Privacy Notice

This privacy notice (Privacy Notice) informs our website visitors, newsletter subscribers, event
participants, current and prospective clients as well as business partners, job applicants and any
other party (or persons acting on behalf of such party) (you) about how Marica Bertarini (we, Kekombo, us, our, ours) treats personal data (Data) in accordance with the Swiss Federal Act on Data Protection (FADP) and the EU and UK General Data Protection Regulations (collectively GDPR), as applicable, when using our website, communicating with us, subscribing to our newsletters, searching for, reading about, registering for and participating in events (Services), visiting our offices, applying for a job vacancy or in any of the other situations set out in Section 3 below. In this Privacy Notice, specific references to the GDPR are only relevant to the extent the GDPR applies.

1. Controller, Representative and Contact Details

The controller is Marica Bertarini (e-mail address: kekombo@protonmail.com).

2. Our Collection of Data and Your Sharing of Third-Party Data

You are in general under no obligation to provide us with any Data. However, if you do not
provide the required information regarding certain use cases set out in Section 3, we may
not be able to process your corresponding request, get in contact with you, send you our
newsletter, invite you to our events, enter into or negotiate a contract with you, provide you
with our Services, process your application, etc.
In order to provide you with our Services, we collect Data related to our Services from you directly when you sign up to our website or from your device, operating system or device when you access our website.

If you share with us Data regarding any other individual (e.g. by email, through our website or you share through the event manager area on our website data about event participants), we assume that this Data is correct. By sharing such Data with us, you confirm that you are authorized to do so and that you have informed the affected individuals about this Privacy Notice and our processing of their Data.

3. Processed Data, Purpose and legal basis

3.1 Website Use

The processing related to your use of our website is limited to Data that is required to
operate, provide and secure the website and the services provided thereon (Website Use
Data) and for web analysis purposes (Website Analysis Data).

Categories of data:

- When accessing our website, the following information about your
access and device may be collected automatically: IP address, operating system, type of
device, browser name and version, date and time of signup and access or date, time and type of operations like email confirmation and password reset requests, as well as the address of the website from
which you were redirected to our website (if applicable), etc.

- When signing up to our website, the following information are collected: email, hash of your password, languages that you speak and their proficiency level, language targets and preferences.

- When registering for an event the following information are collected: intent or attendance to an event, location of where you intend to be, where you are or where you will be at the time of the event, time of arrival or no-show, and payment method. We do not access your real location through your device but we collect your attendance to events whose location is known to us and other website users or partners or public.

Purpose and legal basis: The processing regarding website use is based on our legitimate
interest to operate and secure our website and our services, in particular for security
reasons to ensure the stability and integrity of our systems (Art. 6 para. 1 lit. f GDPR). In
addition, we may perform basic web analysis based on our legitimate interest (Art. 6
para. 1 lit. f GDPR) to optimize the website regarding usability and to gain insights about
the use of our website and services. The collected data will not be merged with other
personal data or disclosed to third parties. Enhanced web analysis using cookies is, within
the scope of applicability of the GDPR, based on your consent (Art. 6 para. 1 lit. a GDPR),
cf. below Section 3.2.

3.2 Cookies

Website Analysis Data may also be collected via the use of cookies. Cookies are small
files that are managed by your browser and are directly stored on your device whenever
you visit our website. You can disable the use of cookies in the preferences of your
browser, but this might result in some functions of our website or some services being
unavailable to you or not functioning properly anymore.

Categories of data: Website Use Data, Website Analysis Data and such further Data as
specified in the
Cookie Policy.

Purpose and legal basis: We may use cookies on our website to ensure a user-friendly
website visitor experience (e.g. session cookies), based on our legitimate interest (Art. 6
para. 1 lit. f GDPR). Enhanced web analysis using cookies is, within the scope of
applicability of the GDPR, based on your consent (Art. 6 para. 1 lit. a GDPR). For further
information, please see our
Cookie Policy.

3.3 Communication

We may be in contact with you by use of different channels, e.g. if you fill in contact or
similar forms on our website, send us e-mails or by using other electronic (or hardcopy)
communication means, whereby Data may be exchanged (Communication Data).

Categories of data: If you fill in our contact forms, send us an e-mail or another form of
electronic message (or a hardcopy message, e.g. a letter), we may collect such information
as your name, e-mail address (or other form of communication identifier, e.g. messenger
nickname), phone number, subject matter, message content, related metadata and any
other information you choose to disclose in your communication to us.

Purpose and legal basis: We use Communication Data to process your inquiry and any
possible further questions you might have in relation to the performance of our services
(Art. 6 para. 1 lit. b GDPR) and any other related questions and matters based on the
content of your communication with us (Art. 6 para. 1 lit. a GDPR). We may keep this data
to document our communication with you, for training purposes, for quality assurance, for
follow-up inquiries (Art. 6 para. 1 lit. f GDPR) and for regulatory purposes (Art. 6 para. 1
lit. c GDPR).

