Privacy policy
(„Privacy Policy“)
1. INTRODUCTION
1.1Protecting your privacy is our top priority. When using our Togetu application, you entrust us with your personal data, and we want you to be confident that we handle it responsibly, transparently, and in compliance with applicable laws — in particular, but not limited to, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR”).
1.2In this Privacy Policy, you will find an overview of what information we collect about you in connection with your use of the Togetu application, why we need it, how we use it, and how we protect it. We will also explain your rights related to data processing and how you can exercise them.
2. WHAT DOES THIS PRIVACY POLICY COVER?
2.1This Privacy Policy applies to the use of the Togetu application (hereinafter referred to as the “Togetu App”), our website https://togetu.com/, and any products or services operated under the Togetu brand (hereinafter collectively referred to as the “Products”).
3. DATA CONTROLLER OF YOUR PERSONAL DATA
3.1The controller of your personal data in connection with the use of the Products is:
3.2Quack 3 eggs s.r.o.
3.3Registered office: Mánesova 1649/86, Vinohrady, 120 00 Prague 2
3.4ID No.: 224 50 963
3.5Registered in the Commercial Register administered by the Municipal Court in Prague under File No. C 416743
3.6(hereinafter referred to as the “Controller,” or “we,” “us,” “our,” etc.).
4. WHAT PERSONAL DATA DO WE COLLECT?
4.1In order to properly provide you with our Products and ensure that they function as intended, we collect (and process) the following personal data about you (hereinafter referred to as “Personal Data”):
| Type of Personal Data | Description |
|---|---|
| Identification Data | Information that can be used to identify you as a natural person, such as your name, gender, or date of birth (or age). |
| Contact Data | Information that can be used to contact you, such as your email address or phone number. |
| Other Information About Your Profile | When you create a User Account (the term “User Account” has the same meaning as defined in the Terms of Use of the Togetu Application and Other Products, available here) and set up your profile in connection with the use of the Products, you provide us (and we therefore collect) additional personal information beyond the data mentioned above, such as your interests, hobbies, photographs and other visual materials you publish within your profile settings, educational institutions you attend, and similar information. |
| Other Data Collected When You Use the Products | We collect information about your activities related to the use of the Products, such as your connections with other users, interactions with other users, use of private messages (chats) with other users — including the content of messages, recipients, and message timestamps — your communications with us (i.e., the Controller), for example, in connection with user support, your user reviews (including those published on third-party websites), and other data related to your interactions and activities arising from your use of the Products. We may also collect information about your interactions with advertisements displayed within our Products (e.g., viewing time, ad clicks, etc.). |
| Device Information | We also collect data about the devices you use to access the Products. This includes, in particular, your IP address, information about the device itself and its settings, hardware and software characteristics — such as device ID or advertising ID, type and version of the operating system, mobile carrier, language settings, memory capacity, battery level, and other related details. If you give us your explicit consent, we may also process the contents of your contact list. |
| Geolocation Data | If you grant permission, we may collect data about your precise geographic location (latitude and longitude) based on information provided by your device’s geolocation technology. If you deny this permission, certain features that rely on precise geolocation may not be available to you. |
| Single Sign-On Information | If you use a single sign-on account from a third party (e.g., Google) to log in to your User Account, those account providers will be notified of your login, and we will receive your Personal Data from them. |
| In certain cases, some of the above-mentioned information may be considered sensitive or special category data, such as information relating to your health, political opinions, sexual orientation, or intimate life. If you choose to share such information with us, we will treat this as your consent to its processing in accordance with the rules described in this Privacy Policy. | |
