Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Koh Labs LLC
30 N Gould St, Ste N
Sheridan, WY 82801, US
Email: aaron@ninja.partners

2. Scope & legal framework

Koh Labs LLCis established in the United States and has no establishment in the EU. We process personal data of visitors in the EU/EEA in accordance with the EU General Data Protection Regulation (GDPR), which applies to us because we offer services to, and monitor the behaviour of, visitors in the Union (Art. 3(2) GDPR). For visitors in California, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) applies. Where national e-privacy rules apply in a visitor's country (for example § 25 TDDDG in Germany), storing or reading non-essential information on your device requires your prior consent.

3. Hosting & server logs

This website is hosted by Vercel Inc. When you access the site, technical data (e.g. IP address, browser type, time of request) is processed to deliver the site securely. Legal basis: our legitimate interest in operating a secure and stable website (Art. 6(1)(f) GDPR).

4. Cookies & consent

We use strictly necessary cookies to operate the site and to remember your cookie choice. Non-essential cookies and similar technologies (analytics, marketing) are only set after you give consent via our cookie banner. Consent is voluntary and can be withdrawn at any time with effect for the future via Cookie settings.

Legal basis for consent-based processing: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

5. Google Analytics 4

With your consent, we use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). GA4 uses cookies and similar identifiers to analyse how visitors use the site. IP addresses are not stored in raw form by GA4. We operate Google Consent Mode v2: no analytics cookies are set until you consent.

Recipient: Google Ireland Limited / Google LLC.
Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
Retention: user- and event-level data is retained for 2 months. Aggregated standard reports are retained independently of this setting.
Third-country transfer: data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection.

6. Marketing & advertising

We currently do not use advertising, remarketing or social-media tracking tools on this website. Should we introduce such tools in the future (for example LinkedIn Insight Tag, Meta Pixel or Google Ads), we will update this policy and load them only after you give your consent. Legal basis for any future consent-based processing: Art. 6(1)(a) GDPR and § 25(1) TDDDG.

7. Contact by email

If you contact us by email, the data you provide will be processed to handle your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual / contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

8. Newsletter, event registration & recordings

Registering for an intelligence.md session. When you register for one of our online sessions we process your name, your email address and, if you choose to give it, your company name. Submitting the form does not yet store anything: we send you a confirmation email, and only when you click the link in it is your registration recorded. Legal basis: Art. 6(1)(b) GDPR — we process this data to provide the service you asked for.

Newsletter. Our newsletter is a separate, optional opt-in with its own tick box, and we use the same confirmed-opt-in step. Signing up for the newsletter is never a condition of attending a session (Art. 7(4) GDPR), and declining it never removes you from a list you are already on. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, using the unsubscribe link in every email or by writing to aaron@ninja.partners.

Processor: we send these emails and keep the corresponding contact lists with Brevo (Sendinblue GmbH, Germany), which acts as our processor under a data processing agreement pursuant to Art. 28 GDPR. Brevo processes your email address, the data you entered in the form, and technical delivery data.

[To be completed by counsel: full registered address of Sendinblue GmbH; whether the French parent company is a party to the processing; and the retention period for registration records after a session has taken place. Newsletter contacts are kept until consent is withdrawn.]

Recordings.Our sessions are recorded. The recording is shared with registrants and published publicly on YouTube, Spotify and our social media channels. As an attendee you are not recorded: no video or audio of you is captured, your camera and microphone stay off, and only the speakers appear. Two things can change that, and only if you choose them. If you ask to join the conversation live during the session, you are part of the recording from that moment on. And a question you type in the chat or the Q&A may be read out and answered on the recording, which is public. Legal basis: our legitimate interest in documenting and publishing our sessions (Art. 6(1)(f) GDPR); where you actively choose to contribute by voice or on camera, your consent (Art. 6(1)(a) GDPR), which you may withdraw.

[To be completed by counsel: the session platform provider and its role, how long recordings are retained, and the platforms the recording is published on as recipients of that content.]

9. EU representative (Art. 27 GDPR)

Koh Labs LLC has no establishment in the EU. A controller without an EU establishment that offers services to data subjects in the Union must, in principle, designate a representative in the Union under Art. 27 GDPR, unless an exemption applies — in particular where processing is occasional, does not involve large-scale processing of special categories of data, and is unlikely to result in a risk to data subjects.

[We consider this exemption likely to apply to this website. To be confirmed by counsel; if a representative is appointed, their name and address will be inserted here.]

10. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority.

11. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to and deletion of your personal information, to correct inaccurate personal information, and not to be discriminated against for exercising your rights.

Categories we process on this website: identifiers (e.g. IP address, and — if you register or subscribe — your name, email address and company), internet/network activity (e.g. analytics data), and audio or visual information where you choose to contribute to a recorded session, as described in sections 3 to 8.
Sale / sharing: we do not sell your personal information, and we do not share it for cross-context behavioural advertising.
How to exercise your rights: contact us at aaron@ninja.partners. We verify requests using the email or account information associated with you.

12. Changes to this policy

We may update this Privacy Policy to reflect changes to our processing or legal requirements. The current version applies.