Privacy Policy for End Users

This Privacy Policy explains how GatherUs processes personal data of individuals who use the GatherUs platform (“you”). The controller of your personal data depends on where you live: if you reside in the European Economic Area, the United Kingdom or Switzerland, the controller is CIC International B.V., Stationsplein 45, 3013 AK Rotterdam, the Netherlands (KvK no. 65212142.); if you reside anywhere else, the controller is CIC Venture Cafe Global Institute, Inc., 1 Broadway, 14th Floor, Cambridge, MA 02142, USA (together and as applicable, “GatherUs”, “we”, “us”). We process your personal data to provide you with access to the platform, to send you event and community communications, to suggest people you may wish to meet where you enable that feature, and to analyse how users use the platform,, as detailed below.

1. TWO CONTROLLERS: GATHERUS AND YOUR EVENT ORGANISER

The GatherUs platform is used by event organisers (“Organisers”) to run their events. GatherUs and each Organiser are separate, independent controllers; we are not joint controllers.
GatherUs is the controller of your account data and of the data generated by your use of the platform, which we process for the purposes in Section 3.
The Organiser is the controller of the data it collects about you for its event — for example your answers to registration questions the Organiser configures, your attendance at its event, and its decisions about your participation. The Organiser’s own privacy notice applies to that processing. Requests about an Organiser’s use of your data (including its marketing) should be addressed to the Organiser; we will forward any such request we receive.
Data uploaded by an Organiser before you have an account. Where an Organiser uploads your name and e-mail address to invite you to its Event before you have a GatherUs account, the Organiser is the controller of that data and we process it only on the Organiser’s behalf, to send you the invitation and to register you for that Event. We become the controller of your account data only once you accept the End User Terms and create your account.

Data we receive from Organisers. Where you enable networking suggestions (Section 3), we receive from the Organisers of the Events you have joined your registration answers and attendance data and process them as our own controller, as described in Section 2.5.

2. PERSONAL DATA WE PROCESS

Account data — name, e-mail address, login credentials, organisation, job title, profile photo and other profile details you choose to add.
Event registration and participation data — the events you register for, your check-in records and the events you attend, and your networking connections. This data is shared with the relevant Organiser, which processes it as its own controller. Your answers to registration questions configured by an Organiser, and your presence and activity within an Organiser’s live event space, are the Organiser’s data: we process them on the Organiser’s behalf for its Event, and we receive registration answers as our own controller only for networking suggestions (Section 2.5).
Usage and device data — log data (IP address, timestamps, pages and features used, actions taken), device and browser type, language, and diagnostic data. The GatherUs app uses only strictly necessary cookies; see the Cookie Notice.
Support and communications data — messages you exchange with us, including support requests.
Data received from Organisers for networking suggestions — where you have enabled networking suggestions, we receive from the Organisers of the Events you have registered for or attended your answers to their registration questions and your attendance data for their Events, and combine them with your account data and event history to suggest people you may wish to meet. Fields that an Organiser has designated as special-category data are excluded.
Communications and engagement data — records of the e-mails we send you (registration confirmations, event reminders, post-event surveys and community newsletters), your subscription and consent status and, only where you have consented, whether an e-mail was opened or a link in it clicked.
Networking inferences — the suggestions of people to meet that we generate for you and the short explanation given for each suggestion.
We do not ask for special categories of personal data (such as health data). Organisers may configure their own registration questions (for example dietary or accessibility requirements); the Organiser is the controller of those answers and responsible for the lawful basis to collect them. Such answers are excluded from the data we receive for networking suggestions.

3. PURPOSES AND LEGAL BASES

Purpose	What we do	Legal basis (GDPR)
Providing access to the platform	Creating and operating your account; enabling event registration and participation features; communications about the service	Art. 6(1)(b) — performance of our contract with you (the End User Terms)
Platform usage analytics	Analysing how users use the platform — feature usage, trends and user behaviour — to understand, improve and develop the platform; producing aggregated statistics	Art. 6(1)(f) — our legitimate interest in understanding and improving our product; where required (e.g. non-essential cookies/SDKs), Art. 6(1)(a) — consent
Security and abuse prevention	Logging, monitoring, investigating and preventing fraud, spam and attacks	Art. 6(1)(f) — legitimate interest in securing the platform
Sharing with your Organiser	Making your registration and participation data available to the Organiser of the event you join	Art. 6(1)(b) — necessary to provide the service you request (participation in the event)
Event and community communications	Sending you registration confirmations, event reminders, post-event surveys and other messages about the Events you have registered for or attended	Art. 6(1)(b) — performance of our contract with you (the End User Terms)
Community newsletters	Sending you the newsletters of the communities (Organisers) whose Events you have joined, where you have subscribed to them	Art. 6(1)(a) — consent; you can unsubscribe at any time via the link in each e-mail or in your account settings
E-mail engagement measurement	Recording whether an e-mail we sent you was opened or a link in it clicked, to measure the effectiveness of our communications	Art. 6(1)(a) — consent (also required under e-privacy rules); you can withdraw it at any time in your account settings
Networking suggestions	Suggesting people you may wish to meet, at Events and outside Event times, with a short explanation of why, based on your account data, your event history and the registration answers and attendance data we receive from Organisers (Section 2.5). This involves profiling (see the paragraph following this table)	Art. 6(1)(b) — performance of our contract with you, where you have enabled networking suggestions in your account settings; you can switch the feature off at any time
Legal compliance	Retaining records, responding to lawful requests, exercising or defending legal claims	Art. 6(1)(c) — legal obligation; Art. 6(1)(f)

Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time (Section 7). Our platform usage analytics for our own product purposes are carried out on aggregated or irreversibly anonymized outputs. Networking suggestions involve profiling: we analyse your profile, your event history and the registration answers and attendance data described in Section 2.5 to infer which other users may be relevant for you to meet, and we show your profile to those users as a suggestion. You can switch networking suggestions off, or object to this profiling, at any time (Section 7). Organisers may also use platform tools that analyse attendance at their own Events (for example to identify new, returning or less active participants); the Organiser is the controller of that analysis and its privacy notice applies. We do not use your personal data for third-party advertising and we do not make decisions producing legal effects about you by solely automated means.

