Privacy Policy
This policy explains how TOONAH SAS processes the personal data for which it is the controller: visitors to the toonah.io website, prospects, contact persons at our customers, users of the platform for the management of their account, and people who write to us. It meets the requirements of Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and of the French Data Protection Act (loi Informatique et Libertés) of 6 January 1978 (Law no. 78-17).
The data that our customers record in their space (risks, controls, audits, evidence, documents, etc.) is processed by TOONAH on their behalf, as a processor: it is covered by the Data Collection and Processing Policy and the Data Processing Agreement. For such data, please address your requests first to the organisation that gave you access.
1. Controller and contact
TOONAH SAS, [TO BE COMPLETED: legal form, Trade and Companies Register (RCS) number and registered office address].
Contact for any question relating to your data: [TO BE COMPLETED: address of the data protection officer (DPO) or of the designated contact, for example dpo@toonah.io, and identity of the DPO if one is appointed]. General contact: contact@toonah.io.
2. Processing, purposes, legal bases and retention periods
| Processing | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Browsing toonah.io | Server technical logs (IP address, date, page requested, browser) | Security and proper operation of the website | Legitimate interest (security) | [TO BE COMPLETED: retention period of web server logs] |
| Demo request via the website form | Name, business e-mail, organisation, headcount, message | Getting back to you | Pre-contractual measures at your request | The form prepares an e-mail in your mail client: nothing is transmitted until you send it. Thereafter, as for a prospect (below) |
| toonah.io public assistant | Questions asked, answers, language; no cookies; conversation kept in your browser tab and for 24 hours on our servers | Answering your questions about TOONAH | Legitimate interest (providing information to visitors) | 24 hours for the conversation |
| Contact request via the assistant | Name, business e-mail, organisation, job title, stated need, excerpt of the conversation; proof of consent (date, version of the information notice, HMAC fingerprints of the IP address and browser) | Getting back to you and qualifying your need | Consent, collected via a box that is not pre-ticked | Conversation excerpt: 90 days. Prospect record: 36 months after the last contact |
| Prospect and customer management (internal customer relationship tool) | Identity and business contact details of contact persons, job title, exchanges, tasks, internal notes, communication preferences | Commercial relationship, account follow-up, support | Legitimate interest (B2B prospecting, relationship management); performance of the contract for customers | Unconverted prospects: 36 months after the last contact (scheduled purge). Customers: duration of the relationship, then [TO BE COMPLETED: duration] |
| E-mail prospecting | Business e-mail address, consent or objection | Information about our plans | Legitimate interest for similar offers addressed to professionals, with a right to object; consent where required (optional box at sign-up) | Until objection or 36 months without contact |
| Creation and management of the customer account | Organisation name, country, sector, plan; administrator's surname, first name, e-mail and language; company identification information (name, registration number, tax number, address, contact) | Opening and administering the space, verifying the identity of the company | Performance of the contract; legitimate interest (fraud prevention) | Term of the contract, then [TO BE COMPLETED: duration] |
| Platform user accounts | Surname, first name, e-mail, language, role, account status, date of last login, failed logins, activation of two-factor authentication | Authenticating, securing and administering access | Performance of the contract with the customer; legitimate interest (security) | Lifetime of the account; [TO BE COMPLETED: period after deletion] |
| Evidence of acceptance of contractual documents | Account, organisation, versions and fingerprints of the documents accepted, date, method, language, HMAC fingerprints of the IP address and browser | Proving the conclusion and content of the contract | Legal obligation and legitimate interest (evidence) | Term of the contract, then [TO BE COMPLETED: limitation period adopted, for example 5 years] |
| Invoicing and payment | Organisation, billing e-mail, plan, currency, customer and subscription identifiers at Stripe, payment history (no card data held by TOONAH) | Invoicing and collecting payment | Performance of the contract; legal obligation (accounting) | Accounting records: 10 years (French Commercial Code, Article L. 123-22) |
