Toduba S.r.l. ("the Company," "we," "us," or "our") (Via Pietro Micca 15, Turin 10121, Italy) is the data controller for personal data processed through todubahq.com. You can reach us at [email protected] for any data-protection matter, including to exercise the rights described below.
Toduba provides an AI-powered flexible benefits configuration platform for HR and total rewards teams at mid-size European employers. Our service reads benefit claim history, builds workforce preference models, and produces budget-neutral configuration recommendations. This policy describes how we handle personal data of visitors to todubahq.com and contact persons at organisations using or evaluating the platform.
1. Personal Data We Process
We process the following categories of personal data:
- Identity and contact data you submit (name, email address, company name, job title, phone number, message content) when you use our contact form, request a demo, or register for early access;
- Account credentials for HR team members who access the Toduba platform under a signed Data Processing Agreement with their employer;
- Employer benefit claim data provided to us by client organisations under those agreements - this data is processed at the aggregate cohort level and does not include individually identifiable employee records in the output;
- Technical data collected automatically (IP address, browser type, operating system, pages visited, referrer);
- Analytics data, where you have given consent through our cookie banner.
Toduba does not build individual employee profiles. Benefit claim data supplied by an employer organisation is used only to produce aggregated preference models and configuration recommendations for that organisation. We do not use client benefit data to train models on behalf of any other organisation, and we do not sell or share it with third parties for their own purposes.
2. Purposes and Legal Bases (Article 6 GDPR)
Under the General Data Protection Regulation (EU) 2016/679, the Company processes personal data on the following bases:
| Purpose | Legal basis |
|---|---|
| Responding to demo requests, contact-form submissions, and early-access enquiries | Pre-contractual steps or legitimate interest (Art. 6(1)(b)/(f)) |
| Providing the Toduba platform to client organisations and their HR users | Performance of a contract (Art. 6(1)(b)) |
| Operating and securing the Service (logs, error tracking, fraud prevention) | Legitimate interest (Art. 6(1)(f)) |
| Compliance with applicable legal obligations (record retention, regulatory requests) | Legal obligation (Art. 6(1)(c)) |
| Analytics cookies to measure site usage and improve the platform | Consent (ePrivacy Directive + Art. 6(1)(a)) |
3. Recipients and International Transfers
Personal data is shared only with processors acting on our behalf under Art. 28 GDPR data-processing agreements. Our primary infrastructure runs in AWS eu-central-1 (Frankfurt), keeping all benefit and user data within the EU/EEA. Processors used for transactional email delivery and support tooling are contractually bound to EU data-residency or Standard Contractual Clauses (Art. 46 GDPR), assessed for adequacy in line with the CJEU Schrems II ruling.
We do not sell personal data to third parties, and we do not use benefit claim data provided by a client organisation for any purpose other than delivering that organisation's agreed service.
4. Retention
We retain personal data only for as long as necessary for the purposes described above:
- Contact and demo-request data: 24 months after last correspondence, unless a subscription contract is formed, in which case records are kept for the duration of the contract plus 5 years for statutory accounting purposes;
- Platform account data and processed benefit models: retained for the contract term plus 90 days, after which they are securely deleted or anonymised on written request;
- Server access logs: 90 days;
- Analytics data (where consented): up to 13 months from collection.
5. Your GDPR Rights
As a data subject under the GDPR, you have the following rights:
- Right of access (Art. 15) - to confirm whether we process your data and to obtain a copy;
- Right to rectification (Art. 16) - to correct inaccurate data we hold about you;
- Right to erasure / "right to be forgotten" (Art. 17), subject to limited exceptions including our legal retention obligations;
- Right to restriction of processing (Art. 18);
- Right to data portability (Art. 20);
- Right to object (Art. 21), including to direct marketing at any time without further conditions;
- Right not to be subject to solely automated decision-making with legal or significant effects (Art. 22). Toduba does not make automated decisions of this kind; benefit configuration recommendations are advisory outputs reviewed by the HR team, not automated decisions applied to individual employees.
To exercise any of these rights, email [email protected]. We respond within one calendar month, extendable by two further months for complex or multiple requests, with prior notification.
6. Right to Lodge a Complaint
You have the right to lodge a complaint with the supervisory authority in your EU member state of habitual residence, place of work, or the place of the alleged infringement. The Italian supervisory authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it). A list of all EU/EEA supervisory authorities is available at edpb.europa.eu.
7. Cookies
See our Cookie Policy for full details. We do not set non-essential cookies (analytics) without your prior consent through the cookie banner displayed on your first visit to todubahq.com, in line with the ePrivacy Directive as implemented in Italy.
8. Security
The Company implements technical and organisational measures appropriate to the risk, including TLS 1.2+ in transit, at-rest encryption for benefit claim data, role-based access controls, and regular security reviews. All benefit data is processed and stored within the EU (Frankfurt).
9. Changes to This Policy
Material changes will be reflected by an updated "Last updated" date at the top of this page. Where required by law, we will request renewed consent from affected data subjects.
10. Contact
Toduba S.r.l.Via Pietro Micca 15
Turin 10121, Italy
Email: [email protected]
Phone: +39 011 508 3140