StartupYard Batch 9, has been defined by “tech with a soul.” That trend continues even when the focus of the startup is on what people traditionally think of as a dry and boring topic: big data, behavior analysis and product recommendation.

That’s because Tomas Pluharik, CEO and Co-Founder of Behavee, believes strongly that the future of recommendations is at once more personal, and more private. Behavee is focused on providing e-commerce and content companies with the tools to truly understand their customers, but without breaching their privacy or mining their personal data and shopping history. They do this by training their machine learning systems to understand how customers behave, and use that knowledge to create instantaneous micro-segmentation of customers based on what they are interested, and what they really want – not just what a company wants to sell them, or what they’ve bought in the past.

To do this, Tomas has arrayed a team of experts in big data, marketing, machine learning, and software engineering with a strong corporate background, who are tired of the way big data is being used for marketing, and believe there is a better way. Behavee is an open-source recommendation engine that learns from its experiences, but doesn’t violate your privacy.

I sat down with Tomas to talk about his vision for the future of marketing in an age of privacy and a post-GDPR world. Here is what he had to say:

Hi Tomas, tell us a little about yourself and your team. How did you all end up together founding Behavee?

We’re a team of corporate refugees who have all worked many years at the Big 4, banks, telcos, and pretty much every big corporations you can imagine in Central Europe.

Without getting into too many of the messy details, I originally hoped to form a spinnoff from one of the Big 4 consultancy firms, to pursue what I found most interesting about big data, which I’m sure we’ll talk about here. Anyway, that experience showed me that my colleagues and I were living on a different planet from our superiors, and we needed to escape to startupland as soon as possible so that we could really do something that big companies don’t have the appetite for.

We teamed up, David, Jan, Richard and myself (team bios are here), and banded together with Michal and Juraj from the banking sector, and Marketa from Microsoft, and we formed what started as a kind of big data agency. I have really enjoyed the fact that the team has been very dynamic, and a harsh selection process outside the cushy corporate environment, which has molded us into a team of hardened individuals who can stay lean and scrappy.

Behavee focuses on user behavior and micro-segmentation for recommendations. What is the unique approach you’re using, compared with other recommendation services?

Ok, how much time do you have? Just kidding, I’ve learned now to make this as clear and straightforward as possible, although in the background it’s tremendously complex.

First of all, we must understand how content and product recommendations currently work online. Or rather, how they don’t really work. What happens mostly today is that e-commerce companies and content companies hoover up a huge mountain of personal data about their users through the use of memberships, cookies, browsing history, purchase history, and data collection services.

With all that data in one hand, and with a pile of products or content to promote in the other hand, they do what you might expect anyone to do in this situation: they figure out the best way to get the most people they can to buy the products they have or look at the content they own.

Now, in this process, they like to think that what they are doing is helping their customers to find products that they need and want. That is sometimes true. However, as you may imagine, it also produces a huge number of recommendations for things customers not only don’t want, but which are actively annoying or nonsensical for them.

A good example of this approach is if say, I bought a phone on an e-commerce platform. The e-shop can recommend me a case for the phone while I am shopping, or even after I purchase the phone. So far so good. Now say I bought the case. Great! Now what does the recommendation system for that e-shop do? It spends the next 6 months advertising that same case to me, over and over again. That’s a true story by the way. Many people, if not most people know it well. 

Why does it do this? Because it is not looking at *me* and thinking: “Tom already bought that case… let’s find something else Tom would like based on what he is actively doing on our platform.” No, instead the e-commerce platform is saying: “We have a couple hundred of these phone cases lying around… we need to sell them to anyone who bought the phone.” That includes me, even if I bought the case already. Who knows- maybe they get lucky and I buy it again? 

I know that sounds pretty dumb actually, but even the most advanced e-commerce companies are still doing this. Even Amazon does that. They can’t stop.

Wait… why can’t they stop doing this?

Because, as I said they have this pile of user data, and this pile of products. They have to move the products using the data. So these little annoyances like seeing the same promotion 50 times after you bought something are not their cheif concern. Their chief concern is to sell the products they need to sell.

What do you do differently?

Ok, now we’re getting somewhere. Behavee is different because we don’t need this giant pile of customer data. We don’t need to know the history of any single individual and what they have bought, or what they are like. We instead anonymously study the behavior of many people, and from this we derive an understanding of how people really work, and what really motivates them. What we do instead of focusing on the past of someone’s shopping activities, is to focus on how a customer behaves, what she or he does when they are visiting the e-commerce or content site, and use that behavior to understand what they are looking for right now. Not a month ago, but right now today.

