Privacy Policy

1. Introduction

This Policy applies to personal data we process about: (a) visitors to our website at tolmete.com; (b) individuals who register for and use a Tolmete account; and (c) representatives of organisations that subscribe to the Services.

3. Personal Data We Collect

We collect the categories of personal data described below. Where we act as a processor (Section 2.2), the categories of data and data subjects are set out in Annex A to the DPA.

4. How We Use Personal Data and Our Legal Bases

Where we act as a controller, we rely on the following legal bases under Article 6(1) GDPR. Where we act as a processor, the lawful basis for the underlying processing is the responsibility of the customer organisation as controller.

Tolmete uses automated processing to generate the following outputs:

We do not use automated processing to make decisions that produce legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR. AI-generated outputs are informational and are presented to authorised users for review, confirmation, or rejection. Where an organisation uses these outputs, it is responsible for applying appropriate human oversight before relying on them for any decision affecting an individual, including employment-related decisions.

Time log and connected-integration data sent to our AI sub-processor for processing is covered by a data processing agreement. Where a connected chat integration has the relevant setting enabled, short excerpts of channel messages (up to 280 characters each) may be included in that processing. API-submitted data is not used to train the provider’s models, and a zero-data-retention configuration is applied where available.

We use cookies and similar technologies on our website for two purposes:

• Strictly-necessary cookies, which are required to operate the site and keep you signed in. These are always active and do not require consent.
• Analytics cookies, which help us understand how the website and Services are used so we can improve them. These are set only where permitted and, in the EEA and UK, with your consent.

You can manage non-essential cookies through our cookie controls and through your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. The specific cookies in use may be updated from time to time; please refer to our cookie controls for the current list.

7. Who We Share Personal Data With (Sub-processors)

We share personal data with the service providers (“sub-processors”) listed below, who process it on our behalf to help deliver the Services. We impose data protection obligations on each sub-processor equivalent to those we are subject to, and we remain responsible for their performance. “Limited” indicates that the provider may receive technical or metadata incidentally (for example, error logs or API call data) but is not engaged to process the content of personal data as its primary function.

Our primary infrastructure is hosted on Google Cloud Platform servers located in the European Union, and all data at rest is stored within the EU.

Some processing involves sub-processors located outside the European Economic Area (EEA), including in the United States, and Lumitech FZCO itself is established in the United Arab Emirates, which has not received an EU adequacy decision. Where personal data is transferred outside the EEA, we rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914) or an equivalent valid transfer mechanism, together with appropriate supplementary measures. You may request further information about these safeguards using the contact details in Section 13.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, after which it is deleted or anonymised. Key retention periods are:

Subject to applicable law, you have the following rights in relation to your personal data:

• Access — to obtain confirmation of, and a copy of, the personal data we hold about you;
• Rectification — to have inaccurate or incomplete personal data corrected;
• Erasure — to have your personal data deleted in certain circumstances;
• Restriction — to limit how we process your personal data in certain circumstances;
• Portability — to receive your personal data in a structured, commonly used, machine-readable format where technically feasible;
• Objection — to object to processing based on our legitimate interests;
• Withdraw consent — where processing is based on consent, at any time, without affecting prior processing;
• Complain — to lodge a complaint with a supervisory authority (see Section 12).

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption in transit using TLS 1.2 or higher, and encryption at rest using AES-256 on Google Cloud Platform infrastructure;
• Role-based access control, with access to production systems and key sub-processor accounts restricted to authorised personnel;
• Strong password policies and multi-factor authentication for administrative access to production systems;
• Network security via Google Cloud VPC with firewall rules and regular security patching;
• Data minimisation — only data necessary for the relevant purpose is collected and transmitted to AI sub-processors; Slack / Teams data is limited to the channels an administrator has linked to a project, and to private channels only where the Tolmete bot has been added; one-to-one direct messages are never collected;
• Application monitoring and logging, reviewed for security incidents;
• Confidentiality obligations binding personnel with access to personal data, and a documented data breach response procedure.

If a personal data breach occurs that affects your personal data, we will act in accordance with our legal obligations, including notifying the relevant controller and, where required, the competent supervisory authority and affected individuals.

13. EU Representative

As Lumitech FZCO is established outside the European Union, we have designated a representative in the Union under Article 27 GDPR. EEA-based individuals and supervisory authorities may contact our EU Representative on matters relating to the processing of personal data under this Policy: