Privacy notice

Who is responsible for your data

Synapse AI Group Oy (business ID 3656890-9), Palomäentie 34 A 3, 33230 Tampere, Finland, is the data controller. For any privacy question, email accounts@synapsesummit.ai.

What data we collect

• Contact and attendee details: your name, email address, address, company and role level, and the answers you give at checkout. If you choose to give them: your mobile number, LinkedIn profile, industry, t-shirt size and how you heard about the Summit.
• Order details: ticket type, add-ons, payment status and your organisation's invoicing details. Stripe handles card details, and we never see your full card number.
• Expression of interest: your name and email, and any optional answers you give in our expression-of-interest form.
• News sign-up: your email address, if you sign up for news and updates about the Summit.
• Invitations: if we invite you personally, your name, company and role, and the work email address or LinkedIn profile we contact you through.
• Messages: what you write when you email us, or when you report a concern under our code of conduct.
• At the Summit: check-in records, and photos and video of the event.
• On our website: technical data such as your IP address, which our hosting provider needs to deliver and protect the site.
• Dietary and accessibility needs: allergies, special diets and accessibility needs you choose to tell us at checkout, so that we can arrange catering and access for you. Some of this, such as allergies or a religious diet, counts as sensitive information under data protection law, so these questions are optional and we use your answers only with your consent.

Where we get your data

Mostly from you. If someone else bought your ticket, for example a colleague or your employer, we get your name, contact details and the answers they gave for you at checkout from them.

If we invite you personally, we got your name, company, role and contact details from our own professional networks or from public professional sources, such as your LinkedIn profile. Each invitation tells you which.

The checkout shows which details are required. We need them to sell you a ticket and let you in, so without them we cannot complete your order.

Why we use your data

For each purpose below, we list the data we use, our legal basis under the GDPR, and how long we keep the data.

Tickets, admission, badges, refunds and transfers

Data

Order and attendee details

Legal basis

Performance of a contract (GDPR article 6(1)(b))

Kept for

12 months after the Summit

Bookkeeping and tax

Data

Orders, invoices and payments

Legal basis

Legal obligation (GDPR article 6(1)(c)) under the Finnish Accounting Act

Kept for

6 years after the end of the financial year, and 10 years for the accounts themselves

Practical information about the Summit

Data

Name, email and, if you give it, mobile number

Purpose

Sending you practical information about the Summit by email and text message, such as a welcome message, schedule updates and urgent changes. Never marketing

Legal basis

Performance of a contract (GDPR article 6(1)(b))

Kept for

Until the Summit ends

Understanding our audience

Data

How you heard about us, role level, industry and country

Purpose

Seeing where participants come from, and sharing statistics with our partners that never identify you (for example, how many participants work in each industry)

Legal basis

Our legitimate interest in planning and promoting the Summit (GDPR article 6(1)(f))

Kept for

12 months after the Summit. Statistics that don't identify anyone may be kept longer

T-shirts and LinkedIn

Data

T-shirt size and LinkedIn profile, if you give them

Purpose

Ordering event t-shirts if we give them out, and connecting with you on LinkedIn

Legal basis

Our legitimate interest in running the Summit and staying in touch with participants (GDPR article 6(1)(f)). Both questions are optional

Kept for

Until the Summit ends

Expression of interest

Data

Name, email and any optional answers

Purpose

Telling you when tickets go on sale and sending you news and updates about the Summit

Legal basis

Your consent, given in the expression-of-interest form (GDPR article 6(1)(a))

Kept for

Until you unsubscribe, which you can do at any time

News and updates about the Summit

Data

Your email address, and when you gave your consent

Purpose

Sending you news and updates as the Summit takes shape, such as themes, speakers and programme news. A few emails before the Summit, never more than twice a month

Legal basis

Your consent, given in our news sign-up form (GDPR article 6(1)(a))

Kept for

Until you unsubscribe, which you can do at any time by replying to any of our emails

Inviting people to the Summit

Data

Name, company, role, and work email address or LinkedIn profile

Purpose

Sending a personal invitation to people we think will find the Summit relevant to their work. Each invitation says who we are and how we got your details, links to this notice, and tells you how to ask us to stop

Legal basis

Our legitimate interest in promoting the Summit (GDPR article 6(1)(f)). You can object at any time, and we then stop contacting you

Shared with

LinkedIn, if we message you there. LinkedIn handles the message as an independent controller under its own privacy policy

Kept for

Until the Summit ends. If you buy a ticket, we keep your ticket details as described above

Do-not-contact list

Data

The email address or LinkedIn profile we used to contact you

Purpose

Making sure we don't contact you again after you object or unsubscribe

Legal basis

Our legitimate interest in respecting your choice (GDPR article 6(1)(f))

Kept for

As long as Synapse AI Group Oy organises events

Ticket waiting list

Data

Name and email

Purpose

Telling you if tickets become available after a tier sells out

Legal basis

Your consent, given when you join the list in Ticket Tailor (GDPR article 6(1)(a))

Kept for

Until the Summit ends

News about future events by Synapse AI Group Oy

Data

Name and email

Legal basis

Your consent (GDPR article 6(1)(a)), given when you sign up or tick the box at checkout. Every email tells you how to unsubscribe.