3.4 Marketing, Events and Newsletters

We may process your Data for marketing purposes and relationship management,
including events and newsletters (Marketing Data).

Categories of data: Marketing Data may in particular include your contact information
(e.g. name, company type and name, business function / title, e-mail, address, etc.) and
further data categories such as your preferences (e.g. your areas of interest), information
relating to your participation in events (including photos) and to your use of our newsletters,
references provided by you as well as Communication Data.

Purpose and legal basis: We process Marketing Data for marketing purposes and
relationship management, for example to send personalized advertising for our services
and products, e.g. in the form of newsletters or other regular contacts either in person, via
e-mail or other electronic form, by phone or any other communication channel for which
we have contact information from you and by any other marketing means (e.g. through
events, fairs, etc.), or to publish photos of events on our website and in other media. We
do so based on our legitimate interest to keep you and other interested parties informed
about our products and services (Art. 6 para. 1 lit. f GDPR), to the extent permitted by
applicable marketing regulations, or, where required, based upon your consent in this
regard (Art. 6 para. 1 lit. a GDPR). In either case, you can object at any time, or refuse or
withdraw your consent to be contacted for marketing purposes.

3.5 Services

Categories of data: In connection with the provision of our Services, we may collect and
further process Data related to such Services. This includes any information that we
require or obtain from you in order to be able to provide our Services, such as your user profile data and event attendance data (as described in Section 3.1), your feedback, etc. Furthermore, when providing our Services, we may process emails, text messages, letters and other communications (including images and videos from events, related metadata, etc.). All the data explained in this section is referred to as
Services Data.

Purpose and legal basis: In general, Services Data will be used for the provision of our
Services (Art. 6 para. 1 lit. b GDPR) and we may process your data to fulfil legal obligations (e.g., accounting or tax-related duties) and for our legitimate interests, such as ensuring platform security, preventing fraud, and improving user experience (Art. 6 para. 1 lit. c and f GDPR). We may also process Services Data to document our Services delivery and communication with you, for training purposes or for quality assurance as well as for market research to improve our Services and operations and for product and service development, based on our legitimate interest (Art. 6 para. 1 lit. f GDPR).

3.6 Contracts

Categories of data: If we enter into or negotiate a contract with you, we may collect Data
in relation to the conclusion and performance of such contract. This may include your
name, contact details (including address, phone number, email address) (collectively Contract Data) and Services Data (as described in
Section 3.5).

Purpose and legal basis: We use Contract Data for the preparation, conclusion,
performance and administration of our contractual relationships and any questions or
inquiries that might arise in that relation (Art. 6 para. 1 lit. b GDPR). Such processing may
be required to comply with legal requirements and internal regulations (Art. 6 para. 1 lit. c
and f GDPR; cf. Section 3.5). We may also process Contract Data to document our
communication with you, for training purposes, for quality assurance and for follow-up
inquiries (Art. 6 para. 1 lit. f GDPR).

4. Disclosure and Transfer of Data

We may disclose your Data to recipients as set out in Section 4.1, which may include
cross-border data transfers as further described in Section 4.2.

4.1 Categories of Recipients

We may make your Data available to the following recipients (in compliance with the
applicable legal requirements):

- event organisers;

- contractual partners (to the extent the disclosure results from such contracts, e.g. if you use our Services under a contract that we have with your employer or with an organisation you belong to or you purchased a service or membership from);

- external service providers (e.g. IT and communication services providers, business information providers, newsletter services providers, marketing and event management services providers, compliance services providers, administrative services providers, etc.);

- other involved parties, such as event partners, service providers, venues, or payment processors, where necessary to facilitate your booking or event participation;

- competent public authorities, such as tax offices, courts, or regulatory agencies, where we are legally required to disclose data or where it is necessary to protect our rights and interests;

Under specific circumstances, certain Data may be published on our website or in other media (in compliance with applicable legal requirements, e.g. based on your consent). This may include photos taken during events you attended or feedback/testimonials you’ve voluntarily shared.

4.2 Cross-Border Transfer of Data

In connection with the disclosures described in Section 4.1, we may transfer Data to the following countries that offer adequate protection pursuant to the FADP and GDPR: EEA member states. We also use service providers, which may process data in countries which do not offer adequate protection pursuant to the FADP and/or GDPR: the United States (US) for IT, communication, cloud, hosting, emailing services, technical support, support and potentially other countries (if necessary for the respective processing purpose, e.g. for IT services or in connection with international legal proceedings). To the extent such countries do not offer adequate protection, the transfer is secured by appropriate safeguards (such as Standard Contractual Clauses) or based on a statutory exemption (e.g. if you have given your consent to the transfer, if the transfer is directly consent to the transfer, if the transfer is directly connected with the conclusion or performance of a contract with you or if the transfer is necessary for the establishment, exercise or enforcement of legal claims before a foreign authority). Within the scope of the GDPR, you may ask us for a copy of the relevant safeguards by contacting us as indicated in Section 1.

