Privacy Policy

United Korean Founders Inc (“UKF,” “we,” “us,” or “our”) is a 501(c)(6) trade association. KOOM Week 2026 is a UKF programme that runs across Manhattan, New York City, from 12 to 18 October 2026. On this site we may also say “KOOM” when we mean UKF acting for KOOM Week.

This notice covers the public KOOM Week websites: koom.nyc, stage.koom.nyc (KOOM Stage, including participant matching), and challenge.koom.nyc (KOOM Challenge). It does not cover the websites of partners, venues, sponsors, or ticketing providers we link to — those operate under their own policies. UKF’s broader services on ukf.net are described in UKF’s general Privacy Policy at ukf.net.

Questions about this notice: contact@ukf.net.

Information you give us. When you send a KOOM Stage inquiry or submit one of our application forms — submit an event, register as a buyer, pitch, sponsor, or volunteer — we collect your contact name and email address together with your message or the answers to that form’s specific questions. Depending on the form these may also include your organisation or affiliation, event details, venue and dates, external links, images you upload, phone number, language proficiency, and an emergency contact. If you subscribe to updates, we collect your email address.

Information collected automatically. Only after you turn analytics storage on, we record:

• A randomly generated visitor identifier and session identifier. These are random values; they contain nothing about you.
• The pages you view and when, the page you arrived on, the site that referred you, and any UTM campaign parameters in the link you followed.
• Your language setting, device type, and browser user-agent string.
• An approximate location that our hosting provider derives from your IP address — country, region, city, and the coordinates of that city. This is not your device’s GPS location.
• Whether you have visited before, and how many pages and form submissions occurred during the session.

We do not store your IP address in our analytics database. Our hosting provider handles it transiently to route the request and to derive the approximate location described above.

Consent counting. Separately from analytics, and whatever you choose, we write one line each time the consent panel is shown and each time a choice is made. That line holds only the choice and the time it happened — no visitor identifier, no session identifier, no IP address, no user-agent — and it lives in a table that cannot be joined to the analytics data. We keep it so we can see whether the panel is working and so we can demonstrate that consent was properly obtained. Because these lines identify nobody, we do not treat them as personal information, and they are recorded even when you decline.

KOOM Stage. On stage.koom.nyc you can propose a session and vote for the sessions you want to hear. A proposal collects your name, email address, role, organisation, and any link you add; the name, role, organisation, and link are published on the session page, while the email address is only used by our team to contact you about that proposal. Voting requires no account: the first time you vote we write a random voter identifier to your browser so your five votes stay yours, and we store a salted, one-way hash of your IP address alongside the vote to detect ballot stuffing. That hash cannot be turned back into an IP address, is not joined to analytics data, and is deleted with the votes after the event.

KOOM Stage participant matching. To book 1:1 meetings at KOOM Stage you sign in with your email address, which creates an account. Your profile can include your name, photo, headline, organisation, job title, a short bio, the topics you are looking for and can offer, industries, skills, a LinkedIn URL and other social links, and a contact email and phone number. Your profile page can be opened by anyone with its link, so shared links show a preview, but it is not indexed by search engines; once you publish it, it also appears in the participant list. The contact email you add is shown on your profile. Your phone number is never shown on your profile and is shared only with the people you have a confirmed meeting with.

When you use matching we also record: the meeting requests you send and receive, with the message you write, the time slots, and every change of status; the profiles you save and the participants you block; reports you make or that are made about you; your answers to the short feedback survey after a meeting; your email notification settings; and a log of the emails we send you. When someone opens a profile we count the view. For signed-in viewers we store which profile viewed which, so we can measure how views turn into meeting requests; for signed-out viewers we store only a salted, one-way hash of the IP address and browser so a view is counted once a day. View counts are seen by our team only and are never shown to participants.

Ticket verification. To send meeting requests you add the email address you used to buy your KOOM Stage ticket and confirm it from a link we email you. We compare it with the ticket buyer list we receive from our ticketing provider, which contains buyers’ email addresses and names. Your login email is never replaced by your ticket email.

KOOM Challenge. When you enter the challenge at challenge.koom.nyc we collect your name, email address, phone number, the answers to your division’s questions, any photo you upload, and the link to your Instagram or TikTok post. Approved entries are published on the public challenge board, but never with your email address or phone number. As stated on the entry form, your submitted content, including your likeness, may be used for the Dream Project, and K-Art photos are reinterpreted through ARTUE’s YourArtue platform.

Information from partners. Event hosts, sponsors, and venue partners send us listing details that sometimes include the names and contact details of their own staff. Our ticketing provider sends us the KOOM Stage ticket buyer list described above.

We do not ask for and do not want sensitive personal information — government identifiers, precise geolocation, health, biometric, racial or ethnic origin, religious belief, sexual orientation, or union membership data. Please do not send it to us in a form field.

