Privacy notice

1 — Controller

• Railworld AB
• Wallingatan 12
• 343 34 Älmhult
• Sweden
• Organisation number: 559563-8254
• Email: hej@kupe.social

2 — Waitlist: what data, what for, how long

When you sign up we process your email address, the language you chose, the time of sign-up and the time of confirmation.

Purpose: to send you exactly one message when Kupe launches. The address is used for nothing else and is never sold or passed on.

The legal basis is your consent, Art. 6(1)(a) GDPR. We use double opt-in: without the click in the confirmation email the entry stays unconfirmed and is deleted automatically after seven days.

Confirmed addresses are deleted no later than six months after the launch email is sent — or immediately if you unsubscribe before that.

To prevent abuse we additionally store a shortened reference to the requesting IP address. It is deleted after 30 days, and for confirmed entries already on confirmation. The legal basis is our legitimate interest in a working sign-up form, Art. 6(1)(f) GDPR.

3 — Withdrawing consent

You can withdraw your consent at any time. The quickest way is the unsubscribe link at the end of every email we send you. An informal message to hej@kupe.social is equally sufficient. Withdrawal does not affect the lawfulness of processing carried out beforehand.

4 — Audience measurement with Matomo

We use Matomo, analytics software that we host ourselves on our own server. No data flows to third parties and there is no transfer outside the EU.

Matomo is deliberately configured here so that it sets no cookies and stores no identifier on your device. That is why this site has no cookie banner — there is nothing to consent to.

Collected are: page visited, time, referring page, approximate region derived from the shortened IP address, device type, screen size and language. The IP address is shortened before any storage and never kept in full.

A "Do Not Track" signal from your browser is respected — in that case nothing is counted at all.

The legal basis is our legitimate interest in knowing whether and how this page is found, Art. 6(1)(f) GDPR.

5 — Server log files

Retrieving the page technically produces log data: date and time, requested address, amount of data transferred, status code, browser type and shortened IP address. It serves secure operation and troubleshooting and is deleted after no more than 14 days.

6 — Fonts

The fonts used, Archivo and IBM Plex Mono, are served from our own server. No connection is made to Google Fonts or any other external service.

7 — Recipients and storage location

The site runs on a server in Helsinki, Finland. We use an EU-based service provider to send the confirmation email. Data processing agreements under Art. 28 GDPR are in place with both.

In fairness: the delivery provider rewrites the links in our emails to point at an address of its own, and therefore learns whether and when a link was clicked. This cannot be switched off on its plan. We do not evaluate that data; it arises technically during sending. We are working on turning it off — until then it is stated here rather than left out.

• Hetzner Online GmbH, Gunzenhausen (DE) — Hosting, data centre Helsinki, Finland (server, database, log files)
• Brevo (Sendinblue SAS), Paris (FR) — email delivery, data centres in the EU (sending the confirmation and launch email)
• Matomo, selbst gehostet — audience measurement, our own server, no transfer to third parties (without cookies, with shortened IP address)

8 — Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on a legitimate interest.

A message to hej@kupe.social is enough.

You may also lodge a complaint with a supervisory authority. The competent authority is the Swedish Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm. You may also contact the authority in your country of residence.

9 — No automated decision-making

There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR.

10 — Changes

When Kupe grows from a sign-up form into a platform, this notice will be replaced. Everyone on the waitlist will be told beforehand.