TOLLOZ PRIVACY POLICY

Last updated: 23 August 2026

1. Who We Are

TOLLOZ UK LIMITED ("Tolloz", "we", "our" or "us") operates the Tolloz bakery management platform, tolloz.com and related applications.

TOLLOZ UK LIMITED
Company number: 17112837
189 Belmont Road, Erith, DA8 1LE, United Kingdom
support@tolloz.com

2. Our Data-Protection Roles

Depending on the circumstances, Tolloz may act as either a data controller or data processor.

When Tolloz is the controller

We normally act as controller for information relating to:

• Tolloz account holders;

• business contacts;

• prospective customers;

• website visitors;

• billing contacts;

• support enquiries;

• sales enquiries;

• Tolloz marketing; and

• our own business operations.

When Tolloz is the processor

When a bakery or cake business uses Tolloz to store and manage information about its own customers, the bakery will normally be the data controller and Tolloz will act as its data processor.

The bakery determines why its customer information is collected and how it is used.

Our Data Processing Agreement provides further information about processor activities.

3. Information We Collect

We may collect the following categories of information.

Account and business information

Including:

• name;

• business name;

• email address;

• telephone number;

• business address;

• job title;

• bakery locations;

• staff information;

• account settings; and

• login information.

Subscription and billing information

Including:

• subscription plan;

• invoices;

• billing address;

• payment status;

• transaction references; and

• payment-provider identifiers.

Complete card information is normally handled directly by our payment provider.

Communications

Including:

• support requests;

• emails;

• support chat;

• contact-form submissions;

• product feedback;

• demo requests; and

• other communications with Tolloz.

Technical information

This may include:

• IP address;

• browser;

• operating system;

• device type;

• identifiers;

• login activity;

• timestamps;

• referring URLs;

• pages viewed;

• application events;

• error information; and

• security logs.

Marketing information

Including:

• campaign interaction;

• communication preferences;

• email engagement;

• advertising attribution;

• website behaviour; and

• consent or opt-out records.

4. Bakery Customer Data

Businesses using Tolloz may upload information concerning their own customers.

This may include:

• customer name;

• email;

• telephone number;

• delivery or collection address;

• order details;

• cake specifications;

• cake reference images;

• customer notes;

• payment status;

• order history;

• birthdays;

• wedding anniversaries;

• other milestones;

• loyalty information; and

• communication history.

Tolloz normally processes this information on behalf of the bakery.

If you are an end customer of a bakery using Tolloz and have questions about how that bakery uses your information, you should normally contact the bakery directly.

5. How We Use Personal Information

Where Tolloz acts as controller, we may use personal information to:

• provide accounts and Services;

• authenticate users;

• process subscriptions;

• provide customer support;

• communicate service information;

• protect our systems;

• detect fraud;

• improve the Services;

• understand product usage;

• manage sales enquiries;

• provide requested demonstrations;

• maintain business records;

• comply with legal obligations;

• administer contracts;

• send permitted marketing; and

• measure advertising and website performance.

6. Our Legal Bases

Depending on the processing activity, we may rely upon:

Contract

Where processing is necessary to enter into or perform our agreement with you or your organisation.

Legitimate interests

Where reasonably necessary for purposes such as:

• operating our business;

• improving the product;

• preventing fraud;

• protecting security;

• providing business-to-business marketing where permitted;

• understanding product performance; or

• providing customer support.

We consider whether those interests are overridden by your rights.

Consent

Where consent is required, including for certain:

• marketing communications;

• advertising cookies;

• analytics cookies; and

• similar technologies.

You may withdraw consent at any time.

Legal obligation

Where information must be processed or retained to comply with applicable law.

7. Tolloz Marketing

We may contact existing and prospective business users regarding:

• product information;

• features;

• webinars;

• offers;

• product updates;

• bakery-management content; and

• related Tolloz services.

Marketing rules differ depending on whether the recipient is a company, sole trader, partnership or individual.

Where consent is required, we will seek appropriate consent.

Every electronic marketing communication will provide a way to unsubscribe or opt out where required.

8. Marketing Sent by Bakeries

Tolloz may provide functionality enabling bakeries to communicate with their customers.

The bakery is responsible for establishing the legal basis for those communications.

Tolloz processes those communications on the bakery's instructions.

Bakery customers should ensure they comply with applicable laws governing:

• email marketing;

• SMS marketing;

• WhatsApp marketing;

• direct marketing;

• consent;

• soft opt-in rules; and

• opt-outs.

9. Payments

Tolloz subscription payments may be processed through Stripe or other payment providers.

