PRIVACY AND PERSONAL DATA PROTECTION POLICY

KAYO'S PERSONAL DATA PROTECTION POLICY

The purpose of this Notice is to fulfill the information obligation set forth in Articles 6 and 13 of the European General Data Protection Regulation (GDPR 2016:679 of April 27, 2016).
It is issued by KAYO, acting as a Data Processor, on behalf of the Exhibitor, acting as the Data Controller within the meaning of the aforementioned Regulation.
INTRODUCTORY STATEMENT
KAYO is a company in the event marketing sector, with a primary focus on trade shows.
It offers Exhibitors an IT service that enables them to share their materials and generate qualified leads from their prospects and customers.
This Service is provided to Exhibitors for their exclusive use.
It is provided through two types of media:
- Devices visible to the customer (Front Office).
These include mobile devices such as kiosks, tablets, laptops, etc.
- Devices not visible to the customer (Back Office).
These are servers accessible via SaaS, hosted in the cloud.
Under the GDPR:
- KAYO’s Client (the Exhibitor) acts as the Data Controller, since it is the sole entity that determines the scope of the measures to be implemented and the purpose of processing the data collected using the tools provided by KAYO
Furthermore, the Client is the sole user of the collected data.
- KAYO acts as a Data Processor, without, however, ever using the data collected using the tools it provides.
The following provisions are intended to clarify the policy regarding the protection of personal data collected by the Exhibitor using the tools provided by KAYO.
These provisions are set forth without prejudice to the data protection policy that the Exhibitor, as the Data Controller, is required to adopt for the same purposes.
The following provisions are organized into three parts:
- Provisions common to all media (A)
- Elements specific to fixed media (B)
- Elements specific to mobile media (C)
1. ELEMENTS COMMON TO ALL MEDIA
NAME AND CONTACT INFORMATION OF THE EXHIBITOR, DATA CONTROLLER
Company Name, Legal Representative (if applicable), Legal Form, Registered Office, Commercial Registry Number, Phone, Email.
IMPORTANT NOTE
In some cases, the Exhibitor may delegate the use of the tools provided by KAYO to another company.
In this case, that company shall be considered the Exhibitor for the purposes of this document and, consequently, the Data Controller.
PROCESSOR
KAYO (hereinafter referred to as “KAYO” in this document)
Represented by its Chief Executive Officer, Mr. Nicolas Gendrot
SAS with capital of €143,286
RCS Rouen: 753 315 647
6 rue Morand, 76000 Rouen
Tel: 02 78 77 50 00
www.KAYO.fr
Email: info@KAYO.fr
CATEGORIES OF DATA PROCESSED
Unless otherwise specified, the data processed using KAYO applications generally includes the following: username, password, first and last name, job title, email address, work landline, work cell phone, cookies, documents, and activity reports.
USE OF PROCESSED DATA
Purpose
Unless otherwise specified, the primary purpose of data processing carried out using KAYO applications is to manage prospects and customers.
Confidentiality
KAYO undertakes to keep the collected data strictly confidential and shall not use it for any purpose whatsoever, except for system maintenance or anonymization.
RECIPIENTS OF PROCESSED DATA
Employees and contractors authorized by the Exhibitor are the sole recipients of the processed data.
DATA RETENTION PERIOD
Unless otherwise instructed by the Exhibitor, the data will be deleted no later than 12 months after the event during which it was collected.
USER RIGHTS: ACCESS, CORRECTION, OBJECTION, DATA PORTABILITY, RESTRICTION, ERASURE
Objection
Automatically collected Personal Data (including IP addresses and cookies) is used to generate statistics regarding visits to the Services’ web pages and to link them to the user’s account.
The data subject therefore has the right to object to this processing, which can be exercised when logged into their account.
This objection will be linked to the user’s account and will remain valid regardless of the device used to access the account.
Account Deletion
The data subject may request the deletion of their account.
Their personal data will be deleted, and any contributions they may have made (comments, questions, answers) will be anonymized.
Access, Rectification, Erasure, Restriction, Withdrawal of Consent
The data subject has the right to access, rectify, erase, object to, or restrict the processing of their data, as well as to withdraw their consent.
They may also provide instructions to KAYO regarding the use of their data after their death.