| Service e-mails | E-mail, first name, language, type of e-mail, technical reference | Sending account-related e-mails (welcome, invitation, password reset, security, invoicing, contractual documents) | Performance of the contract; legitimate interest (security) | Sending log without address: [TO BE COMPLETED: log retention period] |
| Security and audit log | Account identifier, action, date, IP address and browser for sensitive actions (login, role change, support access) | Detecting and investigating incidents, proving actions | Legitimate interest (security); legal obligation (Article 32 GDPR) | [TO BE COMPLETED: retention period of the audit log, no automatic purge to date] |
| Support and support access | Exchanges with support; in the case of support access to a space, identity of the person intervening, date and reason | Resolving requests | Performance of the contract | [TO BE COMPLETED: duration] |
toonah.io website assistant
The website offers an automated assistant, identified as such, which answers your questions about TOONAH on the basis of our public documentation. Your messages are processed by our artificial intelligence provider Mistral AI solely in order to answer you; the conversation is kept for no more than 24 hours, unless you erase it earlier ("Clear the conversation" button). If you agree to be contacted, we record, on the basis of your consent, the contact details you enter, a summary and an excerpt of the exchange, and the date and version of the consent text. This data is intended for our sales team, kept for no more than 36 months after our last exchange (90 days for the conversation excerpt) and is never sold. Sending commercial information requires a separate, optional box. Do not share sensitive data with the assistant.
3. Recipients
Your data is accessible only to the TOONAH teams that need it (sales, support, technical), with access rights limited by role. It is also processed by our providers, within the limits of their assignment:
- OVH SAS (France): hosting of servers and databases; [TO BE COMPLETED: to be confirmed — sending of transactional e-mails];
- Stripe: payment of subscriptions [TO BE COMPLETED: Stripe contracting entity and transfer mechanism];
- Mistral AI (European Union): language model for the toonah.io public assistant [TO BE COMPLETED: confirm the location and safeguards of the Mistral contract].
We do not sell your data. It may be disclosed to the authorities where required by law.
4. Transfers outside the European Union
The processing for which TOONAH is the controller is hosted in France. Where a provider may process data outside the European Economic Area (for example Stripe), the transfer is governed by an adequacy decision (including the EU–US Data Privacy Framework for certified entities) or by the European Commission's standard contractual clauses [TO BE COMPLETED: mechanism adopted for each provider]. You may obtain a copy of the safeguards by writing to the contact address above.
5. Security
TOONAH applies measures appropriate to the risk: hosting in France, encryption of communications (HTTPS), two-factor authentication offered to all users, encryption of secrets at rest, role-based access control, audit log, daily backups. Details are set out in Annex 3 of the Data Processing Agreement.
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection (in particular to prospecting, at any time and without giving reasons) and portability, and the right to withdraw your consent at any time, without affecting prior processing. You may set out instructions regarding the fate of your data after your death.
To exercise your rights: [TO BE COMPLETED: data contact address]. We respond within one month, which may be extended by two months if the request is complex. We may ask you to prove your identity in case of reasonable doubt.
You may lodge a complaint with the CNIL (cnil.fr) or with the supervisory authority of your country of residence. If you reside outside the European Union (for example in a CEMAC or WAEMU (UEMOA) member state or in the Democratic Republic of the Congo), your national legislation may grant you additional rights and designate a competent authority [TO BE COMPLETED: local authorities and notices to be checked by counsel].
7. Cookies and local storage
The toonah.io website does not set any cookies and does not use any audience measurement or advertising trackers. Details of the storage used by the website and by the platform are set out on the Cookies page.
8. Automated decisions
TOONAH does not take any decision producing legal effects concerning you based solely on automated processing. The public assistant qualifies a contact request (interest, urgency) to help the sales team; a member of the team always decides on the follow-up.
9. Changes
We may amend this policy. Each version is dated and numbered. Significant changes are notified on the website and, for our customers, on the platform.