Internal Data Protection Policy
Organisation: tolinax UG (haftungsbeschränkt), operator of the aYOUne platform
Status: Approved by the Managing Director and published. Version 1.0, effective 2026-10-14
Owner: Managing Director
Review cycle: at least annually, and whenever processing activities, sub-processors or legal requirements change. Each review is recorded with date and reviewer.
1. Scope and roles
This policy applies to all employees, contractors and automated agents acting for tolinax. tolinax acts as:
- Controller for its own business data (customers' contact persons, website visitors, applicants, employees);
- Processor for the personal data that customers (tenants) process in the aYOUne platform, acting only on their documented instructions under a data processing agreement (Art. 28 GDPR).
2. Principles (Art. 5 GDPR)
Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.
3. Rules for staff
- Process personal data only as needed for the assigned task and only through the platform's access-controlled interfaces.
- Never copy production personal data to private devices, private accounts or unapproved tools.
- Use test tenants and test data for tests and demonstrations; never use real customer names in public texts or examples.
- Do not share credentials; use the platform's credential vault for third-party secrets.
- Report any suspected data breach immediately to the Managing Director (see Incident Response Policy).
- Confidentiality obligations apply to all staff and continue after the end of employment.
4. Sub-processors
Personal data is passed to sub-processors (hosting, database, e-mail delivery, payment, AI providers and others) only under data processing terms — for the large providers (for example Google Cloud and MongoDB Atlas) these are the providers' standard data processing addenda; tolinax has not negotiated individual agreements with them — and, for transfers outside the EU/EEA, with an appropriate transfer mechanism (EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses 2021). The current list of sub-processors is published on the trust page (https://ayoune.com/en/trust).
5. Data subject rights
Requests for access, rectification, erasure, restriction, portability and objection are handled within one month. The platform provides tooling for data export and erasure (see Data Retention and Deletion Policy). Where tolinax is processor, requests are forwarded to the responsible customer without delay and tolinax supports the customer in answering them.
6. Records and accountability
- A record of processing activities (Art. 30 GDPR) is maintained.
- Technical and organisational measures (Art. 32 GDPR) are documented in the Information Security Policy and its sub-policies.
- Data protection impact assessments are carried out for high-risk processing (for example biometric voice or video data).
7. Contact
Privacy contact: privacy@tolinax.com. tolinax has not appointed a Data Protection Officer because the statutory requirements for an appointment (Art. 37 GDPR, § 38 BDSG) are not met; privacy matters are the responsibility of the Managing Director.