Privacy statement Tolar-app

Privacy Statement (Part A) and Data Processing Agreement (Part B) · Tolar.app B.V. · Version November 2026

Part A — Privacy Statement

Article 1 Controller and contact details

Tolar.app B.V., located at Vlotlaan 554, 2681 TX Monster, the Netherlands, is the controller for the processing of personal data via the Platform, except to the extent that Tolar acts as a processor on behalf of a business Customer pursuant to Part B.

The Platform distinguishes between (i) the Community: the public part of the Platform in which Users of different Customers share questions, answers, messages and uploads with one another; and (ii) Company Channels: closed channels created by a Customer that are accessible only to the Admin(s) and Users of that Customer. For the processing of personal data in the Community, Tolar always acts as the controller, even if the Customer is an organisation. For the processing of personal data in Company Channels, Tolar acts as a processor on behalf of the Customer, in accordance with Part B.

Questions about this privacy statement or about the processing of personal data by Tolar can be sent to info@tolar.app. Tolar has not appointed a Data Protection Officer; the above contact point serves as the point of contact for privacy questions.

Article 2 What data Tolar collects

When you register for and use the Platform, Tolar collects the following categories of personal data:

  • Contact and account data: first and last name, Chamber of Commerce (KvK) number, email address, telephone number and address;
  • Usage data: error codes and troubleshooting questions entered, feedback given, requests made and other input on the Platform;
  • Technical and security data: login times, IP address at login and general user activity on the Platform;
  • Community data: questions, messages, answers and replies posted by the User in the Community, uploaded files (such as photos, videos and documents), the profile data visible with a contribution (such as name and, where provided, company name and profile photo) and the time of posting;
  • Company Channel data: messages and uploads posted by Admin(s) and Users in the Customer’s Company Channels;
  • Moderation data: reports of contributions made by Users and any measures Tolar takes in response.

If an Admin creates an account on behalf of a User, the name and email address of that User are provided to Tolar by the Admin rather than directly by the User. The User then receives an email to log in personally and is referred to this privacy statement at that time.

Article 3 Purposes and legal basis

Tolar processes the data referred to in Article 2 for the following purposes:

  • Performance of the Agreement and granting access to the Platform (contact and account data)
    Legal basis: performance of a contract (Art. 6(1)(b) GDPR);
  • Provision of the Service, including processing questions and generating AI Advice (usage data)
    Legal basis: performance of a contract;
  • Facilitating the Community, in which Users share practical knowledge and experience with one another (Community data)
    Legal basis: performance of a contract or — for Users who are not themselves a contracting party — the legitimate interest of Tolar and the Users in sharing knowledge with one another;
  • Improvement and (further) development of the Products based on practical experience from the Community, where ‘Products’ means: all products and services that Tolar offers or will offer, including the Platform, the knowledge base and the underlying AI model (content of Community data, without identifying data, see Article 4)
    Legal basis: Tolar’s legitimate interest in improving and expanding its Products;
  • Moderation of the Community, including handling reports and removing (allegedly) unlawful content (moderation data)
    Legal basis: Tolar’s legitimate interest in a safe and lawful Community, or a legal obligation;
  • Security, fraud prevention and preventing misuse (login times, IP address, user activity)
    Legal basis: Tolar’s legitimate interest in a secure and reliable Platform;
  • Improvement of the Platform, the knowledge base and the services (feedback, input, queries)
    Legal basis: Tolar’s legitimate interest in product improvement;
  • Personalised email communication, marketing and telephone communication
    Legal basis: Tolar’s legitimate interest, or consent where legally required; you can unsubscribe at any time;
  • Internal analysis and dashboarding for business operations
    Legal basis: legitimate interest;
  • Invoicing and financial administration
    Legal basis: legal obligation (statutory tax retention obligation) and performance of a contract.

Company Channel data is processed solely to provide the functionality of the Platform to the Customer (see Article 4 and Part B).

No automated decision-making that produces legal effects concerning the User or similarly significantly affects them without human intervention takes place in the provision of the Service: AI Advice is purely supportive in nature and the User decides on any follow-up steps.

