Privacy notice
How Togra Transparency handles personal data. It serves two kinds of people: producers who issue Article 19 transparency reports, and the participants those reports are issued to.
1. Who is responsible
Togra Software, [operator registered address to insert] ("we") runs Togra Transparency. Contact for everything in this notice: contact@togra.online.
Our role depends on the data:
- Account and sign-in data (a producer's login, a participant's sign-in link): we decide why and how it is used, so we are the controller.
- The content a producer enters (titles, deal terms, receipts, the names, email addresses and shares of participants, the reports): the producer decides why and how it is used, so the producer is the controller and we process it on their behalf under the data processing agreement.
2. What we hold
| Data | Whose | Why |
|---|---|---|
| Name, email address, password (stored only as a one-way hash), two-step sign-in secret if switched on, sign-in times | Producer users | To run the account and keep it secure. |
| Company legal name, address, CRO and VAT numbers, logo | The producer's company | To head the reports the company issues. |
| Titles, deal terms, receipts, shares, the reports themselves | The producer's company | To calculate and issue reports. Entered by the producer. |
| Name, email address, role and share of each participant | Participants | To calculate each participant's figures and send them their report. Entered by the producer. |
| When a report was sent, opened and acknowledged; the name and IP address given when a confidentiality agreement is signed | Participants | So the producer can show a report was delivered. The producer sees this. |
| The report files, a summary of the figures, and the participant's name, email address and role, when a producer publishes from a connected Togra account | Participants | So the participant sees the report on their page here. Sent by the producer's own account; the producer is the controller. |
| Email address, IP address and time of each request for a sign-in link | Anyone who asks for one | To send the link and to limit abuse. Deleted after 30 days. |
3. Who sees what
A producer who also uses the main Togra service can connect that account so the reports they issue appear on their participants' pages here. A connection is registered by us only after the producer has accepted the terms and the data processing agreement, and the producer chooses, each time they issue reports, whether to publish them here. The email a participant receives says when a report is also on their page.
- A producer sees their own company's data and nobody else's.
- A participant sees only the figures issued to them, as they stood when the producer locked the period. A participant never sees another participant's figures or the producer's other deals.
- We see data only to run and secure the service and to answer a request for help.
4. Who else handles it
Hosting: Hetzner. Email delivery: Scaleway (Transactional Email). We use no analytics, no advertising and no scripts loaded from other sites.
5. Cookies
One session cookie keeps you signed in. It is needed for the service to work and is removed when your session ends or you sign out.
6. How long we keep it
- Records of requests for a sign-in link: 30 days.
- A sign-in link works once and expires after 15 minutes. A participant session lasts up to 12 hours.
- A producer's content and reports: until the producer asks us to delete them or closes the account. [Retention after closure to insert.]
- A report published here from a connected Togra account: until the producer withdraws it or the participant removes it from their page. Removing deletes our copy at once, and it does not return if the producer publishes it again.
7. Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. If your data was entered by a producer, we pass your request to that producer, who decides it, and we help them act on it. Write to contact@togra.online. You can complain to the Data Protection Commission (dataprotection.ie).
8. Changes
Each change gets a new version number, shown at the top of this page.
Questions, data requests and abuse reports: contact@togra.online