Privacy policy

Last updated: 25 October 2026

kongre.net is operated by BOTONBOARD LTD, a company registered in England and Wales (company number 14955016), registered office 20 Wenlock Road, London N1 7GU, United Kingdom. We are the data controller for the personal data described on this page. Contact: [email protected].

This page explains what we collect when you use kongre.net, why, who we share it with, how long we keep it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

1. Browsing without an account

When you visit kongre.net we receive your IP address, browser type and the pages you request. Our web server and content delivery provider (Cloudflare) keep standard access logs for security and troubleshooting for up to 30 days.

We use Google Analytics 4 to understand how the site is used, and Google AdSense and our own ad server (Revive Adserver at delivery.kongre.net) to show advertising. These tools set cookies and similar identifiers only if you agree in the consent banner. See section 7.

2. Creating an account

To create an account we ask for a username, email address and password, or you can sign in with Google. With Google sign-in we receive your name, email address and Google account identifier; we do not receive your Google password.

In the kongre.net mobile app you can also sign in with Apple. Apple gives us your name (the first time only) and an email address, which may be a private relay address created by Apple. We do not receive your Apple ID password.

Optionally you can add a display name, title, short biography, LinkedIn URL, ORCID identifier, profile picture and a list of publications. These appear on your public profile page if you choose to make the profile visible.

If you request an organiser or PCO account, we record that request and an administrator reviews it. We send you an email when it is approved.

Legal basis: performance of a contract; legitimate interest for the approval review.

3. Using the platform

What we record when you use kongre.net features:

Follows: the categories and countries you follow, to build your For You feed.
Favourites and agenda: events you save and sessions you mark.
Attendance: events you mark as planning to attend or attended, with the visibility you chose. If you choose "Anyone viewing this event", your name and profile link appear in that event's public attendee list. If you choose "Only me", nobody else sees it.
Q&A and comments: questions and comments you post on event pages are public and shown with your display name. Organisers can hide comments on their own events.
Messages: private messages you exchange with organisers or other users through the platform, stored so both parties can read them.
Event listings: if you are an organiser, the events, programmes, speakers and venues you enter are published content. Where you enter your own details as a contact or speaker, those are personal data shown publicly.

Legal basis: performance of a contract.

4. Email

We send transactional emails: email verification, password reset, role approval, registration confirmation, organiser broadcasts for events you registered for, and account deletion confirmation. We do not send marketing email. If we introduce an optional digest of events in your fields, it will be opt-in.

5. Registering for an event and paying

When you register for an event through kongre.net we collect the details the organiser's registration form asks for: at minimum your name and email, sometimes your institution, dietary or accessibility needs, or other questions the organiser defines. The organiser receives this data to run their event and acts as a separate data controller for their records (meaning if you wish to erase registration records held directly by an organiser, you will need to contact them directly).

Payments are processed by Stripe. Card details are entered on Stripe's payment page and never reach our servers; we receive a payment reference, the amount, and whether the payment succeeded. Stripe's privacy policy applies to card processing: stripe.com/privacy.

Payments are received by BOTONBOARD LTD and passed on to the event organiser. We keep payment records for accounting and tax purposes for the period required by UK law (section 8).

Legal basis: performance of a contract; legal obligation for accounting records.

Event organisers: your registration details and, if you chose public attendance, your name on the attendee list.
Service providers: Stripe (payments), Google (sign-in, Analytics, AdSense, consent management, and Firebase Cloud Messaging for push notifications in the mobile app), Apple (Sign in with Apple, and push notifications on iPhone), Expo (650 Industries, Inc.; sends push notifications for the mobile app), Cloudflare (content delivery and security), Hetzner Online GmbH (server hosting in Helsinki, Finland).
Other users: whatever you make public (profile, comments, public attendance).
Nobody else. We do not sell personal data.

Our servers are in Finland. Google and Stripe process some data in the United States; those transfers rely on the UK International Data Transfer Agreement or the UK extension to the EU-US Data Privacy Framework.

Expo, which sends the mobile app’s push notifications, processes your device’s push token and the notification content in the United States.

