Trust and compliance
Built for European data sovereignty.
Kohtaa is designed for institutions that cannot compromise on data privacy. Here is exactly what we do, where your data goes, and what we do not do.
Buying for a public organization? The procurement pack has the supplier details, prices and checklist answers on one page.
Last updated: October 9, 2026
Where your data lives
All Kohtaa data is stored exclusively within the European Union. The only personal data sent outside the EU/EEA is what an attendee chooses to share with an optional service: Google or LinkedIn sign-in (name and email) or Telegram reminders, listed under Third-party services below.
Application infrastructure runs on Hetzner in Helsinki, Finland. Hetzner Online GmbH is a German company; Kohtaa specifically uses its Helsinki data centre for the application server and object storage. Hetzner is ISO 27001 certified.
The database is self-hosted MongoDB running on the same Hetzner infrastructure as the application server, not a third-party managed database service. There is no external database subprocessor: the application and the database both run in Hetzner's Helsinki data centre, which is within the scope of Hetzner's ISO 27001 certification. Kohtaa itself holds no certification.
| Component | Provider | Location | EU-hosted |
|---|---|---|---|
| Application server | Hetzner VPS | Helsinki, Finland | Yes |
| Database (MongoDB) | Self-hosted (Hetzner VPS) | Helsinki, Finland | Yes |
| Object storage (images) | Hetzner Object Storage | Helsinki, Finland | Yes |
| Email delivery | Brevo | France | Yes |
| DNS | Namecheap | USA | DNS only* |
| Domain registrar | Namecheap | USA | Registrar only* |
*DNS and domain registration do not involve processing personal data. Only the domain name resolution record is held, no attendee data.
What data we collect, and why
Attendee data
When an attendee joins an event on Kohtaa, we collect a name and an email address, and optionally a role, company, professional goal, profile photo and short bio. This data is used solely to create their profile, which is visible to other attendees at the same event and people they have previously connected with on Kohtaa. The event organizer and co-organizers can also see the attendee list with those profile fields and export it for running the event. Where the organizer uses badge printing, the badge station receives the attendee's name, role and company. At open-networking events, an attendee can send another a "Get in touch" request; only once it is accepted do the two of them see each other's account email address, and nobody else does. Organizers see aggregate meeting statistics; on private events, the default, individual meeting pairs are hidden from the organizer.
Organizer data
Event organizers provide their name, email, and event details. This data is used to manage their events and communicate with them about their account.
Analytics data
Kohtaa operates an in-house analytics system that records page views and product events. It sets no cookies and stores no IP address, user agent or device identifier. A page view records the page, the language, the domain name of the site that referred you (for example google.com) and any campaign tag in the link you arrived by, under a random id that lives only in your browser tab and is gone when you close it. Nothing is stored on your device, and page views are not linked to any account. No data is shared with any third party for analytics purposes.
What we do not collect
- IP addresses, for ordinary product usage
- Device identifiers or browsing history outside Kohtaa
- Phone contacts or location data
- Payment card data (Kohtaa does not process payments; invoicing is arranged directly)
Two exceptions: the organizer upgrade-request form captures the submitting IP address, kept only to investigate abuse of that specific form (see the Data Processing Agreement section below). The badge-printing station login is rate-limited by IP address, and that counter is deleted automatically when its time window expires. The contact form's rate-limit counter is a hash of the address and the day, not the address itself, and is deleted automatically in the same way.
Third-party services
Kohtaa uses the following third-party services. This list is exhaustive.
| Service | Purpose | Location | Personal data shared |
|---|---|---|---|
| Hetzner | Application hosting, database, object storage | Helsinki, Finland | Yes, all product data is hosted here |
| Brevo | Transactional email | France | Email address, name |
| Google OAuth | Sign-in option | USA | Email address, name* |
| LinkedIn OAuth | Sign-in option | USA | Email address, name* |
| Namecheap | DNS, domain registration | USA | None (domain resolution only) |
| Telegram | Meeting reminders and notifications (optional, only if the attendee links Telegram) | Outside the EU | Chat id, notification text (other attendee's name, event, meeting time and place) |
*Google and LinkedIn OAuth: when a user signs in with Google or LinkedIn, their name and email address are shared with that provider as part of the OAuth flow. Users who prefer not to use these providers can sign in with email and password instead, which shares no data with Google or LinkedIn.
Kohtaa uses no third-party analytics service. Page views and product events are recorded in-house (see the section above).
Your rights
- Right to access (Article 15): download a copy of all data Kohtaa holds about you at any time, instantly, from the "Download my data" link in Account settings.
- Right to erasure (Article 17): delete your account and all associated personal data at any time from Account settings, or choose automatic erasure 7 days after your last event. An anonymous record that two people connected at an event is kept, with no profile data on it.
- Right to portability (Article 20): the same "Download my data" export is provided as machine-readable JSON.
- Right to rectification (Article 16): correct any inaccurate data directly in your profile settings.
- Right to object (Article 21): contact curtis@kohtaa.com to object to specific processing, or lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
Contact: curtis@kohtaa.com for all data rights requests.
Cookies
Kohtaa does not use tracking cookies, advertising cookies, or analytics cookies.
The only cookies Kohtaa sets are the ones needed to sign you in and keep you signed in: a session cookie that identifies you for up to 30 days or until you log out, whichever comes first, and two short-lived cookies the sign-in form uses to protect the request. A visitor who does not sign in gets no cookie at all. None of them tracks you across other websites or contains personal information beyond an internal identifier.
This is why Kohtaa operates with no cookie consent banner: every cookie in use is strictly necessary for signing in, which does not require consent under the ePrivacy directive.
Data Processing Agreement (DPA)
Kohtaa is the data controller for the personal data of attendees and organizers, as named in the privacy policy. An organisation that needs to hold the controller seat for its own event can request a Data Processing Agreement, under which Kohtaa acts as a data processor on its behalf.
A Data Processing Agreement is available on request for organisations that need one for procurement or compliance purposes. Contact curtis@kohtaa.com to request one. We aim to turn around signed agreements within 5 business days.
Last updated: October 9, 2026
Questions about this documentation? Contact curtis@kohtaa.com
Kohtaa is operated by Curtis Thomas, trading as Kohtaa, Oulu, Finland.