Conference privacy notice

Updated 30 September 2026

This notice covers The Things Conference website, ticket ordering, visitor app and partner lead scanner.

Who is responsible

The Things Industries B.V., Singel 542, 1017 AZ Amsterdam, the Netherlands, is the organiser identified in our published policies. Contact privacy@thethingsnetwork.org about conference privacy or your rights.

What we use and why

Tickets and attendance: buyer and attendee contact details, company, ticket, billing and payment status to fulfil bookings, provide entry and handle support (contract); financial records also meet legal obligations. When someone books for you, your details come from that buyer or the ticket provider.
App: email and sign-in session, profile, agenda, workshop bookings and check-ins to provide the services you request (contract). Directory visibility is optional and can be switched off in your profile. Other signed-in attendees can see the profile fields you choose to publish.
Inquiries, speaker proposals and partner applications: contact details and submitted content to assess and respond to your request (steps before a contract or our legitimate interest in organising the event). Accepted speaker biographies and programme details are published as agreed.
Security and support: limited technical logs and error reports to prevent abuse and resolve faults (legitimate interests). Avoid including sensitive information in notes or feedback screenshots.
Optional analytics: Google Analytics usage and device information only after you accept in Privacy choices (consent). Refusing does not affect attendance or access.

Entry and workshop checks are separate from partner lead sharing. Before a partner saves a lead, they must identify their company, explain the follow-up and ask permission to receive your name, company, job title and email. You can say no and still attend. Merely wearing a badge is not permission.

The representative records that you agreed, with the notice version, time, partner, edition and representative account. Scans may wait on their device while offline. Once synced, authorised members of that partner team can access them and team administrators can export them. A scan is not permission for newsletters or unrelated marketing.

Each receiving partner is responsible for its follow-up and must provide its own privacy information, retention period and contact details. To withdraw or request deletion, contact the partner or email us with the edition and partner name. Withdrawal does not undo earlier lawful processing. Exported copies require action by the receiving partner; deleting an app record cannot recall a download.

Providers and transfers

Our platform uses Supabase for accounts, database and file storage; Vercel for hosting; SendGrid for email; Stripe for payments where offered; Ticket Tailor for imported tickets; Airtable for event operations; and Sentry for error diagnostics. Only providers involved in the service you use receive the data required for their role. Google receives optional analytics, and YouTube receives connection and playback information if you load a video.

Some providers and partners operate outside the EEA. Applicable transfer safeguards, such as adequacy decisions or standard contractual clauses, must cover those transfers. Contact us for information about the safeguards for your data or a copy where available.

Retention

Retention depends on the purpose: delivering the event and resolving support, your continuing account, required accounting records, or resolving legal claims. We review whether information is still necessary; it should not be kept indefinitely simply because an event has ended. Contact us for the applicable retention period for your record and to request deletion. Partners must tell you their own retention periods.

Synced scanner copies on a device are removed during scanner housekeeping after 24 hours. Unsynced scans remain until synced or explicitly discarded, and signing out alone does not remove them. Protect shared devices and use the scanner’s discard control when appropriate.

Your choices and rights

You can request access, correction, erasure, restriction or a portable copy where applicable, object to processing based on legitimate interests, and withdraw consent. You can always object to direct marketing. Email privacy@thethingsnetwork.org, indicating the event and your request. Do not send a password, badge barcode or identity document unless we arrange a secure verification method.

We normally respond within one month. If an extension is permitted, we will explain it within that month. Some records must be retained for legal obligations; we will explain any limitation. You can complain to the Dutch Autoriteit Persoonsgegevens or your local supervisory authority.

Change directory visibility in your profile and analytics at any time through Privacy choices. Browser notification permission can be withdrawn in your browser settings. This notice is information, not a request for blanket consent.