7. Cookies and similar technologies

kongre_session: keeps you logged in. Essential, lasts up to 30 days.
Consent choice: stored in your browser's local storage so we do not ask again. Essential.
Google Analytics, Google AdSense and Revive Adserver cookies: set only after you accept in the consent banner. You can change your choice at any time from the cookie settings link in the footer.

The full list is on the cookies page.

8. How long we keep data

Account and profile: until you delete your account.
Follows, favourites, agenda, attendance marks, pinned event apps, messages: deleted when you delete your account.
Public comments: kept, shown as "Deleted user" after account deletion.
Registration and payment records: kept for 6 years after the event for accounting and tax purposes, without your profile data once your account is deleted.
Server logs: up to 30 days.
Mobile app push tokens: until you sign out, turn notifications off, remove the app or delete your account.
Event app check-ins: kept with the event’s records; no longer linked to your name once your account is deleted.
Live poll votes: the link between you and your vote is removed 60 days after the event ends; only anonymous totals are kept. Attendee email lists that organisers upload to control voting are deleted at the same time.

9. Deleting your account

You can delete your account from your profile page on the website, or in the kongre.net mobile app (Account, then Delete account). Your account is blocked immediately and permanently anonymised after 14 days. Within those 14 days you can cancel by emailing [email protected]. After that, your username, email, password, profile fields, picture, follows, favourites, agenda, attendance marks and message records are removed. Registration and payment records are retained as described in section 8.

10. Your rights

You have the right to access the personal data we hold about you, to correct it, to delete it, to restrict or object to its processing, and to receive a copy in a portable format. Most of this you can do yourself from your profile and dashboard; for anything else, email [email protected] and we will respond within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office: ico.org.uk.

11. Children

kongre.net is intended for professionals and students in higher education. We do not knowingly collect data from anyone under 16.

12. The kongre.net mobile app

The mobile app uses the same account and the same data as the website, as described above. In addition:

On your phone: your sign-in tokens are kept in the phone’s secure storage, and offline copies of event programmes, your starred sessions and recently opened event apps are kept so the app works without a connection. Signing out removes the sign-in tokens; removing the app removes everything.
Push notifications: sent only if you allow them. We store a push token for your device with your account and send notifications (such as event announcements and session reminders) through Expo, which delivers them via Google Firebase Cloud Messaging on Android and Apple’s push notification service on iPhone. You can switch each notification type off in the app; your choices are saved to your account. Session reminders are based on the sessions you have starred.
Camera: used only to scan QR codes, after asking your permission. The image is read on your phone; no photo is taken, stored or uploaded.
Pinned event apps: saved to your account so they come back on another phone. They are private to you, never shared with organisers and never used for advertising.
Congress pass (event apps): a QR code that identifies your kongre.net account for one event. When the organiser’s staff scan it, we record the check-in (the event, you, who scanned it and when), and the organiser can see the check-ins for their event.
Live polls (event apps): your vote is linked to your account, or to a random identifier for your device, so that nobody votes twice. See section 8 for how long this link is kept.
Live Q&A (event apps): questions appear with your display name unless you ask anonymously. For anonymous questions, organisers never see who asked; we keep the link only so that site administrators can deal with abuse. Questions stay on the event’s Q&A board.
Sign in with Google: if you choose it, Google confirms who you are and gives us your name, email address and Google account ID, which we use only to sign you in to your kongre.net account. We never receive your Google password or access to anything else in your Google account.
Sponsored content: the directory part of the app (not event apps) shows clearly labelled sponsored images from our own ad server (Revive Adserver at delivery.kongre.net). Ads are chosen by the page you are viewing, not by a profile of you. The app does not use advertising IDs, cookies or third-party advertising or analytics tools, and we do not track you across other apps or websites. We count how often each ad is shown and tapped; these counts are not linked to your account.

We process this data to provide the app you use (performance of a contract). Push notifications and camera access are based on your consent, which you can withdraw at any time in the app or in your phone’s settings.

13. Changes

We will update this page when our processing changes and show the date at the top.

This policy is written in English. If we provide translations, the English version prevails in case of any difference.