Kept for

Until you unsubscribe, which you can do at any time

Our LinkedIn page and events

Data

If you follow our LinkedIn page, message it or register for an event we publish there: your LinkedIn name and profile, your message and your registration. LinkedIn also gives us page statistics, which show only totals and never identify you

Purpose

Running our company page, answering messages and seeing who plans to attend our events

Legal basis

Our legitimate interest in promoting the Summit and staying in touch (GDPR article 6(1)(f))

Shared with

LinkedIn. For page statistics, LinkedIn and Synapse AI Group Oy are joint controllers under LinkedIn's terms for page admins, and LinkedIn handles your requests about them. Otherwise LinkedIn acts as an independent controller under its own privacy policy

Kept for

Event registrations until the event ends; messages as described under “Your emails to us”

Wall of Fame and speaker evaluation

Data

Name, company and email

Legal basis

Your consent, given when you choose the add-on (GDPR article 6(1)(a))

Kept for

Until the Summit ends. Wall of Fame photos are kept as described under event photos.

Speakers and advisers we feature

Data

Name, title, company, photo, a short profile and your LinkedIn link, as you give them to us

Purpose

Presenting our speakers and advisers on our website, in the programme and in our posts about the Summit

Legal basis

Your consent, given when you approve your profile (GDPR article 6(1)(a)). You can withdraw it at any time, and we take your profile down within two weeks

Kept for

While you are a speaker or adviser, or until you ask us to take your profile down

Event photos and video

Data

Images of attendees

Legal basis

Our legitimate interest in reporting on and promoting the Summit, on our website, social media and in event reports (GDPR article 6(1)(f)). You can opt out at registration or object later.

Kept for

Up to 5 years, with a selection kept longer in our event archive

Feedback surveys

Data

Your answers and email

Legal basis

Our legitimate interest in improving future events (GDPR article 6(1)(f))

Kept for

24 months

Your emails to us

Data

Your name, email address and what you write

Legal basis

Our legitimate interest in answering you (GDPR article 6(1)(f))

Kept for

24 months after our last contact

Code of conduct reports

Data

The report, the names of the people involved and what happened. A report can include sensitive information, such as details about someone’s health or sexual orientation.

Legal basis

Our legitimate interest in keeping the Summit safe and handling concerns (GDPR article 6(1)(f)). We handle sensitive information only with the explicit consent of the person it concerns, or where it is needed to establish or defend legal claims (GDPR article 9(2)(a) and (f)).

Kept for

As long as needed to handle the report, normally no longer than 24 months

Website security

Data

Your IP address, technical details of your browser, and the pages you request

Legal basis

Our legitimate interest in keeping the website secure and available (GDPR article 6(1)(f))

Kept for

Only as long as our hosting provider, Cloudflare, keeps its standard security logs. We keep no website logs of our own.

Visit statistics

We see total visit numbers from Cloudflare's own traffic statistics, with no cookie or script and no tracking of individuals

Dietary and accessibility needs

Data

Allergies, special diets and accessibility needs you tell us at checkout

Purpose

Arranging catering and access for you at the Summit

Legal basis

Your explicit consent, given at checkout (GDPR articles 6(1)(a) and 9(2)(a)). The questions are optional, and you can withdraw your consent at any time.

Shared with

The venue and its catering, only as far as they need it to serve you

Kept for

Until the Summit ends, and deleted within 30 days after it

Cookies

Our website sets no cookies of its own and uses no analytics scripts, advertising or social media tracking, so we do not ask for cookie consent.

Cloudflare, which hosts and protects the website, may set a strictly necessary security cookie, such as __cf_bm or cf_clearance, when it needs to check that a visitor is a person and not an automated program. These cookies are not used to track you, and they expire after a short time.

Ticket Tailor, Stripe and Typeform set their own cookies when you use their pages. Their own privacy and cookie notices apply there.

If we start using analytics or any other cookies, we will update this notice first, and ask for your consent before setting any cookie that needs it.

Who we share your data with

We do not sell your data. We do not share attendee lists or contact details with partners or sponsors. We share only statistics that don't identify anyone, for example how many participants come from each industry.

A partner at the Summit only gets your details if you give them directly, for example by exchanging business cards or letting them scan your badge. That partner is then responsible for your data. For Executive Roundtables run with a partner, we share your name and contact details with that partner only if you agree first.

