Privacy Policy

TOTO-Flow is operated by TOTO, Külbstr. 20, 55131 Mainz, Germany ("TOTO-Flow", "we", "us"). For the personal data described in this policy, we are the controller, except where we process customer data on a customer's behalf as a processor (see our Data Processing terms).

Questions or requests: info@totoflow.us.

Information you give us: name, work email, company, role, the service you are interested in, preferred time, payment preference, and any message you write when you request a strategy call or the investor brief.

Information collected automatically: IP address, browser and device type, pages viewed, and referring page, recorded in server logs for security and reliability. We store your language and light or dark mode choice in your browser so the site remembers it.

Customer data: when you use our services, we process the business data you connect, such as emails, calendars, call recordings and transcripts, invoices and contracts. This is processed only on your instructions.

To respond to your request and schedule a strategy call (legal basis: steps prior to a contract, and our legitimate interest in running our business).

To provide, secure and improve our services, and to bill you (contract, legitimate interest, legal obligation).

To send service messages and, where permitted, relevant business communications. You can opt out of marketing at any time (consent or legitimate interest).

To comply with law and to establish, exercise or defend legal claims (legal obligation, legitimate interest).

We do not sell personal data. We share it only with service providers that help us operate, under written agreements: hosting and delivery, email delivery, payment processing (Stripe, PayPal), scheduling and customer-relationship tools, and professional advisers.

We may disclose data where required by law or to protect rights, safety and security, or in connection with a merger, financing or sale of the business, subject to equivalent protections.

Some providers are located outside the European Economic Area. Where we transfer personal data internationally, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where needed.

We keep enquiry data for up to 24 months after our last contact unless you become a customer. Customer account and billing records are kept for the term of the contract and for the period required by tax and accounting law. Customer data is deleted or returned after termination as set out in our Data Processing terms. Server logs are kept for up to 90 days.

Under the GDPR and similar laws you may request access, correction, deletion, restriction, portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time.

To exercise your rights, email info@totoflow.us. We respond within one month. You also have the right to lodge a complaint with your local data protection authority.

We use encryption in transit and at rest, access controls, logging and regular reviews. No system is perfectly secure; we will notify affected parties and authorities of a personal data breach as required by law. See our Security page.

Our services are for businesses and are not directed at anyone under 16. We do not knowingly collect their personal data.

We may update this policy. We will post the new version here with a new date, and tell customers about material changes in advance.