In order to do that, you must break this addiction to looking at a customer’s past, and focus on a customer’s present. The fact that I bought a phone 6 months ago is irrelevant, if I am in no way motivated to buy a case. So don’t show me something I am not ready to buy. Instead understand me by the way I behave, and show me something I really want. That is what Behavee is doing. Behind this is machine learning technology, analytical tools and automation software to help e-commerce and content platforms make better recommendations automatically, based on dynamic micro-segmentation, which basically means making offers that work for a customer based on what they do, and not who they are.

How can you understand what a person wants by how they are browsing a site?

Let me give you a nice analogy. My grandfather ran two pharmacies during the second world war and before the period of socialism. He said that after many years, he could tell what a customer was looking for in his shop, just based on how they looked, what they did in the shop, and generally how they behaved. Actually it’s very intuitive, because in-person sales is all about reading body language and judging a person on how they are behaving and how they present themselves to you. Are they confident? Unsure? What items are they interested in? You get that all by observing.

In fact my grandfather said this is the trick to serving people is not to judge based on the past: you pay attention to how they act right now, and not always to what they say about themselves. Very often a customer does not know how to get what they really want. You must understand them and help them to understand and see the products that they really need. Maybe a person who has bought the same thing every week for years doesn’t actually want that same thing again. If you presume too much, you will miss an opportunity to sell them something else.

So this is what we do at Behavee. Our recommendation engine first of all observes how many thousands of people behave on a website, and then just like grandpa in the 50s, we train our machine learning systems to recognize what people need by how they behave: what they look at, where they go, how much attention they pay to something, etc. Then we can actively micro-segment and offer a customer something specifically for them, that we know with a high degree of certainty that they will want.

The best way to give an amazing customer experience is to make it feel like the person magically found exactly that thing they wanted. It feels as if that thing is there waiting just for them. That is the experience we want for customers of e-commerce. Less flashing lights, and more understanding of the individual, but without being creepy and pushing against their privacy.

Our solution looks on the whole customer journey from beginning to the end. We do not ask how we can sell a pile of products we must sell; instead we ask “what does this person need, right now, and can we offer that?”

To do this we are an open-source, open platform company. The more our recommendation engine learns from customer behavior (all without keeping any personal data about individuals), the better we can be at helping e-commerce and even content companies to recommend the “next best thing,” for any individual, based on what they themselves do.

So this is ethical big data?

Of course, privacy and anonymity I believe are fundamental rights that we ignore at our peril.

However, I want to stress that even if I didn’t feel that way, this approach to recommendations just works better than looking deep into someone’s past and trying to predict their future that way. If we keep doing that, using a person’s history to define their future, then we will always miss on the best opportunities, and we will never recognize when our customers have changed and are not interested in the same things anymore.

Using someone’s history all the time is like never letting them grow up. You show you don’t understand or even care about someone by doing that. You bought jeans? You are the jeans guy forever. That is somehow both deeply personal and dehumanizing at the same time. It doesn’t work. It will never work.

Just imagine in my story about my grandfather if he had, instead of looking at his customers as people, just looked at them in some spreadsheet with all their past purchasing activities. That is ridiculous. Maybe he could sell them something that way, but could he tell from this if the person in front of him has a cold right now? No. You can see how this approach can be taken to such extremes that we end up not being able to help people anymore. Ultimately people are looking to be understood, not to be treated as pieces of data.

We work with pseudonymized and anonymized data. We don’t keep data of individuals after using it to train our algorithms. If someone came to me and asked for data deletion (as is anyone’s right now with GDPR), I would have no trouble because I don’t even have it, and I don’t want to keep it. Behavee has no knowledge of individuals, and that makes us better at recommendations than if we did.

As for our partners and clients, this will be an adjustment, but a much needed one.

So you see GDPR (General Data Protection Regulation), as an opportunity to change the way online marketing works?

GDPR will clear the marketing space of the random advert calls for a while and will partially reset some marketing functions (like loyalty programs). The opportunity is in the approach to lead generation. It will be hard to generate direct leads from endless databases anymore. Now you must be smarter and more proactive in thinking about the customer journey.