5. HOW DO WE USE YOUR PERSONAL DATA?
5.1The Personal Data we process, as described in the section above, is used for the purposes outlined below:
| Purpose of Processing Personal Data | Type of Personal Data | Legal Basis |
|---|---|---|
| Enabling the proper use of the Products (e.g., creating and setting up your User Account, recommending one user to others for connection, facilitating communication between you and the Controller, evaluating and responding to your requests addressed to the Controller, etc.). | Identification Data; Contact Data; Other Information About Your Profile; Other Data Collected When You Use the Products; Device Information; Geolocation Data; Single Sign-On Information | Article 6(1)(f) of the GDPR – processing is necessary for the purposes of the Controller’s legitimate interests (it is in the Controller’s legitimate interest to properly provide the Products to users). Article 6(1)(a) of the GDPR – consent (where required by the nature of the Personal Data or by law). |
| Monitoring the performance of our Products and continuously improving them (e.g., analysing how our Products are used, analysing and evaluating user behaviour within the Products — including through artificial intelligence technologies — conducting market research, identifying target groups for the Products, and evaluating user reviews etc.). | Identification Data; Contact Data; Other Information About Your Profile; Other Data Collected When You Use the Products; Device Information; Geolocation Data; Single Sign-On Information | Article 6(1)(f) of the GDPR – processing is necessary for the purposes of the Controller’s legitimate interests (it is in the Controller’s legitimate interest to continuously improve the Products). Article 6(1)(a) of the GDPR – consent (where required by the nature of the Personal Data or by law). |
| Operating marketing and advertising campaigns (e.g., analysing advertising campaigns related to the Products, analysing advertisements displayed within our Products, offering personalized advertising to users of the Products etc.). | Identification Data; Contact Data; Other Information About Your Profile; Other Data Collected When You Use the Products; Device Information; Geolocation Data; Single Sign-On Information | Article 6(1)(f) of the GDPR – processing is necessary for the purposes of the Controller’s legitimate interests (it is in the Controller’s legitimate interest to promote the Products and display personalized advertising to users, making it more useful to them and helping to finance the operation and provision of the Products). Article 6(1)(a) of the GDPR – consent (where required by the nature of the Personal Data or by law). |
| Protecting user safety (e.g., preventing, detecting, and combating violations of any conditions for the use of the Products or applicable laws in connection with the use of the Products, verifying your identity when necessary etc.). | Identification Data; Contact Data; Other Information About Your Profile; Other Data Collected When You Use the Products; Device Information; Geolocation Data; Single Sign-On Information | Article 6(1)(c) of the GDPR – processing is necessary for compliance with a legal obligation to which the Controller is subject (e.g., removal of illegal content). Article 6(1)(d) GDPR – processing is necessary to protect your vital interests. Article 6(1)(f) of the GDPR – processing is necessary for the purposes of the Controller’s legitimate interests (it is in the Controller’s legitimate interest to protect users of the Products). Article 6(1)(a) of the GDPR – consent (where required by the nature of the Personal Data or by law). |
| Compliance with legal obligations, fulfilment of the Controller’s duties, and protection of the Controller in connection with the exercise of its rights or defense against claims (e.g., processing and storing Personal Data to ensure compliance with legal regulations and to demonstrate such compliance, cooperating with public authorities, asserting legal claims by the Controller against relevant persons, and defending the Controller against alleged claims from others etc.). | Identification Data; Contact Data; Other Information About Your Profile; Other Data Collected When You Use the Products; Device Information; Geolocation Data; Single Sign-On Information | Article 6(1)(c) of the GDPR – processing is necessary for compliance with a legal obligation to which the Controller is subject (e.g., removal of illegal content). Article 6(1)(d) of the GDPR – processing is necessary to protect your vital interests. Article 6(1)(f) of the GDPR – processing is necessary for the purposes of the Controller’s legitimate interests (it is in the Controller’s legitimate interest to comply with legal regulations and protect itself in the event of legal or other proceedings). Article 6(1)(a) of the GDPR – consent (where required by the nature of the Personal Data or by law). |
| If required by the nature of the specific purpose of processing Personal Data or by the nature of the Personal Data themselves, Personal Data not explicitly listed in the middle column of this table may also be used to achieve the purpose of processing. | ||
