Data processing terms

These terms form part of our terms of service. They cover the personal data in your event’s content: the photos and videos guests upload, and the names and texts on your event page. For this content, you, the host, are the controller: you decide why and how it is shared. We are your processor: we handle it on your behalf, as Article 28 of the General Data Protection Regulation (GDPR) requires. For our own purposes (orders, emails, abuse limits and logs) we are the controller, as our privacy policy explains.

If you are organising a private event such as a wedding or a birthday, the GDPR may not apply to you, because it excludes purely personal and household activities. These terms still describe how we handle your guests’ data.

1. What we do, and for how long

We store your event’s content, show it to the people who have the event’s link (and its PIN, if it has one), make previews of the photos, and let you download and delete it. We do this for as long as your plan lasts: until the end of its retention, then 7 more days for you to download your files, after which the content is deleted (see section 9).

2. The data and the people concerned

• Data: photos and videos, including the details phones store in them (date, phone model and, if the camera saves it, location); the names and texts on the event page; each upload’s time, size and file name; the messages guests leave in the guestbook, with their voice and video notes; and the replies guests give to the event’s invitation (name, whether they come, how many, a note).
• People: the guests who upload, leave a message or reply to the invitation, and anyone who appears in the photos and videos, which can include children.
• Photos and videos can reveal sensitive information, such as someone’s health or religious beliefs. Toloma is meant for event photos and videos only.

3. Your instructions

We process the content only on your documented instructions: your order, the settings you choose and the deletions you make in your dashboard, and what you ask us by email. We never use it for anything else: not for advertising, not for profiling, and not to train artificial intelligence. If the law requires us to process it in another way, we’ll tell you first, unless the law forbids that. If we believe one of your instructions breaks data protection law, we’ll tell you.

4. Confidentiality

Only the people who run Toloma can access the content, and they are bound to keep it confidential. We look at uploads only when it’s needed, for example to fix a problem you report or to remove clearly illegal content.

5. Security

• All traffic is encrypted (HTTPS, TLS 1.2 or later).
• Files and event data are stored encrypted by Microsoft Azure, in France.
• Guests receive a link that can add one file for a few minutes, never read or delete other files.
• Dashboard keys and PINs are stored only in protected (hashed) form. Uploads and wrong PINs are rate-limited.
• Our administration tool requires a Microsoft Entra sign-in and a dedicated admin role.
• We can restore deleted files for 7 days, to undo mistakes; after that they are gone.

We review these measures as the service changes, and keep them at least at this level.

6. Subprocessors

You give us general authorisation to use subprocessors. For event content, we currently use one:

Each subprocessor is bound by data protection obligations at least as strict as these. We’ll announce a new or replacement subprocessor at least 30 days in advance, on this page and by email to the hosts of active events. You can object; if we can’t resolve your objection, you can end your plan and we’ll refund the part not yet used.

7. Where the data stays

Event content is stored and processed in the European Union. We don’t transfer it outside the European Economic Area.

8. Helping you

• Requests from the people concerned. If a guest, or someone who appears in a photo, asks to see or remove their data, you can delete files from your dashboard straight away. If such a request reaches us, we pass it on to you without delay, and we help with anything the dashboard can’t do.
• Data breaches. If we become aware of a personal data breach affecting your event’s content, we tell you without undue delay, and at the latest within 48 hours, with what we know: what happened, the data and people likely concerned, its likely consequences and what we are doing about it. We help you meet your own obligations, such as notifying a data protection authority.
• Impact assessments. If you need to assess the risks of your processing or consult an authority, we give you the information we have about the service.

9. When processing ends

At the end of your plan’s retention plus 7 days, or earlier if you delete your event or cancel your order, we delete the content, including previews and ZIP downloads. Deleted files can be restored by us for 7 more days, then they are gone. We keep no copies, unless the law requires us to. Before then, you can download your files from your dashboard.

10. Information and audits

We give you the information you need to show that these obligations are met, starting with this page; write to contact@toloma.app and we answer within one month. You, or an auditor you appoint who is bound to confidentiality, can audit our compliance once a year with 30 days’ notice, at your cost, or more often if a breach or a data protection authority requires it.

11. Liability and precedence

Liability follows our terms of service. If these data processing terms and the terms of service conflict on data protection, these terms prevail. They apply for as long as we process your event’s content.