Skip to content
aYOUne

Internal Data Protection Policy

Internal Data Protection Policy

Organisation: tolinax UG (haftungsbeschränkt), operator of the aYOUne platform
Status: Approved by the Managing Director and published. Version 1.0, effective 2026-10-14
Owner: Managing Director
Review cycle: at least annually, and whenever processing activities, sub-processors or legal requirements change. Each review is recorded with date and reviewer.

1. Scope and roles

This policy applies to all employees, contractors and automated agents acting for tolinax. tolinax acts as:

  • Controller for its own business data (customers' contact persons, website visitors, applicants, employees);
  • Processor for the personal data that customers (tenants) process in the aYOUne platform, acting only on their documented instructions under a data processing agreement (Art. 28 GDPR).

2. Principles (Art. 5 GDPR)

Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

3. Rules for staff

  1. Process personal data only as needed for the assigned task and only through the platform's access-controlled interfaces.
  2. Never copy production personal data to private devices, private accounts or unapproved tools.
  3. Use test tenants and test data for tests and demonstrations; never use real customer names in public texts or examples.
  4. Do not share credentials; use the platform's credential vault for third-party secrets.
  5. Report any suspected data breach immediately to the Managing Director (see Incident Response Policy).
  6. Confidentiality obligations apply to all staff and continue after the end of employment.

4. Sub-processors

Personal data is passed to sub-processors (hosting, database, e-mail delivery, payment, AI providers and others) only under data processing terms — for the large providers (for example Google Cloud and MongoDB Atlas) these are the providers' standard data processing addenda; tolinax has not negotiated individual agreements with them — and, for transfers outside the EU/EEA, with an appropriate transfer mechanism (EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses 2021). The current list of sub-processors is published on the trust page (https://ayoune.com/en/trust).

5. Data subject rights

Requests for access, rectification, erasure, restriction, portability and objection are handled within one month. The platform provides tooling for data export and erasure (see Data Retention and Deletion Policy). Where tolinax is processor, requests are forwarded to the responsible customer without delay and tolinax supports the customer in answering them.

6. Records and accountability

  • A record of processing activities (Art. 30 GDPR) is maintained.
  • Technical and organisational measures (Art. 32 GDPR) are documented in the Information Security Policy and its sub-policies.
  • Data protection impact assessments are carried out for high-risk processing (for example biometric voice or video data).

7. Contact

Privacy contact: privacy@tolinax.com. tolinax has not appointed a Data Protection Officer because the statutory requirements for an appointment (Art. 37 GDPR, § 38 BDSG) are not met; privacy matters are the responsibility of the Managing Director.

Work with this page

Ready-made instructions for your AI tool. Copy, paste, go — the AI fetches the content itself via the address in the text.

Summarise the steps for me The essentials, in the right order.
Open in ChatGPT 
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/internal-data-protection-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Summarise the content for me.

- First, in two sentences: what is this about?
- Then the steps in the order I need to take them.
- One line per step, in plain language.
- At the end: what I should have ready beforehand.

Leave out nothing I need in order to actually finish.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Explain what I need this for What it is good for — and when it is worth it.
Open in ChatGPT 
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/internal-data-protection-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Explain to me what I need this for.

1. Which problem does it solve? In one sentence, from my point of view.
2. Three typical situations in which it genuinely helps me.
3. When I do NOT need it — that saves me time.
4. What I can do instead if it is not a fit.

Stick to what the source says. Where it gives nothing, say so openly instead
of guessing.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Help me set this up Step by step, asking me as you go.
Open in ChatGPT 
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/internal-data-protection-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Walk me through the setup step by step.

- First tell me what I need to have ready (access, data, time).
- Then take me through ONE step at a time. Wait for my "next".
- For each step, say how I can tell that it worked.
- If something goes wrong, ask me for the exact message instead of guessing.

If the instructions leave a point open, tell me so rather than inventing it.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Help me with a problem Narrow down the cause instead of guessing.
Open in ChatGPT 
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/internal-data-protection-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Help me narrow down a problem.

- First ask me what I observe and what I expected instead.
- From that, derive the most likely causes consistent with this source.
- For each cause, give me ONE test that confirms or rules it out.
- Order them so the cheapest test comes first.

Do not guess. If the source does not cover the problem, tell me where I should
look next.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Explain it in plain words No jargon, from the ground up.
Open in ChatGPT 
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/internal-data-protection-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Explain the content so that someone without prior knowledge understands it.

- Start with the purpose: why does this exist at all?
- Explain technical terms in half a sentence on first use.
- One everyday comparison where it genuinely holds — none where it limps.
- At the end: the three things worth remembering.

Do not shorten by dropping conditions. A simplification that hides a
prerequisite is a false statement.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
A checklist to tick off To follow along while you do it.
Open in ChatGPT 
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/internal-data-protection-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Turn this into a **tick-off checklist** for practical use.

- Exactly one action per item, in the imperative.
- Order it so that no item depends on a later prerequisite.
- Prerequisites and pitfalls as indented sub-items.
- End with an acceptance step: how do I know everything is right?
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.

Was this article helpful?

👎 No (0)
Leave a comment