Privacy policy

Curtis Thomas, trading as Kohtaa, Oulu, Finland. Contact: curtis@kohtaa.com

When you sign in we store your name and email address. When you fill in your profile we also store your job title, company, industry, what you are looking for, a short bio, and an optional photo. Every meeting request, "Get in touch" request, confirmation, and endorsement you make is stored as part of the event connection record, including the short note you write on a "Get in touch" request. If you submit an organizer upgrade request, we additionally store the IP address it was sent from, for fraud and abuse prevention. The badge-printing station login is rate-limited by IP address, and the contact form by a hash of the IP address and the day; each counter is deleted automatically when its time window expires. If you use the Talk to us form, we store the name, work email, organization, role, expected event size, timing, topic and message you enter, and how you heard about Kohtaa if you say. We attach the page you sent it from, your language, and the visit details from your browser tab: the domain name of the site that referred you, any campaign tag in the link you arrived by, the page you landed on and the random id. We do not store your IP address with it. The form that sends you the procurement pack stores only the email address you give, with the same attachments. When you start as an organizer or place an order, we also keep a sales record with your name, email and organization so that we can follow up. An event organizer may also upload attendee names, email addresses and organisations from their registration system, so that Kohtaa can email each person an invitation to the event and fill in their name and company when they join.

Processing is based on legitimate interests (GDPR Article 6(1)(f)): connecting people at professional and networking events is the core purpose of Kohtaa, and storing the connection record is necessary to provide that service. You can withdraw at any time by deleting your account. The IP address captured on organizer upgrade requests is also processed under Article 6(1)(f), on the separate legitimate interest of preventing fraud and abuse of that form. So are the details you send through the Talk to us form: we use them only to reply, and we keep no marketing list.

Your name, role, company, and profile fields are visible to other attendees of the same event. The organizer of an event you join, and its co-organizers, can also see the attendee list with the profile fields you filled in, and can export it for running the event. If the organizer uses badge printing, the badge station receives your name, role and company. At open-networking events, you can send another attendee a "Get in touch" request with a short note. Only if they accept do the two of you see each other's account email address. Nothing else is shared before they accept, and nobody else, the organizer included, ever sees it. Organizers see aggregate meeting statistics. On private events, which is the default, individual meeting pairs are hidden from the organizer. We do not sell your data or share it with advertisers. We use the following processors:

• Hetzner Online GmbH (application hosting, database, and object storage, all in Finland) - all data stored on EU infrastructure, no third-party database subprocessor.
• Brevo (France) - transactional email for meeting notifications. Your email address is passed to Brevo only to deliver emails you have triggered.
• Google and LinkedIn (OAuth sign-in, optional) - if you choose to sign in with Google or LinkedIn instead of email and password, your name and email address are shared with that provider as part of the sign-in flow.
• Telegram Messenger Inc. (Telegram reminders, optional, outside the EU) - used only if you link your Telegram account for meeting reminders. Telegram then receives your Telegram chat id and the text of each notification we send you: meeting and "Get in touch" requests, replies, reminders and agenda changes. These include the other person's name, the event name, and the meeting time and place. If you do not link Telegram, nothing is shared with it. You can unlink it at any time from Account settings.

Kohtaa uses no third-party analytics services. We operate a minimal in-house analytics system that records page views and product events, without cookies. No IP addresses, user agent strings or device identifiers are stored. A page view records the page, the language, the domain name of the site that referred you and any campaign tag in the link you arrived by, under a random id that lives only in your browser tab. Nothing is stored on your device, and page views are not linked to any account. No data is shared with any third party for analytics purposes.

We keep your data until your account is erased. You can delete your account at any time from Account settings, and your personal data is erased when you confirm. You can also choose, when you sign up or later in Account settings, to have your account and personal data erased automatically 7 days after the last event you are attending ends. This is off unless you turn it on. If you join another event, the date moves with it. We email you 24 hours before, with a one-click way to stop it, and again once it is done. Erasure removes your name, email, photo, bio, messages, notes, ratings, event profiles, goals, profile views, invitations and sign-in tokens. An empty account record with nothing personal on it remains. So does an anonymous record that two people connected at an event: it carries no profile data, and it is kept because the other person's connection history is built on it. One record is kept in full: if you submitted an organizer upgrade request, that request keeps the name, email address and IP address it was sent with, as the record of a request for an invoice and for fraud prevention, even if the submitting account is later deleted. Names, email addresses and organisations an organizer uploads from their registration system are kept only as long as the invitation needs them: for a person who joins, the uploaded name and organisation are deleted when they join and the email address 7 days after the event ends. For a person who never joins, the whole record is deleted 7 days after the event ends. What remains of a joined record is only that an invitation to that event led to someone joining, with no name or email address. Details sent through the contact form are kept while the conversation is open and for 24 months after the last contact, and deleted sooner if you ask at curtis@kohtaa.com.

Under GDPR you have the right to:

• Access all data we hold about you - use the "Download my data" link in Account settings (Article 15).
• Erasure delete your account from Account settings at any time, or choose to have it erased automatically 7 days after your last event. All your personal data is erased. An anonymous record that two people connected at an event is kept, with no profile data on it (Article 17).
• Portability your data export is provided as machine-readable JSON (Article 20).
• Rectification update your profile at any time from your profile settings.
• Objection or complaint contact us at curtis@kohtaa.com or lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).