6. WHO DO WE SHARE YOUR PERSONAL DATA WITH?
6.1In order to provide you with the best possible user experience, we may share your Personal Data with other users or third parties. The specific reasons for sharing your Personal Data are outlined below:
| Recipients of Your Personal Data | Type of Personal Data or Other Definition of Shared Data | Reason for Sharing |
|---|---|---|
| Other Users of the Products | The Personal Data shared with other users depend on the information you provide within your public personal profile. These will primarily include your name, age, information you choose to disclose about yourself (such as your interests and hobbies), photographs and other visual materials you publish in your public profile, and educational institutions you attend. We may also share with other users how we have resolved their complaint concerning your user profile. | The Products (especially the Togetu App) operate, among other things, on the basis of the voluntary disclosure of selected personal data, which allows users to be connected with one another. Therefore, other users may view the information contained in your public profile. |
| Controller’s Partners and Persons Providing Services or Other Deliverables to the Partner | The shared information may vary depending on the nature of the service provided but typically includes: Identification Data; Contact Data; Other Information About Your Profile; Other Data Collected When You Use the Products; Device Information; Geolocation Data; Single Sign-On Information. | We share data with our suppliers and partners who assist us in operating the Products. These may include entities providing services in areas such as marketing, advertising, analytics, hosting, customer relations, legal consulting, and security. These partners, with whom we share your Personal Data, act as data processors, while the Controller remains the data controller of your Personal Data. This means that such partners may process your Personal Data only according to our instructions and for the purposes determined by us as the Controller. |
| Public Authorities or Bodies Empowered to Decide on the Rights and Obligations of Individuals | Identification Data; Contact Data; Other Information About Your Profile; Other Data Collected When You Use the Products; Device Information; Geolocation Data; Single Sign-On Information. | We may share your Personal Data with public authorities both for the purpose of fulfilling the Controller’s legal obligations, and for cooperation in detecting and preventing illegal activities or protecting the safety of certain individuals (if such reasons do not already fall under the legal obligation of the Controller). Similarly, we may share your Personal Data with public authorities, arbitration bodies, or arbitrators in connection with the exercise or defense of the Controller’s legal rights. |
If required by the nature of the specific reason for sharing Personal Data or by the nature of the Personal Data themselves, Personal Data not explicitly listed in the middle column of this table may also be used to achieve the purpose of sharing. We do not share your personal data with any entities outside the European Economic Area, except as required by law and with our partners listed below who are based outside the European Economic Area. | ||
6.2In connection with the use and processing of Personal Data, the Controller plans to use the following partners who, on the basis of a contract between this partner and the Controller, process Personal Data or part thereof for the purposes described in this Policy:
aSupabase, Inc., a company incorporated and operating under the laws of Delaware, with its registered office at 970 Toa Payoh North #07-04, Singapore 318992; in relation to this partner, we note that this partner is based in a third country for which the Commission has not issued a decision on adequate protection within the meaning of the GDPR. Appropriate safeguards have been established regarding the nature of the Personal Data on the basis of a relevant agreement between this partner and the Controller. In order to exercise your rights within the meaning of Article 13(f) of the Regulation, please contact us in the manner specified in Section 10 of this Policy; and
bThe processors of Personal Data are in particular: Supabase, Inc. (database operation, sign-in, and storage of data and photos), Google LLC (Firebase Cloud Messaging push notifications, Crashlytics crash reporting, Google sign-in, and Google Fonts delivery), Apple Inc. (Apple sign-in and app distribution), and Namecheap, Inc. (hosting of the togetu.com website and the contact form).
7. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?
7.1We will generally process your Personal Data for as long as it is needed to fulfill any of the purposes described above. Unless otherwise required by law or other specific provisions, we retain your Personal Data for a maximum of 5 years from the last use of the Product. In the case of Personal Data collected in connection with your User Account created for the use of a Product, we retain your Personal Data for a maximum of 5 years from the deactivation or deletion of your User Account. This retention period is primarily for our protection in the event of potential disputes or claims.
7.2If a legal regulation stipulates a specific period for which certain Personal Data must be archived, we will retain such Personal Data for at least that period.
7.3If there is a reasonable likelihood that we will need your Personal Data for any of the purposes mentioned above (for example, in connection with an asserted claim), we will retain such Personal Data until the reason for its retention ceases to exist (for instance, the conclusion of any judicial proceedings and the expiration of the time limits for extraordinary remedies or for filing a constitutional or international complaint).
8. YOUR RIGHTS
8.1The table below provides an illustrative overview of your rights related to your Personal Data. If you have any questions regarding any of your rights or how to exercise them, please do not hesitate to contact us in the manner described in Section 10 of this Privacy Policy.
