Privacy Policy — onMESSE

Privacy PolicyWhat Lutfios LLC collects when you use onMESSE, why, and what you can ask us to do about it.Who is responsible for your dataThe controller of the personal data described here is Lutfios LLC, a limited liability company organised under the laws of the United States.For any question about this notice, or to exercise the rights described in it, write to privacy@onmesse.com. We answer rights requests within one month (thirty days for requests under Turkish data protection law).What this notice coversThis notice covers onmesse.com, the onMESSE member panel and fair area, the mobile application, and the emails we send you.onMESSE is a business platform, so most of what we hold about you is professional: your work email, your role, and the company you act for. We do not seek information about your private life, and we ask you not to send us any.The personal data we processDepending on how you use onMESSE, we process:

Account data — your email address (which is also how you sign in), first and last name, job title, the company you belong to and your role within it, country, address if you provide one, interface preferences, and the dates on which you accepted our terms, this notice and the Turkish data protection notice.

Sign-in data — one-time codes, stored only as a hash, together with the time, the attempt count and the IP address the code was requested from.

Company and team data — your company’s name, country, address and website, the colleagues invited to it and the status of those invitations.

Participation data — which fairs and editions you registered for, whether as exhibitor, buyer or agency, the package chosen, and your company’s access status and its history.

Content you publish — company profile, product and service information, media, and anything you write in messages or assistant conversations.

Communications — the emails we send you are logged in full, including recipient, subject, body and delivery status, so that we can prove what was sent and diagnose delivery failures.

Device and notification data — if you turn on notifications, the push token issued by your browser or device, along with a device description.

Measurement data — described in its own section below.

Technical data — IP address, a hash of it, the country derived from it, user agent, referrer, requested URL, and the timestamps of your requests.

Where it comes fromMost of it comes from you: what you type when signing in, onboarding or publishing.Some comes from your colleagues — when an owner or manager at your company invites you, they give us your email address before you have an account.The rest is generated automatically by your browser or device as you use the platform.Why we process it, and on what legal basisUnder the GDPR we rely on the following bases:

Performance of a contract (Art. 6(1)(b)) — creating and running your account, signing you in, connecting you to your company, handling fair registrations and access, showing your profile inside an edition you joined, and sending service emails such as sign-in codes, invitations and account notices.

Legitimate interests (Art. 6(1)(f)) — understanding how the platform is used so we can improve it, including the measurement described below; keeping the service secure and preventing abuse; keeping records of what we sent you; and defending legal claims. Where we rely on this basis you have the right to object, and we explain how below.

Consent (Art. 6(1)(a)) — marketing emails, if you opted in, and push notifications, which your browser or device asks you to allow. You can withdraw either at any time without affecting what we did before you withdrew.

Legal obligation (Art. 6(1)(c)) — accounting and tax records, and responding to lawful requests from authorities.

