

You have the right to access, correct, erase, restrict, port, and object to the processing of your data, and to withdraw your consent at any time. Withdrawing consent doesn't affect processing that already happened. To exercise any of these, contact Gerben Kijne, gkijne@unicef.org — the team can export or erase your data on request. You may also complain to a data-protection supervisory authority (in Sweden, the Integritetsskyddsmyndigheten (IMY)).

Changes

We'll update this notice and its version number whenever our processing changes.