GDPR for event networking apps: what a public buyer checks

A public buyer that wants to try an event networking app has a short list of data-protection questions to settle first: who the controller is, what attendees are told, what is collected, how rights work, on what legal basis, how testing is done, and how the pilot's purpose is explained. This article takes those seven in turn, says what to ask any vendor, and gives Kohtaa's own answers.

Some public organisations handle a pilot with a short vendor checklist instead of a full impact assessment, when the organisation itself collects no personal data. Check with your own data-protection officer whether that route is open to you. The questions below fit either route.

Full answers are on the procurement page; the policy is at /privacy.

Who is the controller when a city runs a pilot?

The controller is whoever decides why and how the personal data is processed. If your organisation only hosts the event and collects no personal data itself, the vendor is the controller, and you do not need a data processing agreement. That is Kohtaa's position for pilots of this kind.

For a pilot where the buyer collects no personal data, the controller is Curtis Thomas, trading as Kohtaa, Oulu, Finland, and the privacy policy at /privacy governs. There is no DPA in that case, because you are not a controller of the attendees' data and so have nothing to instruct a processor about.

Some buyers still need the controller seat, for example because their policy requires a signed agreement with every supplier. A DPA template is available on request. Ask any vendor to name the controller in one sentence, with a legal name. If the answer is vague, the rest of the checklist will be too.

Is there a privacy notice attendees see before they join?

An attendee should read who is responsible for their data before they give it. On Kohtaa, the last step of every event's join form names the controller and links to the privacy policy, and the organizer can add their own notice for the event, which is shown on the join step and on the public event page.

Ask any vendor where the notice appears, whether it appears before the person submits anything, and whether the organizer can add event-specific wording. A footer link does not answer the question.

On Kohtaa the per-event data notice is written by the organizer, in English and optionally in Finnish, up to 600 characters each. It appears on the join step above the Join button, on the public event page that can be read before signing in, and on the attendee's event overview after joining. It stays editable after publishing, so wording that comes back from a data-protection review can be pasted in later.

Is every field necessary?

Collect only what the pilot needs. A good answer lists what is required and shows that everything else is optional. On Kohtaa, an email address is needed to sign in and a name is needed to join. Everything else can be left empty, unless the organizer chooses to make a field required for their event.

The organizer can make only two profile fields required: what kind of attendee someone is (for example Founder or Investor) and what they are looking for. The organizer can hide company, industry and stage from the event. An attendee can also choose to appear anonymously.

Ask the vendor for the field list in a table, with required or optional beside each field. Ask about things nobody mentions: profile photo links from sign-in providers, page views, device identifiers. Kohtaa stores a provider's photo link if someone signs in with Google or LinkedIn, and the person can remove it on the join form. Page views of signed-in users are recorded for in-house product analytics with a user id and the page path, with no IP address, user agent or device identifier.

How do attendees exercise their rights?

Rights should be self-service and one or two clicks, with the limits stated honestly. On Kohtaa, an attendee can download a full export of the data held about them in one click, correct their profile, erase their account on demand, switch off notifications, and object by email.

The export is a single JSON file covering the account, attendances, meeting requests, messages, connection records, notes and more. Erasure removes every piece of personal data: name, email, photo, bio, messages, notes, ratings and the per-event profile. An attendee can also choose automatic erasure 7 days after the last event they attend, with a warning 24 hours before and one click to cancel.

Here is the honest limit, and it is the question to push on with every vendor: what survives erasure? On Kohtaa, an anonymous record that two people connected at an event survives, carrying ids, counts and dates and no profile data, because the other person's connection history rests on it. Nobody loses a connection because someone else exercised their rights. Backups are not covered by any retention claim. A vendor who says "everything is deleted" has not looked closely.

Complaints go to the Data Protection Ombudsman (tietosuoja.fi); objections go by email to the controller.

What is the legal basis, and when is consent needed?

The legal basis is the reason the processing is lawful. Kohtaa relies on legitimate interests under GDPR Article 6(1)(f): connecting people at professional and networking events is the purpose, and the connection record is needed to provide it. Consent is not the basis, and no consent record is stored.

Many checklists ask whether participants can withdraw consent where consent is the basis. If consent is not the basis, the item does not apply as written, but the routes that do the work of withdrawal exist: objection by email, erasure from the account page, leaving an event, switching off each type of notification, an anonymous-profile switch, and disconnecting Telegram.

Do not accept "we are GDPR compliant" as a vendor's answer. Compliance is a conclusion you reach, not a statement they make. Ask for the legal basis by article number. Kohtaa does not state that it is compliant with anything; it describes what the product does so that your reviewer can reach their own conclusion.

Is real data used for testing?

If real people's data is used in testing, the use should be justified and controlled. The better answer is that tests use synthetic data. On Kohtaa, events created for testing are tagged as test events, use synthetic accounts on undeliverable domains, and are excluded from every scheduled email.

Ask any vendor whether tests and real events share a database, and how they are separated. Kohtaa runs one production database, so the separation is by tagging: test events are marked at creation, test accounts use reserved domains that cannot receive mail, and every scheduled job skips them.

For a pilot, the cleanest arrangement is a review event with synthetic data, where the only real personal data is the reviewers' own logins, deleted afterwards by agreement. Put that in writing before the review starts.

How are attendees told what the pilot is for?

Attendees should read, at the point of joining, why the pilot exists and what happens to their data. The tool should let the organizer write this in their own words. On Kohtaa, that is the per-event data notice, shown before the Join button and on the public event page.

Three plain sentences are enough: who runs the event, what the tool is for (helping attendees find and meet each other), and what the organizer sees.

Be exact about what the organizer sees. The organizer and co-organizers see each attendee's profile and can export name, role, company and goal. On a private event, which is the default, they see meeting counts and which slots are booked, but not who is meeting whom. "Get in touch" requests reveal contact details only to the other person, and only if they accept.

If you are preparing a pilot now, the procurement page has a supplier summary you can paste into your own forms, and the trust page lists where data is stored. If a registration system is involved, Registration data, Lyyti and your networking tool explains who holds what. To ask a question, contact us.