Procedures for the Data Subject to Exercise All of the Rights Described Above
The data subject may exercise their rights at any time as follows:
- electronically, by sending a request to the following address: info@KAYO.fr,
or
- by mail to the following address: KAYO, 6 Rue Morand, 76000 Rouen
The data subject may be asked to provide proof of identity.
They also have the right to file a complaint against the Data Controller, KAYO, and its processors with the French data protection authority, the CNIL. www.cnil.fr
2. PROTECTION OF DATA STORED ON FIXED MEDIA
PROTECTION OF PROCESSED DATA
Technical Measures
The technical infrastructure of KAYO’s Information System is governed by an IT outsourcing contract entered into with:
SYNALABS
SARL with capital of €11,500
Paris Trade and Companies Register (RCS): 502 178 429
103 Rue de Réaumur
75002 Paris
Under the GDPR, this company acts as a data processor for KAYO.
This applies to both data processing operations and the technical measures for protecting personal data collected through KAYO applications.
The personal data protection policy implemented by the Exhibitor is therefore carried out through its first-tier processor, KAYO, and its second-tier processor, SYNALAB.
For this reason, the obligations undertaken by SYNALABS under the terms of the aforementioned outsourcing agreement are reproduced below in italics.
Article 7. Protection of Client Data
Confidentiality
Any information concerning the Client or relating to its business that the Company becomes aware of in the course of its assignment shall be strictly confidential and must be safeguarded using the same means and procedures as those used for its own confidential information. Such information may not be disclosed and/or communicated to third parties without the prior written authorization of the relevant party, unless such disclosure or communication is required of the Company pursuant to Articles 434-1 and 434-3 of the Penal Code.
Personal Data
The Company is hereby informed that the IT system operated under the Contract processes, among other things, personal data.
In this regard, it is expressly agreed between the parties that the Client remains solely responsible for the processing and retains full control over its database, with the Company acting solely as a data processor within the meaning of the legal provisions relating to the protection of personal data.
In connection with the performance of the Contract, the Company undertakes to respect the purpose of the processing, to act exclusively on behalf of the Client, based on the terms of the Contract and solely on the Client’s instructions and in accordance with them (no use for its own purposes or on behalf of third parties).
It undertakes to comply with the obligations set forth in European Regulation 2016/679 concerning data processors, and in particular Articles 28 and 29 thereof.
In particular, the Company undertakes:
- If it directly carries out the processing activities (collection, storage, etc.), to ensure that such activities take place within the territory of one of the member states of the European Union;
- If it engages a processor, to ensure, including through contractual means, that processing activities (collection, storage, etc.) take place within the territory of one of the member states of the European Union;
- If it engages a subcontractor at the Client’s request, it shall assist the Client to the best of its ability so that the Client may obtain such guarantees, including contractual ones.
In general, any outsourcing by the Company may only take place with the Client’s prior consent, and the Company must ensure that the obligations set forth in these general terms and conditions are also included in the contract with its subcontractor.
Security
In accordance with applicable regulations, the Company undertakes to take all necessary precautions to safeguard the security of the information processed during its handling, and in particular to protect it against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, or unauthorized access. This commitment includes using a software and hardware environment that incorporates available security patches and measures designed to combat known malware, and, where applicable, implementing state-of-the-art security procedures (database encryption, etc.).
In accordance with European Regulation 2016/679, the Company assists the Client in ensuring compliance with relevant obligations, particularly those related to security, taking into account the nature of the processing and the information at its disposal, for example by providing the Client with relevant information enabling it to demonstrate compliance with regulatory obligations (the Company’s Security Assurance Plan, PSSI, etc.).