Article 4 AI processing and use of input

Tolar uses queries, feedback and other input entered to (re)train the underlying AI model. This may happen automatically, or the input is reviewed manually by the Tolar team and used to expand the knowledge base and improve the Platform.

Community data. Tolar is entitled to use the content of contributions posted in the Community, including messages and uploads, for the improvement and (further) development of the Products, including (re)training the AI model and expanding the knowledge base. This takes place either fully automatically or after manual review by the Tolar team. For this purpose Tolar uses only the content of the contributions and first strips them of identifying data, such as name, profile data, time of posting and metadata of uploads. Tolar also makes reasonable efforts to remove or anonymise personal data appearing in the content itself, such as names, telephone numbers or recognisable persons in photos.

Company Channels. The provisions of this article do not apply to Company Channel data. Tolar does not use this data for training, improvement or further development of the Products, nor for any other purpose of its own, and stores and processes it only to the extent necessary to provide the functionality of the Platform to the Customer. The Customer retains full control over this data.

For the AI functionality, Tolar uses OpenRouter as its AI provider, which provides access to models from, among others, Anthropic (Claude) and OpenAI. These model providers have stated that data submitted via OpenRouter is not used to train their models; however, Tolar cannot guarantee compliance with this policy by these third parties and refers to the providers’ own policies for up-to-date information.

Article 5 Recipients and sub-processors

Tolar shares contact, account, invoicing and technical data only to the extent necessary for the performance of the Service: with team members and subcontractors/developers who play an essential role in the functioning of the Platform, and with the sub-processors listed below. This data is not visible to other Users. Personal data is never sold to third parties.

Visibility of contributions. Contributions in the Community, including the profile data shown with them, are visible to all Users of the Platform, including Users of other Customers. Users decide for themselves what they share and are asked not to post personal data about themselves or third parties, confidential information of the Customer or its clients, or other sensitive information in the Community. Contributions in Company Channels are visible only to the Admin(s) and Users of the Customer concerned.

Responsibility for contributions. The Customer and the User posting a contribution are themselves responsible for the content of contributions in the Community and in Company Channels, including their lawfulness and any personal data of third parties contained in them. Tolar makes reasonable efforts to remove or disable access to (allegedly) unlawful content in the Community as soon as possible after a report or its own discovery, but is not responsible for the content of contributions posted by Users. Tolar does not monitor the content of Company Channels; Tolar may, however, take action following a report of (allegedly) unlawful content.

Tolar uses the following sub-processors:

  • OpenRouter: AI provider giving access to models from, among others, Anthropic and OpenAI; based in the United States (New York);
  • Railway: hosting of the Platform, on an EU server;
  • Supabase: data storage, in an EU region;
  • Stripe: payment processing;
  • Resend: sending transactional emails from the Platform, such as invitations, login and account emails and notifications; based in the United States;
  • Mailchimp: sending email campaigns and newsletters; based in the United States;
  • ActiveCampaign: sending email campaigns and marketing automation; based in the United States.

For sending email, Tolar may use one or more of the email providers listed (Resend, Mailchimp and/or ActiveCampaign).

To the extent that data is transferred to sub-processors outside the European Economic Area (including in any case OpenRouter, Resend, Mailchimp and ActiveCampaign), Tolar ensures that an appropriate safeguard applies, such as Standard Contractual Clauses and/or — where applicable — certification under the EU-U.S. Data Privacy Framework. Further information can be requested via info@tolar.app.

Tolar is responsible for its own compliance with the GDPR, but is not liable for any failure by the platforms and sub-processors listed above to comply with applicable laws and regulations themselves.

