This Privacy Policy explains how Toflit (“we”, “us”, or “our”) collects, uses, and protects your personal data when you use [App Name] (the “App”). This policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR) where applicable.
Effective date: 13 August 2026
By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the App.
1. Who We Are
Toflit is the data controller responsible for your personal data collected through the App. If you have any questions about this policy or how we handle your data, you can contact us at [email protected].
2. Information We Collect
We collect only the information needed to provide and maintain your account and access to the App. This currently consists of basic account information, specifically:
– Name
– Email address
– Password (stored in encrypted/hashed form)
We do not currently collect location data, payment or financial information, or usage analytics through the App. If this changes in the future, we will update this policy and notify you as described in Section 11 (Changes to This Policy).
3. How We Use Your Information
We use the account information we collect to:
– Create and manage your account
– Authenticate you when you sign in
– Communicate with you about your account, including service and security notices
– Respond to support requests you send us
– Maintain the security and proper functioning of the App
4. Legal Basis for Processing (UK/EU GDPR)
Where the UK GDPR or EU GDPR applies, we rely on the following legal bases to process your personal data:
- Performance of a contract – to create your account and provide the App’s core functionality.
- Legitimate interests – to keep the App secure and functioning correctly.
- Legal obligation – where we are required to retain or disclose information by law.
5. Sharing Your Information
We do not sell your personal data. We do not currently share your account information with any third-party analytics, advertising, or hosting providers beyond what is strictly necessary to operate the App (for example, the infrastructure provider that hosts our servers, which processes data solely on our behalf and under contractual confidentiality obligations).
We may disclose your information if required to do so by law, or in order to protect the rights, property, or safety of us, our users, or others.
6. International Transfers
If your personal data is transferred outside the UK or European Economic Area (EEA), we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses or an adequacy decision, to protect your data in accordance with UK/EU GDPR requirements.
7. Data Retention
We retain your account information for as long as your account remains active. If you delete your account, we will delete or anonymise your personal data within a reasonable period, unless we are required to retain it for longer to comply with a legal obligation.
8. Your Rights
Under the UK/EU GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of your data (“right to be forgotten”)
- Request restriction of processing
- Object to processing based on legitimate interests
- Request data portability
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, please contact us at [email protected]. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with your local data protection authority if you are in the EU.
9. Data Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including encrypting passwords and restricting access to account data to authorised personnel only. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Children’s Privacy
The App is not intended for children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice within the App, and update the “Effective date” above.
12. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at [email protected].
—
*toflit is operated by Harper Trading ltd*