Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Koh Labs LLC
30 N Gould St, Ste N
Sheridan, WY 82801, US
Email: aaron@ninja.partners

2. Scope & legal framework

Koh Labs LLCis established in the United States and has no establishment in the EU. We process personal data of visitors in the EU/EEA in accordance with the EU General Data Protection Regulation (GDPR), which applies to us because we offer services to, and monitor the behaviour of, visitors in the Union (Art. 3(2) GDPR). For visitors in California, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) applies. Where national e-privacy rules apply in a visitor's country (for example § 25 TDDDG in Germany), storing or reading non-essential information on your device requires your prior consent.

3. Hosting & server logs

This website is hosted by Vercel Inc. When you access the site, technical data (e.g. IP address, browser type, time of request) is processed to deliver the site securely. Legal basis: our legitimate interest in operating a secure and stable website (Art. 6(1)(f) GDPR).

4. Cookies & consent

We use strictly necessary cookies to operate the site and to remember your cookie choice. Non-essential cookies and similar technologies (analytics, marketing) are only set after you give consent via our cookie banner. Consent is voluntary and can be withdrawn at any time with effect for the future via Cookie settings.

Legal basis for consent-based processing: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Embedded YouTube videos. Our episode pages show a preview image instead of the YouTube player, and nothing is loaded from YouTube until you press play. When you press play, the player loads from youtube-nocookie.com, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google then receives technical data such as your IP address, browser information and the page you are on, and may store information on your device. Legal basis: your consent, given by pressing play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. More in Google's privacy policy.

5. Google Analytics 4

With your consent, we use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). GA4 uses cookies and similar identifiers to analyse how visitors use the site. IP addresses are not stored in raw form by GA4. We operate Google Consent Mode v2: no analytics cookies are set until you consent.

Recipient: Google Ireland Limited / Google LLC.
Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
Retention: user- and event-level data is retained for 2 months. Aggregated standard reports are retained independently of this setting.
Third-country transfer: data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection.

6. Marketing & advertising

We currently do not use advertising, remarketing or social-media tracking tools on this website. Should we introduce such tools in the future (for example LinkedIn Insight Tag, Meta Pixel or Google Ads), we will update this policy and load them only after you give your consent. Legal basis for any future consent-based processing: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

7. Contact by email

If you contact us by email, the data you provide will be processed to handle your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual / contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

8. Newsletter, event registration & recordings

Registering for an intelligence.md session. When you register for one of our online sessions we process your name, your email address and, if you choose to give it, your company name. Your registration is recorded when you submit the form, and we email you a confirmation with the join link. We may also email you a reminder before the session and the recording afterwards. These emails are part of the service you asked for: registering does not put you on our newsletter. If someone entered your address without your knowledge, or you change your mind, the removal link in the confirmation email takes your registration off the list, and deletes your contact record if we hold nothing else for you. Legal basis: Art. 6(1)(b) GDPR, because we process this data to provide the service you asked for.

Newsletter. Our newsletter is a separate, optional opt-in with its own tick box, and it only starts once you confirm it through a link we email you. Signing up for the newsletter is never a condition of attending a session (Art. 7(4) GDPR), and declining it never removes you from a list you are already on. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, using the unsubscribe link in every email or by writing to aaron@ninja.partners.

Processor: we send these emails and keep the corresponding contact lists with Brevo (Sendinblue GmbH, Germany), which acts as our processor under a data processing agreement pursuant to Art. 28 GDPR. Brevo processes your email address, the data you entered in the form, and technical delivery data.

[To be completed by counsel: full registered address of Sendinblue GmbH; whether the French parent company is a party to the processing; and the retention period for registration records after a session has taken place. Newsletter contacts are kept until consent is withdrawn.]

Spam protection. To keep bots out of our sign-up forms (session registration, newsletter and downloads) we use Cloudflare Turnstile, provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When a form comes into view, Turnstile checks in the background whether the visitor is a person. For this it processes technical signals such as your IP address, browser and device information. Turnstile does not set cookies and does not use the data for advertising. Most visitors see nothing; only when the check is unsure does it ask you to tick a box. Legal basis: our legitimate interest in protecting our forms and the people whose email addresses would otherwise be misused (Art. 6(1)(f) GDPR). Third-country transfer: Cloudflare, Inc. is certified under the EU-US Data Privacy Framework.

[To be checked by counsel: whether Cloudflare acts as processor or controller for Turnstile, and whether a data processing agreement is needed.]

Recordings.Our sessions are recorded. The recording is shared with registrants and published publicly on YouTube, Spotify and our social media channels. As an attendee you are not recorded: no video or audio of you is captured, your camera and microphone stay off, and only the speakers appear. Two things can change that, and only if you choose them. If you ask to join the conversation live during the session, you are part of the recording from that moment on. And a question you type in the chat or the Q&A may be read out and answered on the recording, which is public. Legal basis: our legitimate interest in documenting and publishing our sessions (Art. 6(1)(f) GDPR); where you actively choose to contribute by voice or on camera, your consent (Art. 6(1)(a) GDPR), which you may withdraw.

[To be completed by counsel: the session platform provider and its role, how long recordings are retained, and the platforms the recording is published on as recipients of that content.]

9. EU representative (Art. 27 GDPR)

Koh Labs LLC has no establishment in the EU. A controller without an EU establishment that offers services to data subjects in the Union must, in principle, designate a representative in the Union under Art. 27 GDPR, unless an exemption applies — in particular where processing is occasional, does not involve large-scale processing of special categories of data, and is unlikely to result in a risk to data subjects.

[We consider this exemption likely to apply to this website. To be confirmed by counsel; if a representative is appointed, their name and address will be inserted here.]

10. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority.

11. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to and deletion of your personal information, to correct inaccurate personal information, and not to be discriminated against for exercising your rights.

Categories we process on this website: identifiers (e.g. IP address, and — if you register or subscribe — your name, email address and company), internet/network activity (e.g. analytics data), and audio or visual information where you choose to contribute to a recorded session, as described in sections 3 to 8.
Sale / sharing: we do not sell your personal information, and we do not share it for cross-context behavioural advertising.
How to exercise your rights: contact us at aaron@ninja.partners. We verify requests using the email or account information associated with you.

12. Changes to this policy

We may update this Privacy Policy to reflect changes to our processing or legal requirements. The current version applies.