This section is the notice we give at or before we collect personal information, as required under the California Consumer Privacy Act and similar US state laws. Forms on this site and this page point here.

• Categories collected: identifiers and contact details; professional and commercial information you put in a form or a matching profile; matching activity such as meeting requests, messages, saves, blocks, reports, and feedback; ticket purchase records used for verification; internet activity and device data (only if you turn analytics on); approximate (city-level) location derived from your IP by our host; images you upload and profile photos.
• Purposes: run and secure the website; review and respond to submissions; publish approved event listings; run KOOM Stage participant matching, including ticket verification and meeting emails; run KOOM Challenge, including judging and publishing approved entries; keep participants safe; measure site and programme interest in aggregate; send updates you asked for; meet legal obligations.
• Sale or sharing: we do not sell personal information and we do not share it for cross-context behavioural advertising.
• Retention: see section 10. Each category is kept only for the period stated there, or the criteria described there.
• Your choices: use “Your privacy choices” in the site footer to control analytics storage, or email us to exercise other rights. Because we do not sell or share, there is no separate “Do Not Sell or Share” flow — that control and Global Privacy Control are how we honour opt-out preference signals all the same.

The full category table is in section 4. This Privacy Policy is the complete notice; the Cookie Policy lists every item stored on your device.

For California and other US state privacy laws, here is what we have collected in the preceding 12 months, where it came from, why we use it, whether it is sold or shared, and how long we keep it. “Share” means cross-context behavioural advertising as those laws define it.

In the preceding 12 months we disclosed personal information to the service providers in section 8 only for the business purposes described there. We did not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

Nothing optional is stored on your device until you choose it. The consent panel appears before any analytics cookie is set, and “Essential only” takes exactly as few clicks as “Accept all”.

Accepting analytics also loads Google Analytics 4 and PostHog, which set their own cookies and receive the measurements described in section 8. Google Analytics runs under Google Consent Mode with advertising and personalisation signals denied. Neither tool is requested if you decline. We do not turn on PostHog session recording.

Opening the Event Calendar map causes your browser to request map tiles from Mapbox, which receives your IP address and the map area you view. That is a third-party network request for a page feature, not an analytics cookie we set. Details are in the Cookie Policy.

Signing in to KOOM Stage participant matching sets a sign-in cookie that is strictly necessary for the account you asked for. Separately, every page reports anonymous performance measurements to Vercel Speed Insights — the page path, loading-speed timings, device type, browser, and country. Speed Insights sets no cookies and stores nothing on your device.

The Cookie Policy lists every first-party item we store, what each one does, and how long it lasts. You can reopen your choices at any time via “Your privacy choices” in the site footer.

• To run the website, keep it available, and protect it from abuse.
• To review, respond to, and follow up on event, buyer, pitch, sponsorship, and volunteer submissions.
• To publish approved events on the public calendar. Event listings — including the host name shown on the listing — are public by design.
• To run KOOM Stage participant matching: show your profile to other participants, verify your ticket, deliver meeting requests and replies, send confirmations and reminders by email, and ask for feedback after a meeting.
• To keep participants safe: review reports, block participants, and cancel meetings where needed.
• To run KOOM Challenge: review and judge entries, publish approved entries on the challenge board, contact entrants and winners, and deliver prizes.
• To keep your matching profile for 12 months after the event so participants can follow up with one another, and, if you turned on updates, to tell you about the next KOOM Week.
• To understand, in aggregate, which pages and events draw interest, so we can plan the programme.
• To send the updates you asked for, and to stop sending them when you unsubscribe.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles.

If you are in the European Economic Area, the United Kingdom, or the Republic of Korea, we rely on the following bases:

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act. There are no advertising pixels or retargeting tags on this website. Google Analytics 4 and PostHog are used for measurement only, after your consent. Google's advertising and personalisation signals stay denied, so neither tool is linked to an advertising audience. Because we do not sell or share, we do not publish a separate “Do Not Sell or Share My Personal Information” link; “Your privacy choices” in the footer is the conspicuous control we provide for reviewing storage preferences and honouring opt-out preference signals such as Global Privacy Control.

We use a small number of service providers who process information on our instructions and are contractually barred from using it for their own purposes:

Other participants see your matching profile as described in section 2, and the people you meet see the details needed for that meeting. For the K-Art division of KOOM Challenge, submitted photos are shared with ARTUE so they can be reinterpreted through its YourArtue platform, as stated on the entry form.

Beyond those providers, we share information only: with event hosts and partners where you specifically asked us to connect you; with professional advisers under a duty of confidentiality; where we are legally required to, or to protect our rights and the safety of attendees; and with a successor entity if UKF is involved in a merger, acquisition, or asset transfer, in which case this notice continues to apply until you are told otherwise.

