Privacy policy

01 Who we are

Tolo Technologies ("we", "us") is the data controller for personal data collected through this website and in connection with our services.

Company: Tolo Technologies
Address: Middelfartvej 125, 5000 Odense, Denmark
E-mail: support@tolotechnologies.com

02 What we collect

SituationData

You send an enquiryName, e-mail, company (optional), the type of project, budget range and your message.

You become a clientContact details, project descriptions, messages, files and links you share, invoices and payment status.

You pay onlinePayments are handled by Stripe. We receive the payment result and the last four digits of the card — never the full card number.

You visit the websiteTechnical data in server logs: IP address, browser type, pages requested and time. Used only for security and fixing errors.

We never ask for sensitive data (such as health information). Please don't send it to us.

03 Why we use it — and our legal basis

To reply to you and prepare a quote — steps at your request before a contract (GDPR art. 6(1)(b)).
To deliver and support your project, including the 1-year service guarantee — performance of our contract (art. 6(1)(b)).
To invoice and keep accounts — legal obligation under bookkeeping law (art. 6(1)(c)).
To keep the website secure and working — our legitimate interest in protecting our systems and our clients (art. 6(1)(f)).

We do not use your data for automated decisions or profiling, and we don't send newsletters unless you explicitly ask for them.

04 Who we share it with

We only use trusted providers that process data on our behalf under a data processing agreement, and only as much as they need:

Hosting provider — runs the website and stores the database, within the EU/EEA where possible.
Stripe — processes card payments securely (PCI DSS certified).
E-mail provider — delivers the e-mails we send you.
Anthropic (Claude) — only if you use the optional AI brief in the client portal; the project description you enter is processed to write the brief.

If a provider processes data outside the EU/EEA, we rely on an adequacy decision or the EU Standard Contractual Clauses. We never sell or rent personal data. We share data with authorities only when the law requires it.

05 Cookies

We use only cookies that are strictly necessary for the website to work, so no consent banner is needed:

CookiePurpose and duration

tolo.authKeeps you signed in to the client portal. Up to 14 days, or until you sign out.

.AspNetCore.AntiforgeryProtects forms against forgery attacks. Deleted when you close the browser.

We use no analytics, advertising or social media cookies. Fonts and scripts are served from our own server, so your browser doesn't contact third parties when you browse the site.

06 How long we keep it

Enquiries that don't become a project — deleted after 24 months.
Client and project data — for the duration of our collaboration and the service guarantee, then up to 3 years so we can support you.
Invoices and accounting records — 5 years from the end of the financial year, as required by bookkeeping law.
Server logs — 30 days.

07 How we protect it

All traffic is encrypted (HTTPS). Passwords are stored as strong one-way hashes, accounts lock after repeated failed sign-ins, and only authorised staff can access client data. Card data never reaches our servers. We keep our systems updated, use strict browser security headers, and back up data regularly. If a breach ever puts your data at risk, we will tell you and the authorities as the law requires.

08 Your rights

AccessGet a copy of the data we hold about you.

CorrectionHave inaccurate data corrected.

DeletionAsk us to delete your data, unless the law requires us to keep it.

RestrictionAsk us to pause the use of your data.

PortabilityReceive your data in a machine-readable format.

ObjectionObject to use based on our legitimate interest.

To use a right, e-mail support@tolotechnologies.com. We reply within one month. You can also complain to Datatilsynet (the Danish Data Protection Agency), www.datatilsynet.dk.

09 Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. If a change matters to you as a client, we'll tell you by e-mail.