Privacy notice

The controller is Tolaron s.r.o., IČO 300 03 547, registered office Příčná 1892/4, 110 00 Praha 1, Czech Republic, entered in the Commercial Register at the Municipal Court in Prague, file C 455064.

For anything about your data, write to hello@tolaron.com.

The form on this website gives us your name, email address, optionally your company name, your project message and the language of the page. It sends them to our inbox through the email service Resend. The website does not store them in any database, and its platform logs record only whether the message was delivered, never what it says.

When you email hello@tolaron.com directly, we have what you put in that email.

We use this data to reply and to discuss possible work together. The legal bases are steps taken at your request before a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Without a name, an email address and a message we cannot reply; the company name is optional.

To keep the form from being flooded, the website keeps a hash of your IP address for at most one hour, from which the address itself cannot be read, and counts the messages sent with it. The legal basis is our legitimate interest in protecting the website (Art. 6(1)(f) GDPR).

Calls are booked through Calendly. Calendly passes us your name, email address, the time you chose and anything you write in the booking. We use it to prepare for and hold the call (Art. 6(1)(b) GDPR). Calendly’s own privacy policy applies on its pages.

The website runs on Vercel. Each time a page loads, Vercel processes technical data about the request, such as your IP address and browser type, to deliver and protect the page (legitimate interest, Art. 6(1)(f) GDPR).

We measure visits and page speed with Vercel Web Analytics and Speed Insights. They use no cookies, we strip parameters from page addresses before they are sent, and we see only totals. We count in the same way how often the form is opened or sent; what you write in it never enters the measurement.

When the browser blocks a script or part of a page fails, the website sends a report with a technical category of the error only, without the page address and without data about you.

Links to our profiles on LinkedIn, Instagram and company directories lead to other operators’ pages, where their own policies apply.

To know whether visitors come from our Google Ads, we use the Google tag (gtag.js) in consent mode. It loads on every page, but until you accept it sets no cookies and sends Google only cookieless signals, with ad click identifiers removed. As with any content it loads, Google sees your IP address and browser details.

When you accept, Google stores cookies (for example _gcl_au) that measure whether a visit from an ad led to an enquiry. The legal basis is your consent (Art. 6(1)(a) GDPR and Section 89(3) of the Czech Electronic Communications Act, No. 127/2005 Coll.).

You can withdraw consent at any time in the cookie settings, here or in the footer of every page; the website then deletes the Google cookies. Your choice is remembered only by your browser and is never sent to our server.

Cookie settings

These providers process data on our behalf, each only for its own part:

• Vercel: running the website, measuring visits and speed
• Resend: delivering messages from the form
• Google: our email inbox and Google Ads
• Calendly: booking calls
• the store that limits how many messages the form accepts (an IP address hash only)

We pass data to no one else and never sell it. We make no automated decisions with legal or similarly significant effects.

Vercel, Resend, Google and Calendly are based in the United States or may process data there. Such transfers rely on the safeguards these providers offer, such as the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

• Enquiries and email: as long as needed to handle your enquiry. If we work together, for the term of the contract and the periods accounting and tax rules require.
• Booked calls: as long as needed to prepare the call and follow up on it.
• The IP address hash that limits messages: at most one hour.
• Technical request records: for the period Vercel sets.
• Google cookies: for the period Google sets, or until you withdraw consent or delete them.

You have the right to access your data, to have it corrected or erased, to restrict its processing and to data portability. You can object to processing based on legitimate interest, and withdraw cookie consent at any time. Write to hello@tolaron.com.

If you believe we handle your data unlawfully, you can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7 (uoou.gov.cz), or to the supervisory authority in the EU country where you live.

If the way we process data changes, we update this page and the effective date above.