Privacy statement

Who is responsible

kopula is run by Kwantor B.V., Kampenringweg 45 D, 2803PE Gouda, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 97698482. Kwantor B.V. is the controller for the processing described here: it decides how kopula works, what it stores and when it deletes it.

The organiser of an event decides to run a kopula list at their event and invites the people who scan for it. The organiser can see and manage that event's list.

For questions or requests about your data, write to kopula@kwantor.com. This statement covers kopula only. kwantor's other services have their own privacy policy on kwantor.com.

What kopula stores

What kopula stores depends on how you use it.

If you are scanned at an event

The link to your LinkedIn profile, read from the QR code you show. A name derived from that link, until you enter your own. The name and short tagline you add, if you add them. Who scanned you and when. If you open your personal link, the people you tick as "connected" on the list.

If you scan for an event

The name you enter, the link to your LinkedIn profile if you add it, and the scans you make.

If you organise an event

Your email address, the name and optional LinkedIn link you show on the event, and the event's name and settings.

If you leave your email address

Your email address, which of your list entries and scanner roles it is linked to, and whether a reminder was sent or you stopped the mails. This is optional for people who are scanned and for scanners.

When you use the site

Security logs to prevent abuse, such as repeated attempts to guess a PIN, kept for at most a day.

kopula fetches nothing from LinkedIn: no name, photo or headline. It sends nothing to LinkedIn and never signs in to it. It does not use analytics, tracking or advertising.

Please do not enter sensitive information, such as health data or political views, in your name or tagline.

kopula is not meant for people under 18. Do not scan or add anyone under 18.

Why kopula uses your data, and on what basis

• To put you on an event's list and show you to the others on it: your consent (GDPR article 6(1)(a)). You give it by showing your LinkedIn QR code to a scanner after the notice on their screen, or by joining as a scanner after the notice on the join page.
• To sign you in by email, show "Your kopula events" and send at most one reminder per event before its list is deleted: your consent, given when you leave your email address.
• To let an organiser create and manage an event and sign in: the agreement with the organiser to provide kopula (article 6(1)(b)).
• To keep kopula secure and limit abuse: kwantor's legitimate interest in a working, safe service (article 6(1)(f)).

You can withdraw your consent at any time, as described under "How to remove your data". Withdrawal does not affect what was done before it. kopula does not make decisions about you by automated means.

Who can see your data

• Everyone with the event's list link, plus the PIN if the organiser set one, sees the name, tagline and profile link of each person on the list, and who scanned them.
• A scanner's name, and LinkedIn link if added, is shown to the people they scan and on the list.
• The organiser sees the list and the scanners, and can remove entries.
• Your email address is never shown on a list or to the organiser of an event you were scanned at. Only you and kwantor see it.
• The service providers below process data on kwantor's behalf.

kwantor does not sell your data, does not share it with LinkedIn and does not use it for marketing. kwantor may disclose data when the law requires it, for example on a court order.

People on a list can open your LinkedIn profile from it. What happens on LinkedIn, such as a connection request, is between you and them under LinkedIn's own terms and privacy policy.

Service providers

kopula uses a hosting provider, a database provider and an email delivery provider, each bound by a data processing agreement. They process data only on kwantor's behalf and under kwantor's instructions.

These providers keep technical logs for a short period to run and secure their service. kopula's emails contain no tracking.

A current list of providers is available on request at kopula@kwantor.com.

Transfers outside the EU

Your data is stored in the EU. Some of these providers may process data outside the European Economic Area; where they do, we rely on an adequacy decision or the European Commission's standard contractual clauses.

How long kopula keeps data

• An event's list, with everyone on it, its scanners, scans and "connected" ticks, is deleted on the event's deletion date: at most 30 days after the event was created. The date is shown on the list.
• Removing an entry deletes it at once and completely. Nothing about it is kept.
• Sign-in links expire after a few minutes. A sign-in lasts 30 days from your last visit.
• An account (an email address) is deleted after 90 days if it has no events, no sign-in and nothing linked to it.
• Security logs to prevent abuse are kept for at most a day.

Database backups are kept for a limited period and then overwritten, so deleted data also disappears from them.

Cookies and local storage

kopula only uses functional cookies and local storage that it needs to work: to keep you signed in, to give you access to the lists you are on or scan for, and to remember choices like light or dark mode and which people you have ticked. They are not used for tracking or analytics, and nothing is shared with third parties. If you delete them in your browser, you will need to sign in or open your link again.

Security

kopula uses encrypted connections, and its links are long random codes that cannot be guessed. A list link is not passed on to LinkedIn when you open a profile. No method of storage or transmission is fully secure, but kwantor takes reasonable measures to protect your data.

Anyone with a list link, and its PIN if one is set, can see the list. Share it only with the people at the event. If a link was shared too widely, the organiser can replace it.

Your rights

Under the GDPR you have the right to:

• access the personal data kopula holds about you and get a copy of it;
• have incorrect data corrected;
• have your data deleted;
• restrict or object to processing;
• receive data you provided in a machine-readable format;
• withdraw your consent at any time;

and to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or the authority where you live.

To use these rights, write to kopula@kwantor.com. kwantor may ask you to show that the data is yours, for example by writing from the email address or showing the profile link concerned, and replies within one month. That period can be extended by two months for complex requests.

How to remove your data

• Your entry on a list: open your personal link (the QR code you were shown when you were scanned) and remove it. It is deleted at once and completely. Lost your link? Ask the organiser, or write to kwantor.
• Reminder mails for an event: use the stop link in the mail.
• Your account: sign in and use "Delete my account" on Your events. Your email address is deleted, and so are the events you organise with their lists. You can also choose to be removed from every list you are on: your entries are then deleted, and where you scanned at someone else's event, your name and profile link are removed and you are shown as "Removed scanner". Otherwise your entries and scanner roles stay on their lists, no longer linked to you, until you remove them or the list is deleted.

Being scanned again after you removed yourself puts you back on the list, as a new choice.

Changes to this statement

kwantor may update this statement. The "Last updated" date at the top shows the current version. If a change matters to how your data is used, kwantor says so on kopula, and by email to people who left their address, before it takes effect. See also the terms of use.

Contact

Kwantor B.V., Kampenringweg 45 D, 2803PE Gouda, the Netherlands.

Email: kopula@kwantor.com.