The Site is operated from the United States and our service providers are located there. If you are in the EEA, the UK, or Korea, your information is transferred to and processed in the United States, which may not offer the same standard of protection as your home jurisdiction.

Where the law requires a transfer mechanism, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent safeguard in our agreements with each provider. You can ask us for details.

If you are in the Republic of Korea, you may object to an overseas transfer under the Personal Information Protection Act. Refusing the transfer means we cannot provide the website’s core functions, because hosting and storage run in the United States.

Where we are required to keep records for tax, accounting, or legal reasons, we keep the minimum necessary for the required period and nothing more.

New York’s SHIELD Act requires reasonable administrative, technical, and physical safeguards. Ours include encrypted transport for every request, encryption at rest at our database provider, row-level security on the database with no public write access, role-based access for staff, and access limited to the people who need it to do their job.

No method of transmission or storage is completely secure. If a breach affects the private information of New York residents, we will notify the individuals affected and the New York State Attorney General, Department of State, and State Police in the most expedient time possible and no later than 30 days after discovery, as the SHIELD Act requires.

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, and withdraw a consent you previously gave.

Deleting your matching account. You can edit your matching profile, unpublish it, or delete your account at any time from your account page. Deleting the account removes your profile from KOOM Stage, cancels your open meetings, and signs you out. We keep the account for 30 days so an organiser can restore it if you ask, and then delete it permanently. If you want it deleted permanently straight away, email us using the steps below.

United States. Residents of California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Virginia, and other states with comprehensive privacy laws additionally have the right to know what is collected and why, to obtain a portable copy, to correct inaccuracies, to delete, to opt out of the sale or sharing of personal information and of targeted advertising and profiling, to limit the use of sensitive personal information, and not to be retaliated against for exercising any of these rights. Because we do not sell or share personal information, do not run targeted advertising, and do not profile, there is nothing in those categories to opt out of — but the “Essential only” control and the Global Privacy Control signal are honoured all the same.

Opt-out preference signals. We detect the Global Privacy Control signal, whether it arrives as the Sec-GPC request header or through the browser’s globalPrivacyControl property. When we see it we switch analytics storage off automatically, delete the analytics identifiers already in your browser, and show you an on-screen confirmation that the request was honoured. You do not need to click anything, and we do not ask you to verify your identity first.

EEA and United Kingdom. You also have the right to restrict processing, to object to processing based on legitimate interests, to data portability, and to lodge a complaint with your national supervisory authority.

Republic of Korea. Under the Personal Information Protection Act you may request access, correction, deletion, and suspension of processing, and you may withdraw consent at any time. You may also raise a dispute with the Personal Information Protection Commission or the KISA Privacy Call Centre (dial 118 within Korea).

How to exercise your rights. Email contact@ukf.net with “Privacy Rights Request” in the subject line and tell us what you would like us to do. We respond within 45 days for requests under US state law and within one month under GDPR and PIPA, extending only where the law allows and telling you if we do. You do not need an account with us. An authorised agent may act on your behalf with your written permission. We will never charge you or degrade your experience for making a request.

How we verify. We match the email address you write from with the email on the relevant form submission, matching account, challenge entry, subscription, or correspondence. If that is not enough, we may ask one or two follow-up questions that only the person who provided the information would know. We do not ask for government ID for ordinary requests. If we cannot verify you, we will say so and explain what else would help, rather than guessing.

Appeals. If we decline your request in whole or in part and you live in a state that gives you a right to appeal — including Colorado, Connecticut, Virginia, Texas, and others — reply to our decision within the time stated in that email and ask for reconsideration. We will review the decision and reply in writing. If we uphold it, we will tell you how to contact your state attorney general or privacy regulator.

This website and KOOM Week are intended for a general professional audience and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will delete it promptly.

New York’s Child Data Protection Act restricts the processing of personal data of New York users under 18. We do not process the personal data of known minors for advertising, profiling, or any purpose beyond what is strictly necessary to provide the website. If you believe a minor has given us personal information, contact us and we will delete it.

There is still no agreed industry standard for the older “Do Not Track” browser header, so we do not act on it. We do honour Global Privacy Control, which is a recognised opt-out preference signal, as described above.

Registration and ticketing links on the event calendar point to third-party websites run by hosts and ticketing providers. Once you leave koom.nyc this notice no longer applies, and we have no control over what those sites collect.

If we change this notice we post the new version here and update the date at the top. We review it at least once every 12 months. When a change materially affects what we store on your device or how we use information you have already given us, the consent panel reappears and we ask you again rather than relying on your earlier answer.

United Korean Founders Inc, 345 E 73rd St 12A. Email contact@ukf.net. Website koom.nyc.

For CCPA-related requests, email contact@ukf.net with the subject line “Privacy Rights Request.”

If you are in the EEA or the UK and are unhappy with our response, you may complain to your local data protection authority. If you are in Korea, you may contact the Personal Information Protection Commission.