Though anyone who knows me can say that I am not a big fan of too much regulation, I believe GDPR for the most part did a necessary amount of damage to the current system. It made it so that these ways of using big databases to sell are less attractive, and that is ultimately better for consumers and businesses.

You’ve already launched the service with some pilot customers. Can you talk about that process? What surprised you, both about the client’s needs and their reactions to Behavee’s capabilities?

Yes we started and we expected to collect the data for a month to make something beneficial for our clients. We still do need a lot of data, to be clear, but we don’t need to keep that data for very long at all to train the algorithms, and that data does not need to be linked to any specific person.

To our surprise, in only a week, we were able to generate interesting reports for the client that had an impact on their sales right away. I did not believe we could provide such a benefit so quickly, so that is a very welcome shock. Actually one of our clients is now calling for more help after he just saw the data we are providing. We are becoming very busy!

On which kinds of projects or in which industries do you see Behavee having the biggest impact in the near term, say 1-2 years?

What we can do right now, and for the near future is to provide a much better insight for our clients into how their visitors behave, and how to work with them. On top of that, we can provide, after some time of monitoring customer behavior, a way of automating recommendations of content and products, and also offering customers relevant products from other sellers, with revenue sharing for the lead originating site (referral marketing), if that is desired.

In short our focus is mostly on e-commerce and media. However we see great potential in interconnecting verticals and businesses over the whole internet. Realtime behavioral analysis of users can be used even in industrial segments, but as I said our main focus is now on e-commerce and media.

Tell us about your decision to join StartupYard. You’ve got many years of corporate experience on your team, so what was the biggest motivator for joining the accelerator?

To be frank, we were initially not sure if we should join. But I knew the product is too fat and unfocused, communication too complicated and clumsy and our sales cycle too long 🙂 . So at the end of the day we give it a shot.

I must say that it surpassed my expectations. The network we have through StartupYard is very strong, even stronger than before, and there is a level of trust that we bring with us into meetings and new potential partners and clients because they know we are an “SY Company,” so it means we are serious and have backup on our side.

The StartupYard management team has been great. It can be very helpful to have someone always with an outside perspective, bringing past experience and knowledge of the network to help us stay realistic but also to be more open to new possibilities too. I can only say I recommend it, even if you have lots of previous experience. This is not about someone telling you what to do, but rather having a support system that you couldn’t buy otherwise.

What kinds of partners and customers are you looking for in the near future?

Ok, so I could tell you that we are looking for the most forward-looking and most progressive e-commerce companies, financial institutions, media, etc. That is the startup thing to say!

Actually these businesses are generally very conservative, and the most conservative players can use our help the most. Some of these companies are trying to build their own closed solutions, and that is ultimately not going to be enough, or is frankly just a bad idea. Smaller startups and younger companies are already set up to use data more wisely, but bigger institutions are big machines that have only a few speeds.

Thus we are looking to work with companies that deal with lots of customers in a pretty conservative, by the book big data approach. That is where we can do the most good, because generally these companies have a lot of tools and a lot of data (and with this they do make a lot of sales) but not much in the way of connecting all those tools to the data to actually improve their customer experiences. Behavee isn’t about “press this button and user your data to sell more.” It’s about collecting the right data, and using it the right way to ultimately grow your business stronger, with better customer experiences. That will generate more sales, and not only in the long run.

What we have learned recently is that being open-source is not a deal breaker for big companies and conservative institutions if they understand what is actually being shared, which is not their own operational data or the data of their customers, but the deeper understanding of how customers behave in general. In this way a bank that is using Behavee can benefit from our understanding of an e-commerce company, and vice-versa. Everyone can become stronger this way.

So if you have a lot of data and you somehow feel that you aren’t quite giving your customers what they are really looking for, then we are open to a discussion with you. Let me convince you that open-source is the future, and that understanding customer behavior, not just mining your data, is the key to being competitive today and in the future.

Blocknify, one of the 6 Batch 9 startups at StartupYard, actually began life at StartupYard, long before now CEO and Co-founder Chris Cowles came onboard. It was originally the brainchild of StartupYard alum Dite Gashi, and a team of developers from Budgetbakers he worked with at the KB Hackathon, cohosted by StartupYard last year.

Though the initial pitch for Blocknify was not much more than a QR code connected with the Ethereum blockchain to verify the authenticity of contracts, the idea clicked, and StartupYard along with Decissio started looking for a real Founder/CEO for the project. We found him this year, and since he arrived, he’s made Blocknify his own. I sat down this week with Chris Cowles to talk about Blocknify, and how he came from working for Amazon in Seattle, to running his own company in Prague.

