Privacy policy

Who processes your data, and in what capacity

The Kwabo platform is published by Trida Luxembourg (RCS Luxembourg B280378).

How the roles are split matters, because it determines whom you should address. For event data (your registration, your pass, your access scans, your networking profile, your exchanges with exhibitors), the event organiser decides the purposes: they are the controller, and Trida acts on their behalf as processor. For platform account data and the technical logs required to run and secure the service, Trida is the controller.

In practice you may write to Trida in every case: a request that falls to the organiser is passed on to them, and you are told so.

What data is processed, surface by surface

The platform does not collect the same data depending on what you do with it. The list below follows your actual journeys.

• Registering for an event: title, last name, first name, email address, organisation, job title, country, phone number where you provide one, and the additional fields the organiser defined for their event (your industry, for instance).
• Pass and ticket: a ticket identifier and a signed QR code, which carries the ticket identifier, the event identifier and the zones it grants access to. If you add the pass to an Apple or Google wallet, the registered device identifier is kept so the pass can be updated.
• Access control: on every scan, the date and time, the checkpoint, the zone and the identifier of the scanning device.
• Networking between attendees: only if you explicitly consent. Your job title, industries, what you are looking for and what you offer, your meeting requests and their qualification, the slots booked, and the messages exchanged are then processed.
• Relations with exhibitors: when an exhibitor scans your badge or a meeting takes place, they receive a contact record. Exports handed to exhibitors are limited to the data needed for that introduction.
• Payment: the amount, the order reference, the operator reference, the transaction status and its timestamps. No bank card details pass through Kwabo or are stored there, and you are never asked for a payment account identifier: entry takes place at the payment operator. The notification the operator then sends back to us is kept as received, solely for technical diagnosis of the payment; it may contain the mobile money phone number or the payer name, and it is erased after ninety days.
• Operation and security: access logs containing your IP address and a timestamp, session identifiers, and your device notification token if you accept notifications from the mobile app.
• Anti-bot check: when a public form on this site is submitted (registration, payment), an automated check tells a person apart from a program. It reads technical signals from your browser, including your IP address, and sets no advertising tracking cookie.

Why this data is processed, and on what basis

Each processing operation serves a specific purpose and rests on an identified legal basis.

• Carrying out your registration, issuing your pass and admitting you to the event: necessary to perform the contract between you and the organiser.
• Keeping you informed about the event (programme, room changes, announcements): necessary to perform that same contract.
• Listing you in the networking directory, sending notifications to your device, or sending you communications unrelated to your registration: your consent, which you may withdraw at any time.
• Securing the platform, preventing access control fraud and protecting public forms against automated submissions: legitimate interest of the publisher and the organiser.
• Keeping payment records: legal accounting retention obligation.

How long it is kept

Unless stated otherwise, the periods below run from the end of the event concerned.

• Registration data, pass and access scans: three years after the end of the event, so the organiser can prepare later events and answer a complaint. At the end of that period, your identity is anonymised automatically: your name, contact details, photo and answers are erased, and only the pass, the access scans and the order remain, with nothing that identifies you, for the accounting and statistics of the event.
• Networking profile: until you withdraw your consent, which removes you from the directory at once and cancels your pending meeting requests. Meetings already confirmed remain until the end of the event, then your messages and requests are anonymised. Three years at the latest.
• Answers to questions about your health or beliefs (dietary needs, accessibility) that the organiser has marked as sensitive: saved only if you consent with a dedicated box, reserved for the organiser’s administrator, deleted thirty days after the end of the event.
• Contact records passed to exhibitors: their retention then falls to the exhibitor, who becomes the controller and must tell you their own periods.
• Accounting records relating to payments: ten years, in line with legal retention obligations. Those records are limited to the payment provider, the transaction reference, the amount, the currency, the status and its timestamps: they contain no personal data.
• Raw notification sent by the payment operator, kept solely for technical diagnosis of the payment: ninety days from the moment it is received, then erased automatically. It may contain the mobile money phone number or the payer name as the operator transmits them; after that period only the accounting records described above remain.
• Pass and badge as PDF files, prepared to be sent to you: thirty days at most after they are produced, then erased automatically. They are produced again on request if you reopen your link, and erased without delay if you ask for your data to be erased or if your name changes.
• Registration attempt sent by a partner’s website, kept so the organiser can follow up if it did not complete: thirty days from receipt, then automatic deletion.
• Technical message-sending queue (emails, notifications): a completed send is deleted twenty-four hours after it is processed.
• Platform audit trail (which account performed which action, and when): thirteen months, then automatic erasure.
• Hosting provider technical logs, which contain IP addresses: seven days. Technical error reports: ninety days at most.
• Database backups, used to restore it after an incident: three days for continuous restore, and about one week for the copies taken before each platform update, then erased by the hosting provider. Data that is erased or anonymised therefore also disappears from backups within that period.

