Skip to content
Kolok

Privacy policy

Last updated: 13 October 2026 (version 2026-10-13)

Kolok (kolok.tn) is a catalogue of venues for professional events in Tunisia. This page describes precisely the data the site collects, based on what the code actually records. Processing is subject to Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data.

Without an account: what we record

  • No advertising cookies and no third-party tracking tools.
  • Anonymous audience statistics: for each page view we count the page path, the language, the device type (mobile, tablet, computer) and the name of the site you came from. To count unique visitors we compute a fingerprint of your IP address and browser with a key that changes every day; it cannot identify you and is deleted after 2 days. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is counted.
  • When you show a venue’s phone, e-mail or website, we add 1 to a daily counter for the room, with no data about you.
  • Your room comparison and display preferences stay in your browser (see “Cookies”).

With an account: data collected

  • Account: e-mail address, name, language, creation date, version of the terms accepted and acceptance date. Your password is never stored in clear (Argon2id hash). If you use Google, we keep your Google account identifier, never your Google password.
  • Security: sessions (device and browser type, sign-in dates), security log (sign-ins, password changes…) with only the first part of your IP address (/24 network). The two-step verification key is encrypted.
  • Use: saved rooms, requests sent to venues (name, organisation, phone, dates, number of participants, message), notifications and e-mail preferences.
  • Venues: if you claim a venue, your job title and professional phone; the corrections you report.
  • E-mails: a log of e-mails sent (type, subject, date). The content of security e-mails (confirmation, reset) is never kept.

Why and on what basis

  • To provide the service you ask for (account, requests to venues, saved rooms): performance of the terms of use.
  • To protect accounts and the site (security log, attempt limits): legitimate interest.
  • To measure audience anonymously and improve the catalogue: legitimate interest, with no identifying data.
  • We do not sell or rent any data and we do no targeted advertising.

Who receives your data

  • The venue you contact receives your request by e-mail (name, organisation, e-mail, phone, dates, message) to answer you directly.
  • The Kolok team, according to its role, for support and moderation; every sensitive action is logged.
  • Our technical providers: the server host (OVHcloud) and the e-mail sending service; Google only if you choose to sign in with Google.
  • When you choose a password, we check that it does not appear in known breaches with the “Have I Been Pwned” service: only the first 5 characters of a hash of the password are sent, never the password.

Retention periods

  • Sessions: 30 days without activity.
  • E-mail confirmation links: 24 hours; reset links: 60 minutes.
  • Accounts never confirmed: deleted after 14 days.
  • Account deleted at your request: closed at once, erased after 14 days.
  • Security log: 365 days.
  • Content of non-security e-mails: 90 days; e-mail log: 365 days.
  • Notifications: 180 days; data exports: 7 days.
  • Requests sent to venues: 24 months.
  • Visit fingerprints: 2 days (only daily totals are kept).
  • Log of Kolok team actions: 5 years.

Cookies and local storage

  • kolok_session (or __Host-kolok_session): keeps you signed in. Necessary, 30 days.
  • kolok_oauth: secures signing in with Google. Necessary, 10 minutes.
  • kolok_locale: remembers the chosen language. Preference, 1 year.
  • kolok_compare (cookie and local storage): rooms added to the comparison. Preference, 30 days.
  • kolok_demo: turns on demo mode. Preference, 7 days.
  • None of these cookies is used for advertising or cross-site tracking, so they need no consent.

Your rights

  • Access and portability: download the archive of your data at any time from My account → My data.
  • Rectification: change your name and language in My account; for your e-mail address, write to us.
  • Deletion: delete your account from My account → My data.
  • Objection and questions: write to contact@kolok.tn. You can also contact the National Authority for the Protection of Personal Data (INPDP, www.inpdp.tn).

Security

  • Encrypted connection (HTTPS), hashed passwords, sessions stored as fingerprints, cross-site request protection, attempt limits, two-step verification required for the team.
  • Uploaded photos are re-encoded: their metadata (including GPS location) is removed.