How we measure the platformWe measure onMESSE ourselves. There is no advertising technology on this site, no third-party analytics script, no cross-site tracking and no data brokerage — nothing about you is sold, rented or shared for advertising, ever.What we record: page views and visits, the pages and referrers involved, named events such as opening a sign-up form or requesting a sign-in code, page-performance measurements, and interaction data used to build heatmaps — where people click, where a click hits nothing, and where the pointer lingers.We also record a technical replay of some sessions: a reconstruction of what the page looked like and how it was navigated, so we can see where an interface confuses people. Masking is built into how it records, not applied afterwards: the contents of every input field are replaced before the recording leaves your browser, which means your one-time sign-in code and your email address are never captured. In our sign-up funnel we store only the domain part of an email address, never the address itself.Whether a given visit is recorded at all is decided by sampling, and recording is switched off entirely on the pages of the signed-in member panel.If you would rather not be included, you can object — see “Your rights” below — and you can block the cookies described in the Cookie Policy.CookiesonMESSE sets a small number of first-party cookies, all of them either strictly necessary or used for our own measurement. There are no advertising or third-party tracking cookies. Each cookie, its purpose and its lifetime is listed in the Cookie Policy.Who we share it withOther participants see what you publish: if your company joins an edition, the profile and content you publish for it are visible to other participants in that edition, and your name and business contact details are visible to people you contact or meet through the platform. Everyone at your company inherits your company’s access and can see what that access unlocks.We use a small number of service providers who process data on our instructions, under contract, and only for us. By category, they are: hosting and infrastructure; email delivery; push notification delivery; error and performance monitoring; AI model providers used for the assistant and matchmaking features; and search-performance data providers used for our own website analysis.We also disclose data where the law requires it, to enforce our terms, or to protect the rights and safety of users and the public. If our business is sold or reorganised, data may transfer as part of that transaction, subject to this notice.If your company signs an agreement with us that requires a named list of processors, we will provide one.Sending data outside your countryWe are established in United States, so personal data processed by onMESSE is transferred there and to the countries where our service providers operate.When we transfer personal data out of the European Economic Area or the United Kingdom, we do so under the European Commission’s Standard Contractual Clauses or another transfer mechanism permitted by applicable law, together with the technical and organisational safeguards described in this notice. For transfers abroad under Turkish data protection law, see the KVKK notice.You may ask us for details of the mechanism relied on for a specific transfer.How long we keep itOur retention rules are:

Account, company and participation data — for as long as your account exists. When an account is closed we anonymise it: the name and email are replaced, sign-in is disabled, and the account is detached from its measurement history.

Sign-in codes — a code is single-use and expires after ten minutes; the record of the request is retained as a security log.

Session replays — deleted automatically after 90 days. Everything derived from them, such as heatmaps, is aggregate and is kept.

IP addresses — the raw address is erased after ten years; an irreversible hash and the country derived from it are retained so that historical traffic figures stay consistent.

Other measurement records — retained for as long as they remain useful for understanding how the platform has developed. We do not currently apply a fixed deletion horizon to them, and we will state one here if we introduce it.

Email logs and accounting records — for as long as we need them to evidence what was sent and to meet tax and accounting obligations.

Your rightsIf the GDPR applies to you, you have the right to:

Ask what we hold about you and get a copy of it.

Have inaccurate data corrected — you can edit most of it yourself in your profile.

Ask us to erase your data, subject to records we must keep.

Ask us to restrict processing while a dispute about it is resolved.

Receive the data you gave us in a portable, machine-readable format, or have it sent to another controller where technically feasible.

Object to processing based on our legitimate interests — including our measurement of the platform — in which case we stop unless we can show compelling grounds that override your interests.

Withdraw consent at any time, for marketing emails and for push notifications.

Complain to a data protection supervisory authority, normally the one where you live or work. Complaining to us first is welcome but not required.

To exercise any of these rights write to privacy@onmesse.com. We may ask you to confirm control of the email address on the account before we act, because that address is the credential for it.Automated decisions and profilingonMESSE analyses profile and product data automatically to suggest which participants may fit each other. This is a ranking of suggestions shown to a person who then decides for themselves; it produces no legal effect and nothing similarly significant, and no one is admitted, refused or priced by an algorithm.Decisions that do matter — granting a company access to an edition, suspending an account — are made by a person.How we protect itThere are no passwords to steal: sign-in is by one-time code, codes are stored hashed and are single-use, and access to an edition is checked on the server on every request. Traffic is encrypted in transit, session cookies are encrypted and inaccessible to scripts, and recordings mask input fields at source.No system is perfectly secure. If a breach affects your personal data and is likely to result in a high risk to your rights, we will tell you and the competent authority as the law requires.ChildrenonMESSE is not intended for anyone under 18 and we do not knowingly collect data about children. If you believe a child has given us data, write to privacy@onmesse.com and we will delete it.Changes to this noticeWe update this notice as the platform changes. The date at the top of the page shows when it last changed substantively; if a change materially affects you we will give notice by email or in the platform before it takes effect.