Hi Chris, you joined StartupYard after meeting one of our alumni, Decissio. How did you end up taking charge of Blocknify?

That’s a classic Prague story! It started before I came here actually. StartupYard investor Philip Staehlin sort of came up with the idea when he was having issues signing sensitive documents with a big group of people.
A bank VP told Philip stories of how he had signed confidential documents in the past. They used to take the multiple copies of the contract and tape them up to the windows of a conference room. That way, they could compare the multiple copies and ensure that they were identical and there were no differences, just based on the line-endings and paragraph sizes.

Obviously that’s crazy in this technological age, but it still happens. Anyway, Phillip shared that idea with Dite Gashi, who is a StartupYard Alum (Decissio), and Dite worked on it with a few friends from BudgetBakers (another SY alum), at a KB hackathon organized by StartupYard. The idea the team came up with to verify contracts was to attach QR codes, and allow people to basically scan the contract with a smartphone and confirm there haven’t been any changes. It would use the Ethereum blockchain to make it transparent and also secure, because none of the data in the contract needed to be shared in order to verify that a new copy is authentic.

Chris, Dite, and the Blocknify team

The team did really well at the KB hackathon, but they were all working on other projects, so the idea didn’t really have an owner. Since Startupyard was interested in the idea, you guys encouraged Dite to find someone (eventually me), to take it over and become CEO for the project. I had just moved here from Seattle, and was looking to get into blockchain development somehow. I found the project by chance on LinkedIn. I actually read Dite’s interview on this very blog, which convinced me I had to check out the project and StartupYard. It just clicked for me.

A few months later here I was, attending startupyard as CEO of Blocknify. We have a development team in Kosovo thanks to Dite, and we’ve simplified and clarified the original idea to something really amazing. I’m excited to talk about it.

Blocknify aims to allow professionals to safely and securely sign documents anywhere, without ever hosting them on cloud servers. How does this technology work, and why is it so different from competing solutons like DocuSign?

Contracts are inherently sensitive. Of course you might not worry too much if certain documents were intercepted or stored improperly, because usually a contract by itself isn’t very compromising (unless you are Donald Trump). However, for businesses as well as for individuals, the sum of all your contracts is kind of the blueprint to your business or your life. It’s a roadmap to your strategy that, if someone had access to all of it, they could gain a serious advantage over you.

As we know from recent experience, centralized databases are prone to theft and hacking. It is innevitable as long as the incentives are there to misuse that data.

Despite this known issue, Europe is not adapting quickly to e-signatures, with many corporations having policies against the use of any software for contracts. Of course it doesn’t help that the regulatory system in Europe is very complex, which is a big part of the challenge of driving adoption of e-signatures.

What is particularly good about Blocknify is that it gets past many of these barriers by not acting like a cloud service. We do not need to store contracts in any reconstructible way, and no part of anyone’s sensitive data needs to touch a server.

Yet we are still able to ensure for multiple parties in different places that the contracts they are signing are the same. That’s because when any user has the contract in front of them on their computer and signs it, that signature is irrevocably recorded in the Ethereum blockchain, and it is attached only to that exact version of the contract. Because we use a unique fingerprint of the document to apply signatures, if someone were to change the document in any way, the unique ID would be different therefore the signature would not match.

In essence what Blocknify allows companies and individuals to do is have the same level of security and verification as if all the signatories were sitting and signing the same exact piece of paper. No chance to hide anything or make unauthorized changes. All documents stay local, without touching the cloud, just like with paper.

Your solution uses the Ethereum blockchain. Many people aren’t deeply familiar with how that works, and what the advantages of distributed ledgers are. Why is Ethereum so important for your solution?

The most important thing to know about why we use the Ethereum blockchain is that in order for Blocknify to work, signatures must be totally immutable. There is just no reason to sign something if someone can modify or destroy the signature later. That’s like signing a contract and then not keeping a copy with the countersignatures. Ethereum is a distributed database of all those countersignatures that can’t be changed, only added to.

On Blocknify, once you sign something, it’s signed. That version of the document is signed, but no other version. The thing about databases in the traditional sense, like a cloud storage platform or an on-premise server, is that it is taking something inherently mutable and making it immutable using software. The problem is that the more functionalities and permissions you add on top of a database, the more possibilities there are for a security flaw, and thus for data to be corrupted or changed. A database can be built very secure, but it is mutable by nature.