| Selected Right | How to Exercise such Right |
|---|---|
| Personal Data portability and right to request access to Personal Data | You can view and review selected Personal Data we process about you directly in your User Account settings. You may obtain a copy of your Personal Data by contacting us using the method described in Section 10 of this Privacy Policy. |
| Correction or amendment of Personal Data | You can edit or correct many of your Personal Data directly within your user profile. If this is not possible or you need assistance, please contact us using the method described in Section 10 of this Privacy Policy. |
| Erasure of Personal Data | You can delete selected Personal Data yourself directly within your User Account (without prejudice to Section 7 of this Privacy Policy). You also have the right to delete your User Account created in connection with your use of the Products at any time. As with any other matter, you can contact us regarding your right to erasure of Personal Data using the method described in Section 10 of this Privacy Policy. |
| Withdrawal of consent | You may withdraw the consent you have given us for processing selected Personal Data at any time by contacting us using the method described in Section 10 of this Privacy Policy. This does not affect our right to process certain Personal Data on another lawful basis under the GDPR, where permitted by law. You may also revoke permissions granted on your device that allow our Products to access selected Personal Data (for example, by withdrawing consent to access your contact list). However, doing so may result in the loss of functionality of certain Product features. |
| Restriction of processing and right to object | You have the right to request the restriction of processing of your Personal Data or to object to the processing of your Personal Data. To exercise these rights, please contact us using the method described in Section 10 of this Privacy Policy. |
| Right to lodge a complaint with a supervisory authority | You have the right to lodge a complaint with the competent supervisory authority regarding the Controller’s conduct. For more information, see Section 11 of this Privacy Policy. |
9. PROFILING
9.1In providing our Products, profiling takes place. Article 4(4) of the GDPR defines profiling as any form of “automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements” In our case, we use profiling to connect you with other users within the Togetu App, to display personalized marketing content, and to enhance safety and improve your overall user experience when using the Products. We assure you, however, that if you choose to share sensitive Personal Data such as information about your race, ethnicity, or nationality, these factors play no role in our profiling processes.
9.2Profiling is a prerequisite for the operation of the recommendation system used in the Togetu App, where Identification Data (particularly age and gender) and Geolocation Data are used as the primary parameters determining suggestions for connecting you with other users of the Togetu App.
9.3The recommendation system in the Togetu App operates based on your voluntary (active) participation in the connection queue, through which you are randomly connected with other users of the Togetu App. This random connection is based on random selection among users of the Togetu App using the main parameters specified in Section 9.2 of this Privacy Policy, and in accordance with the selected type of connection queue within the Togetu App. The parameters used by the Togetu App’s recommendation system are important because they enable the creation of your unique user experience when using the Togetu App, which directly depends on your choice of connection queue within the Togetu App.
9.4The connection is then made automatically based on your previous voluntary participation in the connection queue. Following such a connection, you will be matched with other Togetu App users into a group, in accordance with the selected type of connection queue. You may voluntarily leave such a group at any time.
9.5The Togetu App functions exclusively on the basis of your active participation in the connection queue; therefore, this action is considered your consent to profiling, i.e., to the use of the recommendation system as described in Section 9 of this Privacy Policy.
10. cONTACT
10.1You can contact the Controller regarding any matter (in particular, but not limited to, the exercise of your rights relating to your Personal Data) using one of the following methods:
aOn-line: Via the contact form or by e-mail at support@togetu.com
bData Message (via the Czech system of Data Messages): 6kd6sqi
cBy Mail: To the Controller’s registered office at Mánesova 1649/86, Vinohrady, 120 00 Prague 2 (for faster processing of your inquiry, however, we recommend using one of the above contact methods).
11. COMPLAINT TO THE COMPETENT PUBLIC AUTHORITY
11.1If you believe that our processing of your Personal Data or any of our actions related to your Personal Data violates applicable law, we would appreciate it if you contact us first — we will do our best to resolve the matter to your satisfaction. However, you also have the right to file a complaint with a supervisory authority.
11.2If you reside in the European Union, you may file such a complaint directly with the authority (or office) in the Member State where you have your permanent residence, where you work, or where the alleged violation of data protection laws occurred. A list of the competent supervisory authorities for each Member State can be found at: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. For the Czech Republic, the competent authority is the Office for Personal Data Protection, located at Pplk. Sochora 27, 170 00 Prague 7. Information about the physical and electronic filing office can be found here: https://uoou.gov.cz/kontakt/podatelna-a-elektronicka-podatelna.
12. REPORTING SUSPECTED CRIMINAL OFFENCES
12.1If we become aware of information suggesting that a criminal offence endangering the life or safety of an individual or individuals has occurred, is occurring, or is likely to occur, we will immediately notify the relevant public authorities or bodies empowered to decide on the rights and obligations of affected persons in the relevant member state(s). We will provide these authorities with all available and relevant information, in full compliance with applicable legal regulations.
13. CHANGES TO THIS PRIVACY POLICY
13.1This Privacy Policy may be updated from time to time. You will be notified in advance of any changes before they take effect, using the contact details you have provided.