Article 6 Retention periods

  1. Tolar does not retain personal data for longer than necessary, with a maximum retention period of five (5) years after termination of the Subscription as the starting point, unless otherwise provided below.
  2. If a deletion request is made within this period in accordance with Article 8, the contact and account data will be deleted. In that case, query logs and feedback are not deleted but anonymised, so that they can no longer be traced back to an individual Customer, Admin or User.
  3. If five years have passed since termination of the Subscription without a deletion request having been made, Tolar is entitled to anonymise all personal data. Once anonymised, data no longer qualifies as personal data within the meaning of the GDPR and may be retained and used by Tolar indefinitely.
  4. If the Customer, Admin or User enters into a new Agreement with Tolar after termination of a Subscription, a new five-year period starts upon any later termination of that Agreement.
  5. Notwithstanding the above, invoicing and other financial administration data (including name, address and Chamber of Commerce number to the extent included on invoices) is retained for at least seven (7) years to comply with the statutory tax retention obligation. A deletion request as referred to in Article 8 can never relate to this data.
  6. Contributions in the Community remain visible until the User deletes them or makes a deletion request in accordance with Article 8. They may thereafter be retained and used in anonymised form in accordance with Article 4 and Article 8(2) and 8(5).
  7. Notwithstanding paragraphs 1 to 4, Company Channel data is deleted no later than ninety (90) days after termination of the Subscription, following any export in accordance with Article 19. Anonymisation and further use as referred to in paragraph 3 do not apply to Company Channel data.

Article 7 Security

Tolar takes appropriate technical and organisational measures to protect personal data against loss or unlawful processing. These include:

  • encryption of data, both in transit and at rest;
  • role-based access control, with two-factor authentication (2FA) for accounts with elevated privileges;
  • a password policy in line with current security standards;
  • regular backups of the stored data.

In addition, Tolar partly depends on the security measures of its sub-processors (including Railway and Supabase), which are themselves bound by their own statutory and contractual security obligations.

Article 8 Rights of data subjects

  1. A Customer, Admin or User has the right to request access via info@tolar.app to the personal data Tolar processes about them, and may request that this data be corrected or deleted.
  2. A deletion request covers all personal data, with the exception of:
    • feedback and input given on the Platform, which is anonymised instead in accordance with Article 6(2);
    • contributions in the Community, which are removed from the Community and are no longer visible to other Users, but may be retained in anonymised form in Tolar’s database in accordance with Article 4 and used for the improvement and further development of the Products; and
    • invoicing and financial administration data that Tolar is required to retain by law, see Article 6(5).
  3. Tolar will handle a request as soon as possible and in any case within the statutory period of one month.
  4. In addition to the right of access and deletion, the data subject has the right to rectification, restriction of processing, objection to processing based on legitimate interest and — where applicable — data portability. A data subject also has the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
  5. A User can delete their own contributions in the Community at any time. The contribution is then removed entirely from the Community and is no longer visible to other Users, even if other Users have replied to it; replies from other Users to the deleted contribution may also be removed from the Community. The content of the deleted contribution, stripped of identifying data, may be retained in Tolar’s database in accordance with Article 4 for the improvement and further development of the Products.

Article 9 Data breaches

  1. If a data breach occurs that may affect the personal data of a Customer, Admin or User, Tolar will inform the Customer concerned and will provide assistance to the best of its ability in resolving the data breach.
  2. Tolar is not liable for a data breach and pays no compensation in connection with a data breach, but will use its best efforts to resolve a data breach and limit its consequences. This clause applies as long as there is no deliberate act (i.e. intent).
  3. To the extent that Tolar acts as a processor within the meaning of Part B, it will inform the Customer concerned, as controller, without undue delay — and no later than forty-eight (48) hours after Tolar becomes aware of the data breach — so that the Customer can comply with any obligation to notify the Dutch Data Protection Authority and data subjects.

Article 10 Confidentiality

All personal data is treated by Tolar as strictly confidential and is shared only with team members, subcontractors and developers who play an essential role in operating the Platform, and with the sub-processors listed in Article 5, with the exception of contributions that a User posts in the Community; these are visible to other Users in accordance with Article 5. Personal data is never sold to third parties.

Article 11 Changes

Tolar may amend this privacy statement and data processing agreement from time to time. The Customer, Admin and/or User will be notified of any change. Continued use of the Platform after the effective date of the change constitutes acceptance of the amended version.

Part B — Data Processing Agreement

Applicable (additionally) when the Customer is an organisation with an Admin and one or more Users, within the meaning of Article 28(3) GDPR.

Article 12 Applicability and status

  1. This Part B constitutes a data processing agreement within the meaning of Article 28(3) GDPR and applies as soon as the Customer is an organisation acting as controller for the personal data of its own Admin(s) and Users on the Platform, including Company Channel data. This Part B does not apply to the processing of Community data, for which Tolar itself is the controller (see Article 1). Where the Customer is an individual self-employed professional who is both Admin and User, Tolar acts directly as controller and only Part A applies.
  2. This data processing agreement forms an integral part of the Agreement between Tolar and the Customer, cannot be terminated separately, and ends automatically upon termination of the Subscription.