Blockchain doesn’t have to be like that. Because it is distributed across many, many nodes, no attacker can change the history of transactions without the permission and agreement of a majority of the nodes. As long as there are many actors in the system, the vulnerabilities in any one particular node are minimized by the whole. Ethereum is designed to be very inflexible: it does not focus on speed and ease of use, but on absolute certainty that a change to it is legitimate. Then on top of that, we can build an application layer that is easy to use, like Blocknify.

The great thing about that is that as long as the Ethereum blockchain is used, the records it creates cannot be destroyed or altered. It is safe from disaster in a way. You can’t lose the records in a fire, like you could with paper. You can’t misplace them. If they are destroyed locally, you can still get them back.

So if you imagine a world where all contracts are smart contracts on blockchain, and some disaster happens like a Tsunami, and wipes out all the local databases of a particular company, then every one of their agreements and contracts could still be recovered from their counterparties, and would also still be in effect.

All that being said, as our customer, you don’t need to think about the blockchain or know how Ethereum even works. It is just a way of having a database that is fully transparent and safe in the way it stores and collects data. The way our technology works, we have no access to data from our customers, so no one else does either. Unlike any other e-signature service, there is no risk of a data breach with us because we don’t have any of your data.

This is not only secure in a way that cloud platforms aren’t, but it also makes auditing and verification of authenticity much easier. Because there is no centralized database that can be corrupted, there is also no way to fake, undo, or override previous changes. Anything signed is signed, and the only possible way the signature data is useful is if you have the document it relates to.

To you, what does the future of contracts and signed agreements look like 5 years from now? How will most people be signing and handling confidential documents?

It’s too obvious to say that contracts and the signing process will be paperless. There will be die-hard businesses that still use paper, but changes in regulations such as GDPR will also accelerate the need for everything to be digital, auditable, and in the control of the owners of the data.

I am not going to predict with certainty that you will be using the blockchain to sign everything. You might. Either way, laws and regulations will be focused more on immutable workflows, one way or another. We will have an ever increasing need for systems and databases that cannot be faked, back-dated, or overwritten without some sort of trail. As all things go digital, the danger is the same as with paper: you can destroy documentation and you can create false documentation.

In analogue technology, there have always been ways of using one-of-a-kind aspects of documents to make them resistant to fakery. Watermarks, stamps, holograms, even the grain of paper. The Romans used wood chips that could be matched to each other to verify agreements, for example. They could cut the woodchip in half and only the two pieces matched each other because the wood grains were unique and impossible to fake.

The blockchain replicates that effect. It’s like the blockchain is half of the woodchip, and a private key is the other half. Both unchangeable, both permanent, both only working with the other. That kind of inherent incorruptibility is going to be vital for making digital agreements work in the future.

Of course, blockchain technology also means that we can go beyond the analogue functionalities of a wood chip or a notarized signature. We can construct smart contracts that will only execute when other contracts and agreements have already been fulfilled on the blockchain.

For example, suppose you want to do factoring of your invoices, which means borrowing money against money owed to you as a company, which is a common process in business. Today in order to do factoring, the bank or lender loaning you the money must trust your clients and their agreements with you. If those clients don’t pay, it is your company that is responsible for that. In addition, the lender has to trust that you will pay them back when you get the income you’ve invoiced for.

With a smart contract, you could create a factoring system where that is all automatic. The lender can see the status of the contracts, and can be paid directly from the source. In addition, a smart contract can even put safeguards in place so that a lender knows that the companies which owe money will be able to pay the invoices when they are due. This would also give a lender a way to very safely lend the money, and a company that needs factoring of its invoices a very easy way to get liquidity when it is needed.

In fact, we have built a system just like this for a major bank already. I can’t share more details yet, but this is a really exciting possibility for banks, and for their client companies that face liquidity issues. I believe that solutions like the one we are providing will be the standard in a few years.

What is your go-to-market strategy today, who are you targeting, and where do you see that leading in the next few years?

We were lucky to find our first paid customer early on (Raiffeisenbank) and were able to deliver an API version within a month. Our main go-to-market strategy is B2B as this is business productivity software. Still, because organizations require more significant features, we realize that Blocknify can bring value in a simpler form. With that understanding, we decided first to produce a version meant for freelancers, contractors, and small businesses. We will be launching this version within this quarter (Q2 2018). Then we plan to release an enterprise version in late Q3 2018.   