In order to maintain the security of the IT System, the Company is required to implement access control solutions (to the Monitoring Console, etc.) and therefore to provide the Customer with authentication methods such as “username/password” pairs, etc. The Company reminds the Customer of the importance not only of immediately changing any temporary passwords it may have provided, but also of choosing strong passwords and storing them under appropriate security and confidentiality conditions.
Any authentication of the Customer using the means made available to them by the Company shall be deemed to have been performed by the Customer.
The Company further undertakes to provide, upon the Customer’s request, all logs recorded over a rolling one-year period.
In accordance with the aforementioned European Regulation 2016/679, the Company:
- immediately informs the Client if, in its opinion, an instruction constitutes a violation of this Regulation or other provisions of Union law or the law of Member States relating to data protection; - notifies the Client of any personal data breach as soon as possible after becoming aware of it. The Company further undertakes to coordinate its communication with the Client regarding this breach vis-à-vis any third party, including regulators. - at the Client’s discretion, delete all personal data or return it to the data controller upon completion of the services related to the processing, and destroy any existing copies, unless required by mandatory legal provisions; - provide the Client with all information necessary to demonstrate compliance with the obligations set forth in the European Regulation and to enable the Client or another auditor appointed by the Client to conduct audits, including inspections, and cooperate with such audits.
In connection with the implementation of the Services described in the Appendix, the Company may be required to install and maintain security solutions such as a firewall. The Client acknowledges and agrees that if, as part of the operation of these solutions and in order to address any actual or suspected security risks, restrictions on third-party access to the IT System—or even to certain functionalities—must be implemented (e.g., IP filtering, etc.), such restrictions would necessarily apply to all customers using the Customer’s IT System managed by the Company.
It is the Client’s responsibility to implement all necessary security procedures and techniques that fall outside the strict scope of the services provided by the Company (information classification, encryption, need-to-know, etc.) and which are therefore not the responsibility of the Company.
Just as it would take the necessary measures with respect to its other clients to ensure that they do not compromise the security of the Client’s IT System, the Company reserves the right to suspend, at any time and in whole or in part, access to or the functionality of the Service if maintaining said Service would compromise the security of its own IT systems or those of its own clients (bounce-back hacking, etc.).
With regard to organizational measures
KAYO has implemented various initiatives to raise its staff’s awareness of the legal requirements regarding the protection of personal data.
It has provided them with a Notice of Information regarding the processing of their personal data.
It has amended its Internal Regulations to make the personal data protection rules established by law enforceable against employees.
It is updating its contracts with its clients, specifically by making this document an appendix to the Service Agreement it enters into with them.
3. PROTECTION OF DATA ON MOBILE DEVICES
DEVICES COVERED
“Mobile device” means:
- an interactive kiosk located at the Exhibitor’s booth,
- tablet,
- laptop,
- Box.
GENERAL SECURITY MEASURES
Access to the application requires a username and password.
Data entered on mobile devices is encrypted.
As soon as mobile devices are connected to the internet, data is automatically transferred to the servers.
From that point on, the data transferred in this manner is subject to the security measures described above for fixed devices.
Data entered on mobile devices is automatically deleted immediately after it is transferred.
RESPONSIBILITIES
It is the Exhibitor’s responsibility to connect to the Internet as often as possible to transfer the data entered on mobile devices to the servers.
During the period between the collection of data on mobile storage devices and its transfer to fixed storage devices, the Exhibitor bears sole responsibility for that data.