Article 13 Subject matter, nature, duration and categories

  1. Tolar processes, on behalf of the Customer, the personal data of the Customer’s Admin(s) and Users as described in Article 2, as well as Company Channel data, for the purpose of providing the Service as described in the terms and conditions and this data processing agreement.
  2. Processing takes place for the duration of the Subscription and ends in accordance with the retention and anonymisation periods set out in Article 6.
  3. The categories of data subjects are the Admin(s) and Users that the Customer adds to the Platform, as well as third parties whose personal data appears in Company Channel data. The categories of data are the contact, usage and technical data referred to in Article 2 and Company Channel data.

Article 14 Instructions

  1. Tolar processes personal data of the Customer’s Admin(s) and Users solely on the basis of this data processing agreement and the Customer’s other written instructions, unless a legal obligation requires Tolar to process it otherwise.
  2. Tolar will inform the Customer if it believes that an instruction from the Customer infringes applicable privacy legislation.
  3. Tolar does not process Company Channel data for its own purposes, including training, improvement or further development of the Products (see Article 4).

Article 15 Confidentiality

Tolar ensures that every person acting under its authority who has access to the Customer’s personal data is bound by an appropriate duty of confidentiality.

Article 16 Sub-processors

  1. Upon entering into the Agreement, the Customer authorises Tolar to engage the sub-processors listed in Article 5.
  2. Tolar will inform the Customer in advance of any replacement of or addition to these sub-processors, so that the Customer can object on reasonable grounds.
  3. Tolar ensures that sub-processors are contractually bound by at least the same data protection obligations as those set out in this data processing agreement.

Article 17 Assistance to the Customer

  1. Taking into account the nature of the processing, Tolar provides the Customer with reasonable assistance in responding to requests from data subjects to exercise their rights as referred to in Article 8.
  2. Tolar provides the Customer with reasonable assistance in complying with its obligations under Articles 32 to 36 GDPR, including security, data breach notification and — where applicable — a data protection impact assessment.

Article 18 Audit

At the Customer’s request, Tolar provides the information reasonably necessary to demonstrate that Tolar complies with its obligations as a processor, and allows the Customer to have audits carried out, provided that this is announced in writing in advance and takes place in a manner reasonable for Tolar.

Tolar is entitled to comply with an audit request by providing relevant certifications, reports from independent third parties (such as ISO, SOC 2 or comparable audits) or other equivalent documentation, to the extent that these reasonably cover the information requested. Only if such documentation is unavailable or provides insufficient insight is Tolar obliged to permit an on-site audit.

An audit will not take place until the Customer and the auditor it engages have entered into a written agreement with Tolar that sets out at least the following:

  • Confidentiality: the auditor and the Customer undertake to maintain full confidentiality regarding all information, data and business processes of which they become aware in the course of the audit, and will not disclose this information to third parties or use it for any purpose other than assessing Tolar’s compliance with its obligations as a processor.
  • Non-competition: the auditor engaged by the Customer may not work for, or otherwise be affiliated with, a competitor of Tolar, and will not in any way use the knowledge acquired during or after the audit for the benefit of a competing service or business.

Without such a prior written agreement, Tolar is not obliged to cooperate with an audit.

All costs associated with an audit initiated by the Customer, including but not limited to the costs of employees, advisers or third parties engaged by Tolar, and any business interruption reasonably resulting from it, are borne entirely by the Customer.

Article 19 Return and deletion after termination

After termination of the Subscription, the personal data of the Customer’s Admin(s) and Users is processed in accordance with the retention and anonymisation periods set out in Article 6. At the Customer’s request, made before this period expires, Tolar will provide an export file of the relevant data. By way of exception, Article 6(7) applies to Company Channel data.

Article 20 Liability

Tolar’s liability under this data processing agreement is subject to the same limitations as set out in the terms and conditions of Tolar.app B.V. These apply only to liability claims brought by the Customer against Tolar.app B.V.

Last updated: November 2026