Trust and compliance

Built for European data sovereignty.

Kohtaa is designed for institutions that cannot compromise on data privacy. Here is exactly what we do, where your data goes, and what we do not do.

Send to your IT team

Last updated: July 14, 2026

Where your data lives

All Kohtaa data is stored exclusively within the European Union. No data is processed on, transferred to, or accessible from servers outside the EU/EEA.

Application infrastructure runs on Hetzner in Helsinki, Finland. Hetzner Online GmbH is a German company; Kohtaa specifically uses its Helsinki data centre for the application server and object storage. Hetzner is ISO 27001 certified.

The database is self-hosted MongoDB running on the same Hetzner infrastructure as the application server, not a third-party managed database service. There is no external database subprocessor: Hetzner's ISO 27001 certification covers the full stack, application and database alike.

Component	Provider	Location	EU-hosted
Application server	Hetzner VPS	Helsinki, Finland	Yes
Database (MongoDB)	Self-hosted (Hetzner VPS)	Helsinki, Finland	Yes
Object storage (images)	Hetzner Object Storage	Helsinki, Finland	Yes
Email delivery	Brevo	France	Yes
DNS	Namecheap	USA	DNS only*
Domain registrar	Namecheap	USA	Registrar only*

*DNS and domain registration do not involve processing personal data. Only the domain name resolution record is held, no attendee data.

What data we collect, and why

Attendee data

When an attendee joins an event on Kohtaa, we collect: name, email address, role, company, professional goal, and optionally a profile photo and short bio. This data is used solely to create their profile, visible only to other attendees at the same event and people they have previously connected with on Kohtaa.

Organizer data

Event organizers provide their name, email, and event details. This data is used to manage their events and communicate with them about their account.

Analytics data

Kohtaa operates an in-house analytics system that records page views and product events. No IP addresses, device identifiers, or user agent strings are stored. No cookies are set. No data is shared with any third party for analytics purposes.

What we do not collect

IP addresses, for ordinary product usage
Device identifiers or browsing history outside Kohtaa
Phone contacts or location data
Payment card data (Kohtaa does not process payments; invoicing is arranged directly)

One exception: the organizer upgrade-request form captures the submitting IP address, kept only to investigate abuse of that specific form (see the Data Processing Agreement section below).

Third-party services

Kohtaa uses the following third-party services. This list is exhaustive.

Service	Purpose	Location	Personal data shared
Hetzner	Application hosting, database, object storage	Helsinki, Finland	Yes, all product data is hosted here
Brevo	Transactional email	France	Email address, name
Google OAuth	Sign-in option	USA	Email address, name*
LinkedIn OAuth	Sign-in option	USA	Email address, name*
Namecheap	DNS, domain registration	USA	None (domain resolution only)

*Google and LinkedIn OAuth: when a user signs in with Google or LinkedIn, their name and email address are shared with that provider as part of the OAuth flow. Users who prefer not to use these providers can sign in with email and password instead, which shares no data with Google or LinkedIn.

Kohtaa uses no third-party analytics service. Page views and product events are recorded in-house (see the section above).

Your rights

Right to access(Article 15): download a copy of all data Kohtaa holds about you at any time, instantly, from the “Download my data” link in Account settings.
Right to erasure (Article 17): delete your account and all associated personal data at any time from Account settings. Deletion is immediate.
Right to portability(Article 20): the same “Download my data” export is provided as machine-readable JSON.
Right to rectification (Article 16): correct any inaccurate data directly in your profile settings.
Right to object (Article 21): contact privacy@kohtaa.com to object to specific processing, or lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

Contact: privacy@kohtaa.com for all data rights requests.

Cookies

Kohtaa does not use tracking cookies, advertising cookies, or analytics cookies.

We use one authentication cookie, set when you sign in. It identifies your session for up to 30 days or until you log out, whichever comes first. It does not track you across other websites and contains no personal information beyond an internal session identifier.

This is why Kohtaa operates with no cookie consent banner: the single cookie in use is strictly necessary for the service to function, which does not require consent under the ePrivacy directive.

Data Processing Agreement (DPA)

Organisations using Kohtaa to process personal data of their event attendees act as data controllers. Kohtaa acts as a data processor on their behalf.

A Data Processing Agreement is available on request for organisations that need one for procurement or compliance purposes. Contact hello@kohtaa.com to request one. We aim to turn around signed agreements within 5 business days.

Last updated: July 14, 2026

Questions about this documentation? Contact hello@kohtaa.com

Kohtaa is operated from Finland.