Last updated: October 2026

KAYO places particular importance on the protection of personal data and respect for privacy.

The purpose of this policy is to provide you with clear and transparent information about the personal data that may be processed by KAYO, the reasons for its use, the recipients of such data, how long it is retained, and your rights.

It applies in particular to the use of the website www.kayo.fr, communications with KAYO, and data processing carried out by KAYO on its own behalf.

This policy is established in accordance with Regulation (EU) 2016/679 of April 27, 2016 (“GDPR”) and the amended French Data Protection Act.

1. IDENTITY OF THE DATA CONTROLLER

When KAYO determines the purposes and essential means of processing personal data, the data controller is:

KAYO SAS
7 rue des Patis
76140 Le Petit-Quevilly
France

SIREN: 753 315 647
SIRET: 753 315 647 00036
RCS Rouen

Phone: 02 78 77 50 00
Website: www.kayo.fr
Email: dpo@kayo.fr

2. KAYO’S ROLE IN DATA PROCESSING

KAYO acts as the data controller when it independently determines the purposes and essential means of data processing.

This includes, in particular:

  • managing its customers, prospects, and partners;
  • managing contact requests;
  • the management of its business and contractual relationships;
  • managing its own communications and marketing initiatives;
  • the administration of its website;
  • measuring website traffic and usage when such tracking is implemented;
  • managing electronic communications and, where permitted, measuring their effectiveness;
  • the security of its information systems and services;
  • compliance with its legal, regulatory, accounting, and tax obligations.

3. CATEGORIES OF DATA PROCESSED

Depending on your relationship with KAYO and the services you use, KAYO may process the following categories of data.

Identification Data

Including:

  • last name;
  • first name;
  • company;
  • job title or position held.

Business contact information

Including:

  • email address;
  • work phone number;
  • business address.

Data related to the business relationship

Including:

  • inquiries;
  • communication history;
  • information regarding services purchased;
  • documents exchanged;
  • information necessary for managing the relationship with a customer or prospect.

Data related to user accounts

In particular:

  • username;
  • authentication information;
  • access rights;
  • technical history associated with the account.

KAYO does not store user passwords in plain text.

Technical and Browsing Data

Depending on the services used:

  • IP address;
  • information about the browser and device;
  • technical and connection logs;
  • pages viewed;
  • information from cookies or similar technologies;
  • interactions with certain features of the site.

Data Related to Electronic Communications

When the relevant features are used and authorized, KAYO may process certain information related to sent communications, including:

  • delivery of an email;
  • opening of an email;
  • the date and time of certain interactions;
  • clicks on a link;
  • technical information associated with these interactions.

KAYO ensures that it collects only data that is adequate, relevant, and necessary for the purposes pursued.

4. PURPOSES AND LEGAL BASES FOR DATA PROCESSING

When KAYO acts as the data controller, data processing may be carried out, in particular, for the following purposes and on the following legal bases.

Customer management and service provision

Purposes:

  • creating and managing accounts;
  • provision of services;
  • managing orders and services;
  • assistance and support;
  • management of the contractual relationship.

Legal basis: performance of a contract or pre-contractual measures.

Management of contact requests and leads

Purposes:

  • responding to inquiries sent to KAYO;
  • organizing demonstrations;
  • preparing sales proposals;
  • follow up on potential business relationships.

Legal basis: pre-contractual measures and, depending on the situation, KAYO’s legitimate interest in developing its business.

Marketing and Commercial Communications

Purposes:

  • to present KAYO’s services;
  • to send commercial information;
  • follow up with prospects;
  • inform customers about services that may be of interest to them.

Legal basis: depending on the circumstances, KAYO’s legitimate interest or the data subject’s consent when required by law.

Each recipient has the right to object to marketing communications under the conditions set forth by regulations.

Measuring Electronic Communications

Purposes:

When this feature is enabled, KAYO may track certain interactions with its emails, in particular to:

  • assess the effectiveness of its communications;
  • track open rates;
  • to improve the relevance of the communications sent.

Legal basis: consent when required by applicable regulations.

The terms and conditions are detailed in the “Email Tracking” section.

Website Operation and Improvement

Purposes:

  • to ensure the website functions properly;
  • to measure its usage when permitted;
  • to improve its usability and content;
  • ensure the security of the service.

Legal basis: KAYO’s legitimate interest for strictly necessary operations and consent when required for the use of certain trackers.

System Security

Purposes:

  • authentication;
  • access control;
  • detection of abnormal behavior;
  • prevention of attacks and unauthorized access;
  • retention of security logs;
  • investigation in the event of an incident.