5. Storage Periods and Erasure

Storage Periods and Erasure
We process and retain Data for as long as our processing purposes, the legal retention periods and our legitimate interests regarding documentation require it. Except in case of contrary legal or contractual obligations, we will erase or anonymize your Data once the storage or processing period has expired. Regarding specific Data categories, we will in general retain your Data as follows:
- Website Use Data: Website Use Data will be processed for as long as required to
  enable the requested access and secure the stability and integrity of the relevant
  systems.
- Website Analysis Data: Website Analysis Data will be stored for as long as required
  to perform the analysis and will thereafter be deleted or anonymized.
- Cookies: Cookies will be stored on your device for the time period required to achieve
  the related purpose and as further set out in the Cookie Policy and will thereafter be
  deleted by your browser.
- Communication Data: Communication Data will be deleted after responding to /
  completing your inquiry if and to the extent (a) we are not legally obliged to retain such
  Data (e.g. for accounting or document retention purposes) and (b) we do not have an
  overriding or legitimate interest to retain such Data for documentation, quality
  assurance or similar business purposes or for the assessment or exercise of, or
  defense against, legal claims.
- Marketing Data: We generally keep Marketing Data for as long as necessary to
  achieve the respective purposes. Such Data will be deleted thereafter if and to the
  extent (a) we are not legally obliged to retain such Data (e.g. for accounting or
  document retention purposes) and (b) we do not have an overriding or legitimate
  interest to retain such Data for documentation, quality assurance or similar business
  purposes or for the assessment or exercise of, or defense against, legal claims.
- Services Data and Contract Data: We keep Services Data and Contract Data for the
  duration of the statute of limitations regarding contractual claims, as calculated from
  the end of the contractual relationship if and to the extent (a) we are not legally obliged
  to retain such Data for a longer period (e.g. for accounting or document retention purposes) and (b) we do not have an overriding or legitimate interest to retain such
  Data for documentation, quality assurance or similar business purposes or for the
  assessment or exercise of, or defense against, legal claims.

6. Your Rights as Affected Data Subject

a) Information, i.e. to ask us whether we are processing Data about you and, if so, to
provide you with further information related thereto.
b) Correction, i.e. to ask us to correct or complement your Data if it is incorrect or
incomplete.
c) Deletion, i.e. to delete your Data (to the extent we are not under a legal obligation
or have an overriding or legitimate interest to retain such Data).
d) Object, i.e. to dissent to the processing of your Data based on our legitimate interest
(Art. 6 para. 1 lit. f GDPR) by explaining your particular reasons and specific
circumstances on which your objection is based. Regarding cookies through which
certain Data may be collected, you can block the setting of such cookies at any time
by changing the settings in your browser accordingly. A deactivation of cookies may
result in a limited user experience and you may not be able to use every function of
our website or services or to access the services in an appropriate manner
altogether.
e) Restrict processing, i.e. to ask us to temporarily restrict our processing of your
Data.
f) Data portability, i.e. to ask us to provide you or another controller in electronic form
with the Data you have provided to us (to the extent technically feasible).
g) Withdraw your consent, i.e. to revoke your consent to the extent you have
previously given such consent to any specific purpose of processing of your Data.
This will not affect the lawfulness of any processing carried out before you have
withdrawn your consent (or any processing based on any legal basis other than your
consent) and it may mean that we will no longer be able to provide our Services to
you.

In case you wish to exercise any of these rights, please contact us as specified in
Section 1. Before responding to your request, we may ask for proof of identity. This helps
us to ensure that your Data is not disclosed to any unauthorized person.

7. Data Security

We have put appropriate technical and organizational security policies and procedures in
place to protect your Data from loss, misuse, alteration or destruction. Despite these
security measures, we cannot completely eliminate the security risks associated with data
processing.

8. Complaints / Regulatory Authority

If you believe that our processing of your Data contradicts the applicable data protection laws, you have the possibility to lodge a complaint with the appropriate data protection authority. The data protection authority in Switzerland is the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Berne, Switzerland ( https://www.edoeb.admin.ch). Based on your residence, you may have the possibility to lodge a complaint with the appropriate data protection authority of your place of residence.

9. Changes to this Privacy Notice

This Privacy Notice does not form part of any contract with you and we may amend it at
any time. The version published on our website is the version that currently applies.

Last update: 07 May 2025