Privacy Policy

United Korean Founders Inc (“UKF,” “we,” “us,” or “our”) is a 501(c)(6) trade association. KOOM Week 2026 is a UKF programme that runs across Manhattan, New York City, from 12 to 18 October 2026. On this site we may also say “KOOM” when we mean UKF acting for KOOM Week.

This notice covers the public KOOM Week website at koom.nyc. It does not cover the websites of partners, venues, sponsors, or ticketing providers we link to — those operate under their own policies. UKF’s broader services on ukf.net are described in UKF’s general Privacy Policy at ukf.net.

Questions about this notice: shawnbaek@ukf.net.

Information you give us. When you submit one of our forms — submit an event, register as a buyer, pitch, or sponsor — we collect your organisation name, contact name, and email address, together with the answers to that form’s specific questions. Depending on the form these may include event details, venue and dates, external links, and images you upload. If you subscribe to updates, we collect your email address.

Information collected automatically. Only after you turn analytics storage on, we record:

• A randomly generated visitor identifier and session identifier. These are random values; they contain nothing about you.
• The pages you view and when, the page you arrived on, the site that referred you, and any UTM campaign parameters in the link you followed.
• Your language setting, device type, and browser user-agent string.
• An approximate location that our hosting provider derives from your IP address — country, region, city, and the coordinates of that city. This is not your device’s GPS location.
• Whether you have visited before, and how many pages and form submissions occurred during the session.

We do not store your IP address in our analytics database. Our hosting provider handles it transiently to route the request and to derive the approximate location described above.

Consent counting. Separately from analytics, and whatever you choose, we write one line each time the consent panel is shown and each time a choice is made. That line holds only the choice and the time it happened — no visitor identifier, no session identifier, no IP address, no user-agent — and it lives in a table that cannot be joined to the analytics data. We keep it so we can see whether the panel is working and so we can demonstrate that consent was properly obtained. Because these lines identify nobody, we do not treat them as personal information, and they are recorded even when you decline.

Information from partners. Event hosts, sponsors, and venue partners send us listing details that sometimes include the names and contact details of their own staff.

We do not ask for and do not want sensitive personal information — government identifiers, precise geolocation, health, biometric, racial or ethnic origin, religious belief, sexual orientation, or union membership data. Please do not send it to us in a form field.

This section is the notice we give at or before we collect personal information, as required under the California Consumer Privacy Act and similar US state laws. Forms on this site and this page point here.

• Categories collected: identifiers and contact details; professional and commercial information you put in a form; internet activity and device data (only if you turn analytics on); approximate (city-level) location derived from your IP by our host; images you upload for a listing.
• Purposes: run and secure the website; review and respond to submissions; publish approved event listings; measure site and programme interest in aggregate; send updates you asked for; meet legal obligations.
• Sale or sharing: we do not sell personal information and we do not share it for cross-context behavioural advertising.
• Retention: see section 10. Each category is kept only for the period stated there, or the criteria described there.
• Your choices: use “Your privacy choices” in the site footer to control analytics storage, or email us to exercise other rights. Because we do not sell or share, there is no separate “Do Not Sell or Share” flow — that control and Global Privacy Control are how we honour opt-out preference signals all the same.

The full category table is in section 4. This Privacy Policy is the complete notice; the Cookie Policy lists every item stored on your device.

For California and other US state privacy laws, here is what we have collected in the preceding 12 months, where it came from, why we use it, whether it is sold or shared, and how long we keep it. “Share” means cross-context behavioural advertising as those laws define it.

In the preceding 12 months we disclosed personal information to the service providers in section 8 only for the business purposes described there. We did not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

Nothing optional is stored on your device until you choose it. The consent panel appears before any analytics cookie is set, and “Reject all” takes exactly as few clicks as “Accept all”.

Opening the Event Calendar map causes your browser to request map tiles from Mapbox, which receives your IP address and the map area you view. That is a third-party network request for a page feature, not an analytics cookie we set. Details are in the Cookie Policy.

The Cookie Policy lists every first-party item we store, what each one does, and how long it lasts. You can reopen your choices at any time via “Your privacy choices” in the site footer.

• To run the website, keep it available, and protect it from abuse.
• To review, respond to, and follow up on event, buyer, pitch, and sponsorship submissions.
• To publish approved events on the public calendar. Event listings — including the host name shown on the listing — are public by design.
• To understand, in aggregate, which pages and events draw interest, so we can plan the programme.
• To send the updates you asked for, and to stop sending them when you unsubscribe.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not build advertising profiles.

If you are in the European Economic Area, the United Kingdom, or the Republic of Korea, we rely on the following bases:

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act. There are no advertising pixels, retargeting tags, or third-party analytics products on this website. Because we do not sell or share, we do not publish a separate “Do Not Sell or Share My Personal Information” link; “Your privacy choices” in the footer is the conspicuous control we provide for reviewing storage preferences and honouring opt-out preference signals such as Global Privacy Control.