Cake businesses may also use integrated third-party payment providers to take customer payments through or alongside Tolloz.

Payment providers may collect information directly and process that information under their own privacy notices and contractual arrangements.

Tolloz does not normally store complete raw payment-card details.

10. Service Providers

We use technology providers to help operate Tolloz.

These may include:

• Supabase: Database, authentication and application infrastructure.

• Vercel: Application hosting and content delivery.

• Stripe: Subscription billing and potentially integrated payment functionality.

• Resend: Transactional email delivery.

• Twilio: SMS, WhatsApp and communications functionality.

• Squarespace: Public website hosting and related website functionality.

• HubSpot: Customer relationship management, enquiries, sales and support functionality.

• Google: Analytics, Tag Manager, advertising and related services where enabled.

• Meta: Advertising measurement and marketing functionality where enabled.

• LinkedIn: Advertising and conversion measurement where enabled.

• Microsoft Clarity: Website analytics and interaction measurement where enabled.

We may introduce tools such as PostHog and Sentry for product analytics, monitoring and error management. Where their use materially changes our processing, we will update our privacy information and cookie controls before or when they are enabled.

11. Cookies

We use cookies and similar technologies for purposes including:

• authentication;

• security;

• website functionality;

• analytics;

• preferences;

• support;

• performance measurement; and

• advertising.

Non-essential cookies will be controlled through our cookie-consent mechanism where required.

Please see our Cookie Policy for further information.

12. International Data Transfers

Tolloz operates internationally and some providers may process information outside the United Kingdom.

Where UK personal information is subject to a restricted international transfer, we will use an appropriate mechanism where required, which may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved EU Standard Contractual Clauses; or

• another legally recognised safeguard.

We will take appropriate steps to assess and protect international transfers.

13. How Long We Keep Information

Retention depends on the type and purpose of information.

Active accounts

Account and Service information is generally retained for the duration of your relationship with Tolloz.

Customer Data after cancellation

Customer Data may remain available for recovery for up to 30 days after subscription termination.

After this, it will normally be deleted or anonymised from active systems.

Encrypted backup copies may remain for up to a further 90 days before expiring through normal backup cycles.

Financial and company records

Invoices, subscription records and relevant accounting information may be retained for approximately six years or longer where legally required.

Marketing records

Marketing information will be retained while relevant and necessary, including suppression records where necessary to ensure we respect opt-outs.

Security records

Security and system records may be retained for an appropriate period depending on their purpose and risk.

14. Security

Tolloz uses technical and organisational security measures appropriate to the nature of the Services.

These may include:

• encrypted HTTPS/TLS connections;

• encrypted cloud storage;

• user authentication;

• tenant separation;

• database access controls;

• role-based permissions;

• restricted administrative access;

• secure secrets management;

• backups;

• logging;

• monitoring;

• vulnerability management; and

• incident-response procedures.

No internet-based service can guarantee absolute security.

15. Tolloz Personnel Access

Tolloz staff do not routinely inspect bakery customer databases.

Where access is necessary for support, security, maintenance or legal reasons, access is restricted to appropriately authorised personnel and subject to confidentiality and security controls.

16. Your Rights

Depending on applicable data-protection law and the circumstances, you may have rights including:

• access to your personal information;

• correction;

• deletion;

• restriction;

• objection;

• portability;

• withdrawal of consent; and

• rights relating to certain automated decisions.

To exercise rights relating directly to your Tolloz account, contact:

support@tolloz.com

If your information was collected by a bakery using Tolloz, you should normally contact that bakery first because the bakery is usually the controller.

We will assist our business customers where appropriate.

17. Complaints

If you have concerns, please contact us first:

support@tolloz.com

You may also have the right to complain to the UK Information Commissioner's Office or another competent data-protection regulator.

18. Children

Tolloz business accounts are intended only for people aged 18 or over.

The Services are not directed at children.

A bakery using Tolloz remains responsible for determining whether it is lawful and appropriate to enter information relating to a child as part of an order.

19. International Users

Tolloz may be offered to businesses outside the United Kingdom.

Where local privacy laws impose additional mandatory obligations, we will seek to comply with those requirements.

As Tolloz expands into additional territories, country-specific privacy supplements may be introduced.

20. Changes to This Policy

We may update this Privacy Policy to reflect:

• changes to Tolloz;

• new providers;

• new features;

• legal developments; or

• changes in our processing.

The latest version will be published with an updated date.

21. Contact Us

TOLLOZ UK LIMITED
Company number 17112837
189 Belmont Road
Erith
DA8 1LE
United Kingdom

support@tolloz.com