Privacy Policy

If you need to reach us, the phone number to call is 866-387-7898, and the email address to write to is help@toniesa.it.com. Both routes connect you with people who can help, whether your question concerns a product, an account, an order, or anything else related to our services. We know that reaching out can sometimes feel like a hurdle, especially when a child is waiting to hear a favourite story or when an order has not arrived as expected. That is why we try to make every conversation simple and welcoming, and why we encourage you to contact us before you begin a return or take any other step, since many troubles can be resolved quickly with a bit of guidance.

Protecting personal information is something we treat with real seriousness, and we work hard to make sure your privacy is respected at all times. The operator of this website, its related domains and the mytonies app for iOS and Android handles your personal data in a confidential manner and follows applicable data protection rules, including the General Data Protection Regulation, the German Federal Data Protection Act, the UK version of the GDPR and the California Consumer Privacy Act, along with this policy. We invite you to read the following details so you understand how your information is gathered, used and processed for clear purposes, and what rights you hold. Data collected through our platforms is processed only on servers located within the European Union. Our store for the United States is run by our subsidiary there, which shares personal information with the parent company. Where processing concerns personal data from individuals in the United Kingdom, the UK version of the GDPR applies, and references to the GDPR should be read as pointing to the corresponding UK rules.

The controller responsible for processing is tonies GmbH, located at Oststraße 119, 40210 Düsseldorf, Germany. Our privacy officer can be reached through Philipp Herold at Hafenstrasse 1 A, 23568 Lübeck, Germany. For questions from the United States, you may contact tonies US, Inc., Attn: Privacy, at 4251 Los Palos Ave, Palo Alto, CA 94306, or by writing to help@toniesa.it.com. If you prefer to speak with someone directly, you can also call 866-387-7898.

Using our website and apps for general information is designed to gather as little data as possible, and it is usually possible without providing any personal details. That changes when personal data is needed for an order from our online shops, for creating a Tonie account, for using mytonies including orders from the Audio Library, for customer care enquiries, for a newsletter you have requested, through our contact form, for our blog, or to tell you about similar products and services of our own. As a network based system with a server and client devices, there are also other data exchanges that are unavoidable if the system is to be used to its full extent.

We collect personal data only on a voluntary basis where this is possible for delivering our service, and where no legal ground exists we generally ask for your consent, which you may withdraw at any time. Your data is not shared with third parties, apart from service partners who need personal data to process your orders or handle customer care, such as delivery companies, payment institutions and technical support. Even then, only the minimum necessary is transferred, and all partners treat the data as confidential and process it in line with the GDPR. For a credit check, address and credit history data may be exchanged with a recognised external company within a legally permitted framework, while protecting your legitimate interests. We do not accept liability for third parties unless such liability is stated separately.

If we take part in a merger, acquisition, financing review, reorganisation, bankruptcy, receivership, purchase or sale of assets, or a transfer of service to another provider, your personal information may be sold or transferred as part of that transaction, only as the law or a contract permits. We may also disclose information we store about you when we believe in good faith that doing so is required or appropriate to comply with law enforcement or national security requests and legal process, to protect your rights or the rights of others, to enforce our policies or contracts, to collect amounts owed to us, or to assist with an investigation or prosecution of suspected or actual illegal activity. If we adjust our business processes in ways that affect information duties under applicable law, we will update this policy and notify you as required, and we will also incorporate changes in data protection law and case law. We recommend reading this policy regularly for that reason.

We process your personal data in line with the GDPR and the German Federal Data Protection Act. Data entered into the contact form is processed on the basis of your consent, while the legal ground for data transferred when sending an email is found in the legitimate interest provision, and if the email contact aims at entering a contract, an additional legal ground applies. Your personal data is processed mainly to perform our contractual services in our online shops and mytonies, meaning as part of our contracts with customers and, where relevant, to carry out pre-contractual measures taken at your request. To provide these services we use processors with whom we have concluded a data processing agreement. Where processors sit outside the EU or EEA and no adequacy decision exists, processing is permitted because we have signed a contract including the standard contractual clauses of the European Commission. If you have given consent for specific purposes such as a newsletter, that data is processed on the basis of your consent, which you can withdraw at any time; withdrawal only affects the future and does not make earlier processing unlawful. Where a legal obligation requires us to process personal data, for example to meet tax duties, that processing rests on the legal obligation ground. In the context of balancing interests, if we process personal data not covered by the above grounds, the processing may also be necessary to respect a legitimate interest of our company or a third party, provided your interests, fundamental rights and freedoms are not overridden. This applies, for example, when we use your data to inform you about our own similar goods and services, or when data is exchanged with a recognised third party company for a credit check that may form part of order processing.