We use a small number of service providers who process information on our instructions and are contractually barred from using it for their own purposes:

Beyond those providers, we share information only: with event hosts and partners where you specifically asked us to connect you; with professional advisers under a duty of confidentiality; where we are legally required to, or to protect our rights and the safety of attendees; and with a successor entity if UKF is involved in a merger, acquisition, or asset transfer, in which case this notice continues to apply until you are told otherwise.

The Site is operated from the United States and our service providers are located there. If you are in the EEA, the UK, or Korea, your information is transferred to and processed in the United States, which may not offer the same standard of protection as your home jurisdiction.

Where the law requires a transfer mechanism, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent safeguard in our agreements with each provider. You can ask us for details.

If you are in the Republic of Korea, you may object to an overseas transfer under the Personal Information Protection Act. Refusing the transfer means we cannot provide the website’s core functions, because hosting and storage run in the United States.

Where we are required to keep records for tax, accounting, or legal reasons, we keep the minimum necessary for the required period and nothing more.

New York’s SHIELD Act requires reasonable administrative, technical, and physical safeguards. Ours include encrypted transport for every request, encryption at rest at our database provider, row-level security on the database with no public write access, role-based access for staff, and access limited to the people who need it to do their job.

No method of transmission or storage is completely secure. If a breach affects the private information of New York residents, we will notify the individuals affected and the New York State Attorney General, Department of State, and State Police in the most expedient time possible and no later than 30 days after discovery, as the SHIELD Act requires.

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, and withdraw a consent you previously gave.

United States. Residents of California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Virginia, and other states with comprehensive privacy laws additionally have the right to know what is collected and why, to obtain a portable copy, to correct inaccuracies, to delete, to opt out of the sale or sharing of personal information and of targeted advertising and profiling, to limit the use of sensitive personal information, and not to be retaliated against for exercising any of these rights. Because we do not sell or share personal information, do not run targeted advertising, and do not profile, there is nothing in those categories to opt out of — but the “Reject all” control and the Global Privacy Control signal are honoured all the same.

Opt-out preference signals. We detect the Global Privacy Control signal, whether it arrives as the Sec-GPC request header or through the browser’s globalPrivacyControl property. When we see it we switch analytics storage off automatically, delete the analytics identifiers already in your browser, and show you an on-screen confirmation that the request was honoured. You do not need to click anything, and we do not ask you to verify your identity first.

EEA and United Kingdom. You also have the right to restrict processing, to object to processing based on legitimate interests, to data portability, and to lodge a complaint with your national supervisory authority.

Republic of Korea. Under the Personal Information Protection Act you may request access, correction, deletion, and suspension of processing, and you may withdraw consent at any time. You may also raise a dispute with the Personal Information Protection Commission or the KISA Privacy Call Centre (dial 118 within Korea).

How to exercise your rights. Email shawnbaek@ukf.net with “Privacy Rights Request” in the subject line and tell us what you would like us to do. We respond within 45 days for requests under US state law and within one month under GDPR and PIPA, extending only where the law allows and telling you if we do. You do not need an account with us. An authorised agent may act on your behalf with your written permission. We will never charge you or degrade your experience for making a request.

How we verify. We match the email address you write from with the email on the relevant form submission, subscription, or correspondence. If that is not enough, we may ask one or two follow-up questions that only the person who provided the information would know. We do not ask for government ID for ordinary requests. If we cannot verify you, we will say so and explain what else would help, rather than guessing.

Appeals. If we decline your request in whole or in part and you live in a state that gives you a right to appeal — including Colorado, Connecticut, Virginia, Texas, and others — reply to our decision within the time stated in that email and ask for reconsideration. We will review the decision and reply in writing. If we uphold it, we will tell you how to contact your state attorney general or privacy regulator.

This website and KOOM Week are intended for a general professional audience and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will delete it promptly.

New York’s Child Data Protection Act restricts the processing of personal data of New York users under 18. We do not process the personal data of known minors for advertising, profiling, or any purpose beyond what is strictly necessary to provide the website. If you believe a minor has given us personal information, contact us and we will delete it.

There is still no agreed industry standard for the older “Do Not Track” browser header, so we do not act on it. We do honour Global Privacy Control, which is a recognised opt-out preference signal, as described above.

Registration and ticketing links on the event calendar point to third-party websites run by hosts and ticketing providers. Once you leave koom.nyc this notice no longer applies, and we have no control over what those sites collect.

If we change this notice we post the new version here and update the date at the top. We review it at least once every 12 months. When a change materially affects what we store on your device or how we use information you have already given us, the consent panel reappears and we ask you again rather than relying on your earlier answer.

United Korean Founders Inc, 345 E 73rd St 12A. Email shawnbaek@ukf.net. Website koom.nyc.

For CCPA-related requests, email shawnbaek@ukf.net with the subject line “Privacy Rights Request.”

If you are in the EEA or the UK and are unhappy with our response, you may complain to your local data protection authority. If you are in Korea, you may contact the Personal Information Protection Commission.