Privacy notice

Who is responsible

BARTOSZ PAPRZYCKI COMPXED is the data controller. Our correspondence address is ul. Księcia Witolda 49, lok. 15, 50-202 Wrocław, Poland. Contact us at hello@tonalure.com. Our identifiers and telephone number are on the Company & contact page.

When you visit

Your browser sends your IP address, the page address, the time of the request and technical details such as browser information. Our hosting provider uses this information to serve and protect the website. We do not keep a visitor access log or database.

The site has no analytics, advertising trackers, fingerprinting or mailing list. You cannot upload photos, register an account or make a payment here.

The legal basis is our legitimate interest in operating and securing the website (Article 6(1)(f) GDPR). We use only the information needed for those purposes.

When you contact us

We process the contact details, message and attachments you choose to provide to answer your request and handle follow-up. This is based on our legitimate interest in responding to enquiries. If you ask us to take steps towards a contract, Article 6(1)(b) GDPR applies to those steps. Processing needed to comply with a legal duty, including data-protection requests, is based on Article 6(1)(c).

Providing this information is voluntary. Without enough information to understand your request and reply, we may be unable to help. We do not add people who contact us to a marketing list.

Who processes your data

Fly.io, Inc. hosts the website on a server in Frankfurt, Germany. Its global network and operations also process data outside the EU, including in the United States. Transfers covered by the EU–US Data Privacy Framework use that framework; Fly’s data processing agreement provides Standard Contractual Clauses for other transfers. See Fly’s transfer notice and subprocessor list.

OVH sp. z o.o. provides our domain, DNS and email. Our Zimbra mailbox is hosted in Europe. Support and maintenance may involve OVHcloud affiliates outside the European Economic Area (EEA). Where required, transfers rely on an adequacy decision or Standard Contractual Clauses in the OVHcloud data processing agreement.

These providers process data for us under data processing agreements. They may also be responsible for processing needed to meet their own legal and business obligations. We may share information with authorities when the law requires it, or with professional advisers when needed for a specific matter. You can contact us for details of the safeguards used for transfers outside the EEA.

How long we keep information

Fly retains application logs for seven days and records technical details of connection errors. According to Fly, incoming client IP addresses are not retained in its log store. We do not copy these logs to another service.

We keep correspondence until we have dealt with your request and any necessary follow-up, then delete it. Records needed for a dispute, legal obligation or data-rights request may be kept longer. The retention period depends on that purpose and the applicable legal time limits.

Copies may remain in our email provider’s recovery or security systems after we delete a message. OVH’s Zimbra terms allow up to a year of security retention for blocked malicious or spam messages.

Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal data. You can object to processing based on legitimate interests for reasons relating to your situation. Contact hello@tonalure.com; we may ask for information necessary to verify your request.

You can complain to a data protection authority, including the President of the Personal Data Protection Office (UODO) in Poland, or the authority where you live or work in the EEA. You do not have to contact us first.

We do not make decisions about you using automated processing that have legal or similarly significant effects.

Cookies and updates

Our Cookies & device storage page explains what the website stores in your browser. We will update this notice before introducing services that change how we process personal data.