As required under applicable law and depending on where you live, you may hold rights in relation to your personal data, including access, rectification, erasure, restriction of processing, objection and data portability. To exercise these rights, you may complete the contact form, make changes directly within your profile, or contact us using the details above, including the phone number 866-387-7898 and the email address help@toniesa.it.com. Restrictions set out in the German Federal Data Protection Act apply to the rights of access and erasure. You also have the right to lodge a complaint with the relevant supervisory authority for data protection. Users in California can find additional rights information in the relevant section below.

The following explains in detail how our systems use your data. The provider of this website automatically gathers and saves information in server log files that your browser transfers automatically, including browser type and version, operating system, referrer URL, host name of the accessing computer, time of the server request, IP address and request authorisation. We do not match this data with a specific person or merge it with other sources, though we reserve the right to review it later if we learn of concrete indications of unlawful use. This data is needed to present our website content correctly, including directing you to the right regional version, to optimise content and advertising, to ensure ongoing operation of our IT systems and technology, and to supply information required for criminal prosecution in the event of a cyberattack. The data is analysed for statistical purposes and to increase the protection and security of data in our organisation so that an optimal level of protection can be assured. The anonymous data in server log files is stored separately from all personal data provided by the data subject, and stored customer data is not sold.

Every Toniebox comes by default with an individual client certificate it can use for unique authentication with mytonies. In addition to this certificate, another Toniebox ID is stored in mytonies for each device, and this ID is also affixed to the bottom of the Toniebox. When setting up the device for the first time and connecting it to a new Wi-Fi network, you are asked to enter the Toniebox ID so it can be matched with mytonies, which ensures that only authorised devices can make contact. The Toniebox is coupled with a Tonie account through the Toniebox ID, and all you need to create this account is a valid email address and a password you choose. You must also provide your Toniebox ID to link the device with your account. Creating a Tonie account is a requirement for using and configuring the Toniebox, using Creative Tonies and the Audio Library, connecting with other members and using other functions in the ecosystem. If a Tonie account is deleted after being used to set up the device, these special functions will no longer be available.

When you use your Toniebox, certain events cause it to try to establish a connection with mytonies, such as initial set-up, powering on, placing an unknown Tonie on the device and starting a search for new content. If the connection succeeds, the device sends your individual client certificate, your IP address and a timestamp. When you use Tonies and Tonieboxes, we also receive data about operational events, such as a Tonie being placed or removed along with its identifier, volume changes, fast-forwarding and skipping, connecting or disconnecting headphones, connecting or disconnecting the charging station, and the content assigned to your Tonie at a particular time. When setting up the device or adding another Wi-Fi network, the available networks and the connected network are also transmitted. We do this to improve our service and product for you on an ongoing basis. The transferred data described above is generally collected on an anonymous basis and stored in server log files so we can analyse it as necessary. If you contact customer care and state the Toniebox ID as part of a support enquiry, the data that was anonymous up to that stage may be linked with the personal data you provided. Customer care staff will actively let you know about this in such cases. Using data in this manner makes it possible to process your support enquiry, track down devices or figures lost in transit, resolve problems with Audio Library content, and uncover instances of misuse or breaches of law and defend against them. Data linked in this way is deleted as soon as your support enquiry has been fully concluded. Where there has potentially been a breach of law, we store the data until the breach is resolved, or until legal proceedings conclude if such proceedings are opened, and erase it only when we no longer need it for evidence and defence or to comply with retention obligations.