Who else has access

The platform relies on technical providers, which act only on instruction and do not reuse your data for their own purposes. Your data is never sold, nor passed on for advertising.

• Hosting of the platform and the database: Render, in a data centre located in the European Union (Frankfurt).
• Delivery, network protection, anti-bot verification of public forms (Cloudflare Turnstile) and document storage (PDF passes, images): Cloudflare.
• Payment collection: PayDunya for mobile money and cards in West Africa, Stripe for international cards.
• Email delivery: Resend.
• Sign-in codes by SMS: Twilio or EasySendSMS, depending on the provider the platform has chosen. It receives your phone number and the message carrying your code, in order to deliver it to you, and nothing else.
• Machine translation of event content: DeepL, or a language model from Anthropic (Claude) or OpenAI, depending on the service the platform has chosen. It receives only the texts the organiser wrote for their event that must appear in the other language, including the job title and biography of speakers, which often carry their name. Those texts are entrusted to it solely to produce a translation, which the organiser can then correct; no registration data and no attendee data is sent to it.
• Notifications on your device: Firebase Cloud Messaging (Google) for Android, Apple Push Notification service for iOS.
• Passes in Google Wallet: Google. When you add your pass to Google Wallet, Google receives your name as it appears on the pass, the pass number and type, the zones it grants access to and its signed QR code, together with the event name, dates and artwork, in order to display the pass in your wallet. Afterwards, whenever the pass changes (new code, new artwork), the platform sends Google its number, type and QR code to keep it up to date, and only for a pass whose addition to Google Wallet was requested.
• Application error monitoring: Sentry.
• The organiser of the event you attend, and the exhibitors you choose to engage with.

Anti-bot verification of forms

The public forms on this site are protected by Cloudflare Turnstile, in invisible mode: the check runs in the background, with no puzzle, no checkbox and nothing asked of you. Its only purpose is the security of the service: preventing an automated program from creating registrations, orders or messages in bulk.

To do so, Cloudflare analyses technical signals from your browser: your IP address, the fingerprint of the secure connection, the browser identification, the public identifier of the widget and the domain visited. Those signals serve only to tell a person apart from a program. They are not used for advertising, no advertising tracking cookie is set, and what you type into the form is neither read nor transmitted by this check.

This processing rests on the legitimate interest of the publisher and the organiser in protecting the service. Cloudflare acts here as a processor, and describes the data it processes on that occasion in its Turnstile Privacy Addendum, published at https://www.cloudflare.com/turnstile-privacy-policy/.

Audience measurement on registration pages

We measure how the registration pages are used: how many visits end in a registration, how long the form takes, and which field most often blocks people. This measurement exists to make the pages simpler, and for nothing else.

It sets no cookie, keeps neither your IP address, nor the full identification of your browser, nor the address of the page you came from, and cannot be linked to you or to your registration. What is kept is deliberately coarse: the size of your window in steps, the time to the minute, the language and the type of device. That information does not make you identifiable, including by cross-referencing, and it is deleted after twelve months.

Transfers outside the European Union

The platform and its database are hosted in the European Union. Some operations nonetheless involve providers established outside the Union: payment collection in West Africa, notification delivery by Google and Apple, adding a pass to Google Wallet, certain international payment services, and, where the provider chosen by the platform is established outside the Union, SMS delivery and machine translation of event content.

Those transfers are covered by the European Commission standard contractual clauses or by a recognised adequacy mechanism.

Your rights, and how to exercise them

You have the right to access your data, to have it corrected or erased, to restrict processing, to object, and to data portability. Where processing rests on your consent, you may withdraw it at any time, without calling into question what was done before the withdrawal.

To exercise these rights, write to [email protected], stating which event is concerned. You will receive an answer within one month.

Consent to networking can also be withdrawn directly from your profile in the app: your record then stops appearing in the directory.

The steps to ask for your account to be deleted are described on the “Delete my Kwabo account” page, reachable from the footer of this page.

If the answer does not satisfy you, you may lodge a complaint with a supervisory authority: the Autorité de protection des données à caractère personnel (APDP) in Benin, the Commission nationale pour la protection des données (CNPD) in Luxembourg, or the authority of your country of residence.

Applicable law

The platform applies the General Data Protection Regulation (Regulation EU 2016/679), Benin law no. 2017-20 of 20 April 2018 establishing the digital code of the Republic of Benin, and the African Union Convention on Cyber Security and Personal Data Protection, known as the Malabo Convention.

Changes

This policy may change as the platform evolves. Any change is published on this page, and the update date above is authoritative. A change affecting the purpose of a processing operation would be flagged to you before it takes effect.