Privacy notice
Version: 27 October 2026 (draft)
Who is responsible
MirHunn S.à r.l.-S, trading as TokTech Studio, 44, rue de l’Industrie, L-8069 Strassen, Luxembourg (RCS B311057). Email: info@toktechstudio.com, phone and WhatsApp: +352 621 394 175. The EU General Data Protection Regulation (GDPR) applies; for Switzerland also the Federal Act on Data Protection (DSG).
1. Businesses we contact (concept websites and the first email)
- What we use: the business’s name, its business contact details (the email address it publishes on its own website or in a public business register or directory, phone, address), names of owners or staff when the business publishes them on its own website, the texts and photos of its current website, and its public Google Maps listing (opening hours, rating).
- Sources: the business’s own website, public business directories (for example search.ch), the public company registers (Brønnøysund in Norway, PRH in Finland), and Google Maps.
- Why: to build a concept website for the business and to offer it once by email, with at most one reminder.
- Legal basis: our legitimate interest in offering our services to businesses (Art. 6(1)(f) GDPR); in Switzerland an overriding private interest (Art. 31 DSG). We do not contact businesses that have opted out of advertising in a directory (the “*” mark in Switzerland), and in Norway we write only to a company’s general address.
- How long: if there is no answer, we delete the concept and the data 30 days after the reminder (36 days after the first email at the latest). If you say no, we delete everything within 14 days, except a short do-not-contact record (business name, email address and its domain, the reason and the date), which we keep without time limit so that we never write to you again.
- Your right to object: you can object at any time, free of charge, by answering “4”, “no” or “stop”, or with the link in the email. We stop at once.
2. Customers and the TokTech app
- What we use: contact and billing details (business name, contact person, billing address, VAT number), the domain and website details, the extras you choose, the date you accepted our terms, messages, photos and files you send us in the app (photos are re-encoded on your device, which removes location data), change requests, call-back requests (day, time window, phone number, note), sign-in data (a keyed hash of your personal code, one-time codes sent to your business email, the devices you signed in on with a short label such as “iPhone, Safari”), payment references and invoice copies from Stripe, and, if you turn them on, the address your browser gives us for notifications.
- Why and legal basis: before you say yes, our legitimate interest in answering you (Art. 6(1)(f) GDPR); after you say yes, to carry out our contract with you (Art. 6(1)(b) GDPR); invoices and accounting records, because the law requires it (Art. 6(1)(c) GDPR).
- How long: for as long as you are a customer. When the monthly plan ends, we delete your app data 12 months after the end date; if you never take the monthly plan, 12 months after your website goes live; earlier if you ask. Invoices stay with our payment provider Stripe for the 10 years Luxembourg bookkeeping law requires. Sign-in sessions expire after 90 days, one-time codes after 30 minutes. Security logs (who did what, never message content and never IP addresses) are kept for 2 years.
- Cookies in the app: only cookies that are strictly necessary to sign you in and keep you signed in (session, known device, sign-in in progress). No tracking or advertising cookies, so no cookie banner.
3. Visitors of the TokTech website and requests sent from it
- No cookies and no tracking on the website. Our hosting provider keeps short technical logs for security.
- When you send the request form or ask for a call back, we use your name, business, email or phone, your choices and your message to answer you (Art. 6(1)(b) GDPR, or (f) where no contract is in view). We delete the request 90 days after it is closed, and at the latest after 12 months.
- To stop spam, sending a form uses Cloudflare Turnstile, which processes your IP address and browser details for that check. It is loaded only when you send a form.
4. Forms on our customers’ websites
When a visitor sends a form on a website we built (for example a table request or an order), we forward the message to that business by email and do not store it; we keep only a daily count of messages. The business is responsible for that data; we act as its processor under the Data Processing Terms.
5. Who receives data
Service providers that work for us under data processing agreements:
- Cloudflare (hosting of the website, the app and its database and files; spam protection);
- Stripe Payments Europe, Ireland (payments, invoices, customer portal);
- our email provider, Namecheap Private Email (our mailbox, sign-in codes and notices);
- GitHub (storage of the code of our websites and of the concept websites);
- browser push services (Google, Apple, Mozilla, Microsoft), only if you turn on notifications; the content is end-to-end encrypted.
If you write to us on WhatsApp, WhatsApp (Meta) processes the messages under its own terms.
Some providers are in the USA or have access from there; transfers rely on the EU-US and Swiss-US Data Privacy Framework and the Standard Contractual Clauses. We do not sell data.
6. Your rights
You can ask for access, correction, deletion, restriction and data portability, and object to processing based on legitimate interest, including direct marketing (always free and without giving reasons). Write to info@toktechstudio.com or use the chat in the app. You can also complain to a supervisory authority: the CNPD (Commission nationale pour la protection des données) in Luxembourg, or your local one: the Federal Data Protection and Information Commissioner (EDÖB / PFPDT) in Switzerland, Datatilsynet in Norway, or the Data Protection Ombudsman (Tietosuojavaltuutettu) in Finland.
7. Security
Encrypted connections, access only for those who need it, personal codes and one-time codes stored only as keyed hashes, no passwords, regular backups, and automatic deletion when data is no longer needed.
8. Changes
We update this notice when our processing changes; the date at the top shows the current version.