Legal basis: KAYO’s legitimate interest in ensuring the security of its services and, where applicable, compliance with legal obligations.

Legal Obligations

Certain data may be processed or retained in order to comply with the legal, regulatory, accounting, and tax obligations to which KAYO is subject.

Legal basis: compliance with a legal obligation.

5. TRACKING OF EMAILS

Certain emails sent by KAYO may include technologies that allow us to track whether they have been opened or how users interact with their content.

Tracking Pixels

When enabled, web beacons can, among other things, determine whether an email has been opened.

Depending on the technology used, certain technical information may also be generated when the email is opened, including the date and time of opening, the IP address, or certain information about the device used.

This information may be used to measure the effectiveness of KAYO’s communications and improve their relevance.

When the use of these technologies requires the data subject’s consent, they are activated only after such consent has been obtained.

The data subject may withdraw their consent at any time, just as easily as they gave it.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

Click Tracking

Certain links in emails may include parameters that allow us to measure interactions with the content provided.

When this information constitutes personal data, it is processed in accordance with the stated purposes and the applicable legal basis.

KAYO does not reuse data collected through these mechanisms for any purpose incompatible with the one stated at the time of collection.

6. COOKIES AND OTHER TRACKING TECHNOLOGIES

When you visit the www.kayo.fr website, cookies and other similar technologies may be placed on or read from your device.

Some are necessary for the website’s operation or security. Others enable us to provide features, measure website usage, or load services provided by third parties.

Where required by law, the relevant trackers are placed or read only after obtaining your consent.

6.1. Technical and Security Cookies

The KAYO website uses infrastructure services to ensure its operation and security.

Cookie Provider Purpose Estimated Duration
__cf_bm Cloudflare / HubSpot infrastructure Automated traffic detection and protection against bots About 30 minutes
_cfuvid Cloudflare / HubSpot infrastructure Security and traffic throttling, particularly to distinguish between users sharing the same IP address Session / technical duration of the service

These cookies may be used without consent when they are strictly necessary for the operation or security of the service.

6.2. HubSpot

KAYO uses the HubSpot platform, in particular for hosting and certain features of its website.

Depending on the features enabled and your consent choices, the following cookies may be used:

Cookie Purpose Estimated Duration
messagesUtk Recognition of a visitor using the chat module and continuity of the conversation Up to 6 months
__hstc Tracking visits and activity on the site Approximately 6 months
hubspotutk Technical identification of the visitor, particularly when using forms Approximately 6 months
__hssc Tracking of browsing sessions Approximately 30 minutes
__hssrc Determining the start of a new session Session

HubSpot trackers that require consent are only used after consent has been obtained.

6.3. YouTube Videos and Google Services

Certain pages on the KAYO website may embed videos hosted by YouTube, a service provided by Google.

When this content is enabled, YouTube or Google may set or read cookies to, among other things, ensure the video player functions properly, maintain service security, save certain preferences, measure interactions with the content, or—depending on the user’s settings—personalize the experience.

Cookies that may be used include, in particular:

Cookie Provider Purpose Estimated Duration
_Secure-ENID Google Preferences and operation/customization of certain Google services Approximately 13 months
__Secure-YNID Google / YouTube How YouTube Services Work, Analysis, and Personalization About 6 months
VISITOR_INFO1_LIVE Google / YouTube How YouTube Works, Analytics, and Customizing the YouTube Experience About 6 months
VISITOR_PRIVACY_METADATA Google / YouTube Preserving certain privacy choices related to YouTube Depending on service settings
YSC Google / YouTube YouTube session functionality and security Session
__Secure-ROLLOUT_TOKEN Google / YouTube Gradual rollout of features and measurement of their usage Approximately 6 months

Using YouTube content may also result in certain technical information being transmitted to Google, including the device’s IP address and the URL of the page being viewed.

When these operations require your consent, the relevant trackers are only activated after you have made your selection.

6.4. Managing Your Preferences

When you first visit the site, a consent management tool allows you to accept or reject the categories of trackers subject to consent.