Today our platform allows us to build processes into our smart contracts.  For example, you have a contract but it is only valid for a certain amount of time. If the contract is self-executing, there’s no need to actively monitor it. Also, we can do something similar for approval processes, and we see these self-executing smart contracts involving more processes over time. We believe this change will happen and we want to provide simple solutions to help companies realize the benefits of smart contracts.

You joined StartupYard in March. What did you expect from the experience, and how has that compared to reality? What has been your biggest challenge in the program?

Coming from consulting, I knew the value of getting an outside opinion for creative inspiration or challenging assumptions. I was expecting StartupYard with the mentors to be the outside consultant to challenge and inspire new ideas. This did happen, and we have benefited greatly from this.

What I didn’t expect was to find partners to help us avoid the common pitfalls, but also going beyond that and helping us grow a business that is self-sustaining and with a strong long term vision. From the outside the acceleration process looks like a carwash, but from the inside, you’re rebuilding the whole engine. When you’re starting a startup, you don’t know how to match your vision with what’s real. At StartupYard you integrate the vision and reality and make it real.

I believe you’re the first American to join the accelerator as a founder. Tell us a bit about your history, and how you ended up in Prague. What was surprising, either pleasant or not, about the transition?

Actually I am Czech on my Mom’s side of the family, but going back to her grandparents. She grew up in a Czech neighborhood in Chicago, with church services in Czech and Slovak. She taught me a lot about the Czech culture, and it ended up being a hobby for me. I used Czechoslovakia and Czechia as topics for a lot of school projects, and things like that.

I started out my career in Seattle, have traveled and lived in South East Asia as a management consultant, eventually living in Seattle again and working for Amazon. I didn’t really want to stay there, and I wanted to run my own company. That’s also a family thing, because my dad also founded and sold his own startup in the past. So I booked a ticket to Europe just to sort of look around. I ended up in Prague, and instantly fell in love. And of course, while I was visiting I met a girl as well. So I was hooked, as many people have been before.

To me Prague is the perfect size for what I want to do. It’s not in the spotlight like San Francisco or London, but it’s smart, there’s lots of local talent, and it still retains this unique atmosphere that my Mom loved about her “Bohemian” neighborhood in Chicago.

Hi Ales, TeskaLabs has done really well post-StartupYard. What have been your biggest successes in the last 3 years?

Thanks, Lloyd. Very glad to hear that. There is a lot of work behind it. As you know, TeskaLabs launched with StartupYard with a focus on securing enterprise mobile applications and networks.  Originally this was with a single core “secure gateway” technology called SeaCat. Based on our cooperation with large corporations such as 02 in the Czech Republic, we have expanded the uses for this core technology into new product lines that support enterprises with large networks and sensitive data in the field.

It is a cruel request to name the most successful piece of work we’ve done. We play a synergic game: we aim to have any new product or feature enhance the whole. So in that sense we are moving on several fronts all at once.

But if I have to choose one, it will be Black Swan, which we first talked about in our annual report last year. Black Swan is originally a part of SeaCat – but today it is a standalone product. It’s a real-time stream analyzer designed to detect anomalies, trend changes, and things that should not be happening on a high-value network. It can be used to identify cybersecurity breaches, detection of malfunctioning IT technologies, but also as a business analytics and intelligence tool.

We deployed Black Swan last year on the national network of a large mobile operator (I won’t name them here), on LTE, 3G, 2G, voice, and data. That investment from their side, I’m happy to say, paid back for them in 5 days.

You also recently announced a new data-anonymization product for GDPR compliance: TurboCat.io. Who is it designed for, and why is it needed?

This is why I said our work is so synergistic. Every time you dive into the problems of securing big networks with lots of different things going on, you discover yet another way to provide more value with the same technology base. That is the case for TurboCat.io as well.

TurboCat.io originated as a part of Black Swan. Black Swan collects and processes billions of datapoints, and a great deal of them are sensitive personal information. Obviously this is a huge concern for telco operators and really anyone who is handling a lot of customer data. GDPR comes with very expensive consequences if data is mishandled or stored in a way that isn’t permitted, so corporations are all thinking now in terms of how GDPR will impact their operations and products.