We may also share data with the venue, Sokos Tripla Conference Centre, when it is needed for safety, and with the venue’s catering when it needs your dietary needs to serve you. We share data with authorities when the law requires it, and with venue security or the police when someone's safety is at risk.

Service providers we use

These companies process data on our behalf, under data processing agreements (where appropriate):

• Ticket Tailor: ticket sales, waiting list and check-in. Processed in the United Kingdom, which has an EU adequacy decision.
• Stripe: card payments, including Link, Stripe's optional service for saving payment details at checkout. Processed in the EU and the USA under the EU–US Data Privacy Framework. Stripe is also an independent controller for its own legal duties, such as preventing fraud and money laundering, as described in Stripe’s privacy policy.
• Klarna and MobilePay/Vipps: optional payment methods at checkout, offered through Stripe. If you choose one, Klarna (Klarna Bank AB, Sweden) or MobilePay/Vipps (Vipps MobilePay AS, Norway) handles your payment as an independent controller under its own privacy notice. Both are based in the European Economic Area.
• Google Pay and Apple Pay: optional ways to pay by card at checkout, offered through Stripe on supported devices and browsers. If you choose one, the provider of Google Pay or Apple Pay handles your payment details as an independent controller under its own privacy notice. We receive only the order and payment status from Stripe, as with any card payment.
• Typeform: the expression-of-interest form, other forms and surveys. Processed in the EU and the USA under standard contractual clauses. The Typeform account for the expression-of-interest form and the news sign-up form is held on our behalf by Actineo Consulting LLP, in the United Kingdom (which has an EU adequacy decision), under a written agreement.
• Google Workspace: email, documents and its built-in AI assistant, Gemini. Processed in the EU and the USA under the Data Privacy Framework.
• Cloudflare: website hosting and security. Processed globally under the Data Privacy Framework and standard contractual clauses.
• Sanity: the content of our website, including the profiles and photos of people we feature. Provided by Sanity US Inc., USA. Hosted mainly in the EU (Belgium), with some processing in the USA under standard contractual clauses.
• Anthropic (Claude): AI assistance for event administration and automations, and for website content. Processed in the USA under standard contractual clauses.
• OpenAI (ChatGPT): AI assistance for event administration. Processed in the USA under standard contractual clauses.
• Our accounting firm (Mintti Tilipalvelu Oy): bookkeeping, VAT returns and tax. Processed in Finland.
• Fennoa: invoicing and accounting software, used by us and our accounting firm. Provided by Fennoa Oy, Finland.
• Sessionize: the speaker evaluation. If you join it, we give Sessionize your name and email so it can invite you to review session proposals. Provided by Web-ideja Ltd, which may process data outside the European Economic Area with appropriate safeguards.

You can ask us for a copy of the safeguards that protect your data outside the EU, such as the standard contractual clauses.

How we use AI tools

We use AI services from Anthropic (Claude), OpenAI (ChatGPT) and Google (Gemini, inside our Google Workspace) to help run the Summit. For example, they help us process registrations and orders, choose who to invite and draft personal invitations, draft and sort emails, answer questions, and keep our planning documents, website content and systems up to date. These services may process your name, contact details, company, role and LinkedIn profile, order details and the messages you send us, and, for our website, the profiles and photos of the people we feature on it.

They act as our processors under data processing agreements, and those agreements do not allow them to use our data to train their models. We do not use AI to make decisions about you that have legal or similarly significant effects. A person on our team stays responsible for decisions such as refunds or refused entry, and reviews and sends every invitation.

Your rights

You can ask us to:

• show you the data we hold about you
• correct it
• delete it
• restrict how we use it
• give it to you in a portable format

You have the right to object. You can object at any time to processing based on our legitimate interest, including event photos and invitations. If you object to invitations or unsubscribe from our emails, we stop sending them, and keep the email address or LinkedIn profile we used on a do-not-contact list so that we don't contact you again. You can also withdraw your consent at any time. Withdrawing consent does not affect processing that happened before. Email accounts@synapsesummit.ai and we will reply within one month. If a request is complex, we may need up to two more months, and we will tell you so within the first month.

How to complain

If you are unhappy with how we handle your data, please contact us first. You can also complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi) or to the data protection authority where you live or work.

How we keep your data safe

Only the people who need your data for the Summit can access it. Our accounts use two-factor authentication, and our service providers are bound by data processing agreements (where appropriate).

Changes to this notice

We may change this notice at any time, for example when we start using a new service provider or the law changes. The current version is always published at synapsesummit.ai/privacy, with the date it was last updated. A change never reduces your rights under data protection law. If a change significantly affects how we use data we already hold about you, we will tell you by email before it takes effect, and ask for your consent where the law requires it.