You can withdraw your consent or change your preferences at any time using the cookie management tool available on the site.

Rejecting optional cookies does not prevent access to the site’s essential features. However, certain features provided by third parties—such as playing certain videos or using certain interactive tools—may be unavailable until the trackers necessary for their operation have been authorized.

The list of cookies is subject to change depending on the services used by KAYO and any changes made by the relevant providers.

7. RECIPIENTS OF THE DATA

Access to personal data is limited to individuals who need it to perform their duties and within the scope of their authorizations.

Depending on the specific processing activities, the data may be accessible to:

  • authorized KAYO employees;
  • technical service providers acting on behalf of KAYO;
  • to hosting and infrastructure providers;
  • service providers responsible for the maintenance and security of the services;
  • to providers of communication, customer relationship, or analytics tools used by KAYO;
  • to administrative or judicial authorities when required by law.

Service providers processing data on behalf of KAYO are contractually bound in accordance with the requirements of the GDPR.

When KAYO itself acts as a processor, access to data is limited to authorized individuals and processors in accordance with the instructions of the client acting as the data controller.

8. MAIN SERVICE PROVIDERS

KAYO may use the following categories of service providers, among others:

  • HubSpot: website hosting, management of certain web features, and customer relationship management tools;
  • Cloudflare, particularly through the infrastructure used by certain services: security, protection against bots, and traffic management;
  • Google / YouTube: provision and integration of video content;

This list may change depending on the services used by KAYO.

9. RETENTION PERIODS

KAYO retains personal data only for as long as necessary to fulfill the purposes for which it was collected.

Retention periods may vary depending on the nature of the processing.

Customer Data

Data necessary for managing the contractual relationship is retained for the duration of that relationship.

Certain data may subsequently be archived for the periods necessary to comply with KAYO’s legal obligations or to establish, exercise, or defend legal rights.

Data relating to prospects

Data is retained for as long as necessary to manage the business relationship and in accordance with the retention periods permitted by applicable regulations.

Security data and technical logs

This data is retained for a period commensurate with its security purpose and the risks involved.

Data from cookies and trackers

This data is retained for periods corresponding to the trackers in question and within the limits set forth by applicable regulations.

Data related to electronic communications

Information derived from communication monitoring tools is retained only for as long as necessary to fulfill the stated purpose.

At the end of the applicable retention periods, the data is deleted or anonymized, unless further retention is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.

10. RIGHTS OF DATA SUBJECTS

Depending on the specific processing activity and its legal basis, you may have the following rights:

  • the right to access your personal data;
  • the right to have inaccurate or incomplete data corrected;
  • the right to erasure of your data under the conditions set forth in the GDPR;
  • the right to restrict processing;
  • the right to object to certain processing activities, particularly those based on legitimate interests;
  • the right to data portability when the conditions set forth in the GDPR are met;
  • the right to withdraw your consent at any time when the processing is based on it.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

You may also object at any time to the use of your data for direct marketing purposes.

Exercising Your Rights When KAYO Is the Data Controller

You may submit your request to:

By email:
dpo@kayo.fr

By mail:
KAYO SAS
7 rue des Patis
76140 Le Petit-Quevilly
France

To protect your data, KAYO may ask you for additional information to verify your identity when there is reasonable doubt regarding it.

11. FILING A COMPLAINT WITH THE CNIL

If, after contacting KAYO, you believe that your rights regarding your personal data have not been respected, you may file a complaint with the French data protection authority:

Commission Nationale de l’Informatique et des Libertés (CNIL)
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France

Website: www.cnil.fr

12. CHANGES TO THIS POLICY

KAYO may modify this policy to take into account, in particular:

  • changes to its services;
  • changes in its practices;
  • changes in the technologies used;
  • changes regarding its service providers;
  • changes in laws or regulations.

The date of the last update is indicated at the top of this policy.

In the event of a substantial change affecting the processing of personal data, KAYO may notify the individuals concerned of this change by appropriate means.

Last updated: October 2026