Therefore, there was particular demand from customers to develop robust tools for anonymization, pseudonymization, encryption, and other tools to ensuring air-tight data privacy. We came up with TurboCat.io thanks to a review with a corporate data privacy officer. We discovered the urgent need for a broader solutions to these issues, so we decided to make it available for others too.

So we created TurboCat.io, a product focused on de-identification of personally identifiable information (PII) as defined by GDPR. You can find more on our blog, where we are publishing a whole series about data privacy for big companies with large databases.

For those who still haven’t brushed up on GDPR and its many new requirements for online businesses, can you tell us what is most important to understand about the new framework?

I think, perhaps a little controversially, that GDPR was needed. Many companies are still in shock and trying to come to grips with the complexities and the limitations on their old data-use practices, but on the whole I think this is a constructive process.

You know, we do cybersecurity, and what we sometimes saw, in the sense of how some companies worked with personal data, scared me frankly. It should scare more people.

GDPR can be viewed as a kind of “scared straight” moment for many companies dealing with a lot of sensitive data and with customer privacy. This was really needed, and it helps to get all of us on one page, dealing with security in a more thorough and complete way. This put everybody on notice that privacy is a right for customers, and must be respected and strictly upheld.

The way the EU bureaucracy has done this is, of course, another matter. It’s not perfect, and it’s not what I would have done, but we are here to deal with it and help companies to adjust.

I view it as essential to privacy and real security, that personal data such as names, emails, addresses, and the like be recognized as having value for their owners. If a business decides to store or process these data, it must also adequately protect them. Fundamentally what GDPR does is to strongly state that these data are our property, and that our property and our privacy are not to be sold or traded as someone else’s assets, beyond our knowledge or control.

GDPR is putting a lot of businesses into panic mode right now. What do you see as the biggest vulnerabilities, and in which industries will GDPR present the biggest challenges?

Yes, you are right. There is a lot of panic.

In general, B2C companies are more exposed than B2B. Obviously B2C companies are dealing with many individuals, and often have many different products and many overlapping data sets and uses for these data that need to be understood, not only by customers but by the companies themselves.

Up to today, large B2C companies such as retailers often did not know all of the data they were storing, who had access to the data, and what all of the data was being used for across the whole company. That can no longer be the case, because in order to do any of these things legally, the company must inform the customers and ask for their permission. They must offer a way of removing these data in many cases, and that requires real changes in the way they operate.

How do you expect that GDPR requirements will change company cultures, or require big shifts in the way some companies operate?

We are working  with several big companies to help them adopt GDPR requirements, and I have to say that it is not really a significant shift at the end of the day.

Staff needs to be well informed and instructed. Bad practices need to be changed, but here it usually correlates with cybersecurity issues, so it needs to be fixed anyway. That’s why I see it as overall positive, not just for society but also for business. These things needed attention, but now there is a strong incentive to make positive changes.

One typical example is a shared account for various online (SaaS) marketing and BI tools. It is very common, and it can do a lot of damage. Single sign-ons for large organizations present a single point of vulnerability that can be exploited. If there is only one way in, then all a company’s associated data is then at risk. GDPR is going to change the behavior of these SaaS providers *and* the companies who use them for the better.

And of course, you should consult your lawyer and review your user agreements. There are probably issues you need to fix. You can no longer hide your data practices behind a general user agreement.

Aside from challenges, what opportunities or positive long-term effects are you expecting from GDPR?

I suspect the landscape of personal data dealing will change significantly. So it is definitively an opportunity for new businesses and innovations. If I have to bet, blockchain technologies and crowd monetization of the access to personal data resonates a lot.

Blockchain allows the possibility of always being in control of what data is shared, and always having visibility on how it is being used. The opportunity to change or correct personal data is really important, and the blockchain allows these changes to be made based on consensus, and not just on the decisions of a particular company. Unfair and descriminatory practices can be defeated in this way, for example by giving individuals the opportunity to see how theirs data is being used in comparison with the data of others.

How should companies make sure they’re compliant with GDPR within the next month?

It is not even a whole month until GDPR become effective. If you haven’t started, I bet you are late already. But no worries, you can still prepare your business. I think that the EU is very much expecting this to be a learning curve, and they must be prepared to give some room to manuever. Then again they will also need to make examples.

Technically: Get a good understanding what personal information you are collecting. Who has access to what, and how you protect these data. Evaluate all data exports and implement de-identification of unneeded entries. And implement monitoring of your IT systems, which will give you an audit trail. That is important for any eventual dispute and will help you a lot.