What procurement and data-protection reviewers usually ask
Kohtaa is supplied by Curtis Thomas, trading as Kohtaa, in Oulu, Finland. Prices are published, orders are placed online and paid by invoice, and the application, database and images are hosted in Helsinki. Everything below is readable without giving an email address.
By Curtis Thomas, last reviewed
Who supplies Kohtaa?
Curtis Thomas, trading as Kohtaa, Oulu, Finland. Invoices are issued for Kohtaa; the invoicing party's business ID appears on the invoice.
How do we order, and when are we invoiced?
You place the order online, and you choose whether the invoice comes before or after the event. Payment is due within 14 days of the invoice date.
Create your event, choose Medium or Large on its page and submit the order. The order form asks for your organization's legal name, business ID and billing contact, and optionally a purchase order or reference and an e-invoice address. The event can go live as soon as the order is submitted, and Curtis reviews each order afterwards.
Every order is paid by invoice. We do not take card payments. There is no long-term contract. The annual plan is arranged through the contact form below.
What does it cost?
Medium is 100 EUR per event, up to 100 attendees. Large is 950 EUR per event, with no attendee limit. Annual is 3,900 EUR per year, with unlimited events and no attendee limit. All prices include VAT.
The published price is the invoice total. Attendees never pay.
For reference, hankinnat.fi gives the national threshold for goods and services in the Finnish Public Procurement Act (hankintalaki, section 25) as 60,000 EUR excluding VAT. Whether an order of this size needs a competitive tender is for your organization to decide under its own rules.
Where is the data stored, and who processes it?
The application, the database and uploaded images are on Hetzner servers in Helsinki, Finland. Personal data is stored only in the EU.
- Application server: Hetzner, Helsinki, Finland.
- Database: MongoDB, self-hosted on the same Hetzner server in Helsinki. There is no external database provider.
- Images: Hetzner Object Storage, Helsinki, Finland.
- Email delivery: Brevo, France.
- DNS and domain registration: Namecheap, USA. They handle the name resolution record only, no attendee data.
- Optional services: signing in with Google or LinkedIn sends the person's name and email address through that provider, and Telegram meeting reminders, which a person can link themselves, are sent outside the EU. These are the only cases where personal data leaves the EU.
Hetzner holds ISO/IEC 27001:2022 certification, and its Helsinki data centre is within the certified scope. Kohtaa itself holds no certification.
Who is the data controller, and do we need a DPA?
For a pilot where your organization collects no personal data itself, Kohtaa (Curtis Thomas, trading as Kohtaa) is the data controller, so a data processing agreement is not part of that arrangement. Your own data-protection team decides whether that fits.
The legal basis is legitimate interests, GDPR Article 6(1)(f), as the privacy policy states. If your organization needs the controller seat for its own event, a data processing agreement is available on request, with Kohtaa as the processor.
How does Kohtaa answer the pilot privacy checklist?
Here are short answers to the seven items of a pilot privacy checklist that a public buyer sent us. The full document, with the place to check each statement, is available on request.
These answers describe what the product does. They are not a statement that Kohtaa complies with any law or checklist: that judgement is for your reviewers.
1. A privacy notice is in place and kept up to date
The privacy policy is published at kohtaa.com/privacy, with a Finnish version, and the trust page covers hosting, third parties and rights. English and Finnish copy are checked against each other on every build, and every public factual claim is checked against an internal register before it ships. That is an internal working rule, not an external audit.
2. Participants are told who is responsible for their data
Every event's join form names the controller, Curtis Thomas trading as Kohtaa, and links to the privacy policy before a person joins. The privacy policy and the site footer name the controller too.
3. Only data that is needed is collected
To take part, a person gives an email address to sign in and a name to join. Everything else is optional, unless the organizer makes the person's archetype (for example Founder or Investor) or what they are looking for required. The organizer can hide company, industry and stage, and a person can switch on an anonymous profile.
4. Data subjects can exercise their rights
Most rights are self-service from the account page: a one-click download of everything held about the person (GDPR Articles 15 and 20), profile editing, and erasure on request after one confirmation. Erasure removes the personal data; an anonymous record that two people connected at an event remains. Notification emails and Telegram messages can be switched off, and objections go to curtis@kohtaa.com or to the Data Protection Ombudsman. The account page is currently in English only.