Organisers — as described in Sections 1 and 3. Our sharing with Organisers is governed by a controller-to-controller data sharing agreement obliging them to process shared data lawfully and transparently. The same agreement governs the registration answers and attendance data we receive from Organisers for networking suggestions (Section 2.5).
Service providers (processors) acting on our instructions, in the following categories: cloud hosting and infrastructure providers; e-mail delivery providers; payment processing providers (used for organiser billing only — we do not take payments from End Users); and operational support providers.
Other users — your profile and in-event activity are visible to other participants to the extent inherent in the feature you use (for example, networking or Q&A). Where you have enabled networking suggestions, your profile and the explanation for a suggestion may be shown to users who attended other Organisers’ Events.
Authorities, advisers, successors — where required by law, to establish or defend legal claims, or in connection with a merger, acquisition or asset sale (with notice to you).
We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

5. INTERNATIONAL TRANSFERS

GatherUs operates through two entities: CIC International B.V. in the Netherlands and CIC Venture Cafe Global Institute, Inc. in the United States, and uses service providers that process data in the United States and the European Union. Your personal data may therefore be transferred between these entities and to our service providers outside your country.
Where personal data of EEA/UK/Swiss users is transferred to a country without an adequacy decision (including transfers from CIC NL Operations B.V. to CIC Venture Cafe Global Institute, Inc. or to US-based service providers), we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum or Swiss adjustments where relevant), supplemented where necessary following a transfer impact assessment, or on an applicable adequacy framework such as the EU-US Data Privacy Framework where the recipient is certified. You can request a copy of the relevant safeguards via the contact in Section 9.

6. RETENTION

We keep your personal data only for as long as your account exists. When you delete your account, we do not keep your user data: your account and profile data and associated usage data are deleted or irreversibly anonymized within [30] days of account deletion. Networking inferences are deleted when you switch networking suggestions off, and e-mail engagement data is deleted when you withdraw your consent, in each case within the same period.
The only exceptions are: (a) residual copies in encrypted backups, which are purged on a rolling cycle within [90] days; (b) data we are legally required to retain or need to establish or defend legal claims (kept only for as long as strictly required); and (c) data already shared with an Organiser or other users through your participation in an Event, which the Organiser holds as its own controller.
Anonymized, aggregated data — which no longer relates to you or any identifiable person — may be retained.

7. YOUR RIGHTS (EEA/UK/SWITZERLAND)

You have the right to access your personal data and obtain a copy; to rectification; to erasure; to restriction of processing; to data portability; and to object at any time to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time with future effect. You can switch off networking suggestions, unsubscribe from community newsletters and withdraw consent to e-mail engagement measurement at any time in your account settings.
To exercise your rights, contact us at [privacy e-mail] or use your account settings (which let you access, correct and delete your profile). We respond within one month (extendable as permitted by law). Requests concerning an Organiser’s processing will be forwarded to the Organiser.
You may lodge a complaint with your local supervisory authority. For EEA/Swiss users, CIC NL Operations B.V. is your EU-established controller and point of contact. [A UK Art. 27 representative may still be required for UK users — to be confirmed.]

8. US STATE PRIVACY NOTICE (CALIFORNIA AND OTHER STATES)

Categories collected (in the last 12 months): identifiers (name, e-mail, IP address, account IDs); professional information (organisation, job title); internet or other electronic network activity (usage and log data); audio/visual information only if you add a profile photo or participate in recorded features; and inferences (platform usage patterns and, where you have enabled networking suggestions, inferences about which other users may be relevant for you to meet). Sources: you; your device; Organisers (e.g. when they register you, or when they share your registration answers and attendance data with us for networking suggestions). Purposes: as set out in Section 3. Disclosures for business purposes: to the service providers and Organisers listed in Section 4.
No sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly collect or sell personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes requiring a “limit use” right.
Your rights: to know/access, correct, delete, and to receive your data in a portable format; not to be discriminated against for exercising rights. Because we do not sell or share personal information, no opt-out is required; we nevertheless honour opt-out preference signals (Global Privacy Control) as required by law. Submit requests to [privacy e-mail] or [toll-free number / web form]. We will verify your request via your account e-mail; you may use an authorised agent with written permission.

9. CONTACT, CHILDREN, CHANGES

Controllers: CIC International B.V., Stationsplein 45, 3013 AK Rotterdam, the Netherlands (EEA/UK/Swiss residents); CIC Venture Cafe Global Institute, Inc., 1 Broadway, 14th Floor, Cambridge, MA 02142, USA (all other users). Privacy contact: [privacy e-mail]. [DPO, if appointed: name and contact.]
The platform is not directed at children under 16 and we do not knowingly process their data; if you believe a child uses the platform, contact us.
We will notify you of material changes to this Policy (by e-mail or in-platform notice) before they take effect. The “last updated” date above indicates the current version.