5. Consent can be withdrawn where consent is the basis
Consent is not the legal basis, legitimate interests is. A person can still end the processing by deleting their account, leaving an event, switching off notifications or disconnecting Telegram.
6. Real personal data in testing is justified and documented
Kohtaa runs one production database and has no separate test environment. Events created for testing are tagged as test events, use synthetic accounts on undeliverable addresses, and are skipped by every scheduled email.
7. Participants are told the purpose and how their data is processed
The organizer can write a data notice for the event, in English and optionally Finnish, up to 600 characters each. It is shown above the Join button, on the public event page before sign-in and on the attendee's event overview, and it can be edited after the event is published.
What does an attendee see, and what does the organizer see?
Attendees see each other's profiles at the same event. The organizer sees the attendee list and aggregate numbers, and by default never who is meeting whom.
What an attendee sees
An attendee sees the profiles of the other attendees at the same event and of people they have connected with before, limited to the fields those people chose to fill in. If one person asks to get in touch and the other accepts, the two then see each other's account email address and profile links. Nobody else sees them, and the organizer does not.
What the organizer sees
The organizer and co-organizers see the attendee list with the profile fields filled in, and can export it as a CSV. They see aggregate meeting numbers and per-attendee counts. On a private event, which is the default, meeting pairs stay private: they see which slots are booked and whether each booking is confirmed, not who is meeting whom. The organizer can also write the data notice described in item 7 above.
What support do we get?
One inbox: curtis@kohtaa.com. Curtis replies within one business day.
A 30-minute security review call is available on request. Kohtaa does not offer a service level agreement or out-of-hours support.
How many attendees can it handle?
300 concurrent attendees at a single event, measured on live production with a mixed workload.
The Large and Annual tiers have no attendee limit in the licence. That is a licensing statement, not a performance guarantee. If your event will have more than 300 people using Kohtaa at the same time, talk to us first.
Supplier summary you can paste into your form
A short block for your own supplier or procurement form.
Supplier summary
Supplier: Curtis Thomas, trading as Kohtaa, Oulu, Finland. Invoices are issued for Kohtaa; the invoicing party's business ID appears on the invoice.
Hosting: application, database and images on Hetzner in Helsinki, Finland (Hetzner holds ISO/IEC 27001:2022, Helsinki in scope; Kohtaa itself holds no certification). Email delivery by Brevo, France. Data is stored only in the EU; optional Google or LinkedIn sign-in and Telegram reminders send data outside it.
Prices: Medium 100 EUR per event (up to 100 attendees), Large 950 EUR per event (no attendee limit), Annual 3,900 EUR per year. VAT included.
Invoicing: order placed online; invoice before or after the event as the buyer chooses; payable within 14 days of the invoice date; business ID required; invoice only, no card payments; no long-term contract.
Data controller: Kohtaa (Curtis Thomas, trading as Kohtaa) for pilots where the buyer collects no personal data. A data processing agreement is available on request if the buyer needs the controller seat. Your reviewers decide whether this suffices.
Support: curtis@kohtaa.com, reply within one business day, 30-minute security review call on request. No SLA.
Capacity: 300 concurrent attendees at a single event, measured on live production.
Common procurement questions
Do we need to sign a contract?
There is no long-term contract. You place an order online and accept the order terms shown on the order form, and the order is paid by invoice.
Can you invoice after the event?
Yes. When you order you choose whether the invoice comes before or after the event. Payment is due within 14 days of the invoice date.
Do you need our business ID?
Yes. The order form asks for your organization's legal name, business ID and billing contact, and the invoice cannot be sent without them.
Is Kohtaa ISO 27001 certified?
No. Kohtaa itself holds no certification. Its host, Hetzner, holds ISO/IEC 27001:2022 certification, and the Helsinki data centre where Kohtaa runs is within the certified scope.
Can we get the full checklist document?
Yes, on request. Write to curtis@kohtaa.com or use the form below. It describes the product item by item and says where each statement can be checked.
Can we pay by card?
No. Every order is paid by invoice.
Send this pack to my inbox
We email you a link to this page and the supplier summary above. One field, nothing else.
Questions about your paperwork?
Tell us what your procurement or data-protection team needs, and Curtis will reply.