After you have set up a Tonie account and linked your device using the Toniebox ID, we can link your customer data with the data described above and customise our newsletter, if you have opted in, and other marketing activities to you and your interests, improving our marketing on an ongoing basis. If you do not want this, you can deactivate it at any time from within your profile. If you upload audio files for your Creative Tonies, these files are converted by our server into the required format and made available for playback. The data you originally upload is automatically deleted after seven days, while the converted data is stored in mytonies. You can upload new files as often as you like. Once the maximum run time of ninety minutes has been reached for each Creative Tonie, you must delete your old files so they can be replaced. We do not save old data, though for technical reasons the converted data is stored for at least seven days following conversion. We reserve the right to sample uploaded data and check whether it potentially violates applicable law, including copyrights, personality rights or competition law, applicable case law or common decency. If we find such a violation, we reserve the right to delete your data and cancel your account. If you close your Tonie account, your Audio Library content and the files you uploaded for your Creative Tonies will be deleted after cancelling, along with your order history and any personal information provided voluntarily or to place orders. It is impossible to transfer this information to another user before cancelling.

If you use our app, you require a Tonie account and must log in with your email address and password before you can use it. The apps enable you to record speech and combine it with a selected Creative Tonie by uploading it from your smartphone or tablet to mytonies. For you to use the app and its functions to their full extent, the app must be able to access various functions and data, and you must grant the relevant permissions so that we receive this access. We only obtain permissions actually required for practical usage, and you should be aware that you cannot use the full extent of the app without providing all permissions. All users must ensure they have the proper consent of any individual they record through the app, or in the case of a child’s voice, the child’s parent or guardian, when uploading content. The app uses audio recordings and titles uploaded to mytonies, customer data for verification, the Toniebox name and a push token for sending notifications. The app accesses identity and accounts on the device, photographs, media and files for transfer as part of defined usage, the microphone for recording audio files, the network for displaying connections, stopping the device from entering sleep mode and changing audio settings. Every Toniebox package is given a QR code during manufacturing, which primarily serves internal purposes, and as a rule this information is not linked with your Tonie account. The contrary applies only if we have sufficient evidence of fraud, in which case we link the QR code with your account to detect devices that have not arrived, protecting us from breaches of law. We delete the personal data used in this process as soon as the suspicion proves unsubstantiated or the fraud investigation concludes and the data is no longer needed for evidence and legal defence. We may send you push notifications through our app, and you may opt out at any time by changing the settings on your mobile device.

If you wish to receive our newsletter by email, we require an email address, and you may also provide your first and last name, your preferred addressing and the birthday of one or more children you entertain in order to receive personalised advertising and offers tailored to their age group. Additional data is not collected. We use this data exclusively for sending the requested information and pass it to our instructed service provider in the United States, with whom we have concluded contracts to guarantee data protection requirements. We obtain statistics about whether the newsletter is opened and which links are clicked. While this information can be matched with individual recipients, that is not the purpose of our analyses, which serve solely to identify reading habits and adapt our content or send different content in line with user interests. You may receive personalised advertising and offers if you consent to us determining your preferences by analysing your purchases and actual usage, and we use this data only for personalising marketing emails. You can withdraw consent for the storage and usage of data and your email address at any time, free of charge, by clicking the unsubscribe link. Data is retained until you unsubscribe, request modification or deletion, or submit an advertising objection, after which usage information and communicated birthdays are kept anonymised by removing the link to your account. If you choose, you can still receive newsletters that are not tailored to you. If you have consented to us using your profile information to customise the content of our platforms, we can show you recommendations, for example through push notifications or banner ads. By providing additional information, your profile is enriched. If you have ordered personalised advertising, we use usage data from your account together with the birthday of a child you entertain to provide personalised recommendations based on implied interests. If we do not yet have products for your child’s age group, you will receive recommendations based only on purchasing behaviour, and we will add the date of birth to your profile so we can recommend suitable products at the right time, which can also be revoked at any time. We may offer tools that let you share information from third parties, such as referral services that allow you to forward content to a friend, and if you use these features, we retain your friend’s email solely to enable the referral. We may also provide surveys, sweepstakes, contests or other social media content that may involve collecting personal information, and contact information you provide may be used to reach you about a sweepstakes or contest and for other promotional, marketing and business purposes if permitted by law. In some jurisdictions, we are required to publicly share information about winners.

We require your personal data to process your order from our online shop, including your title, first names, surnames, email address, delivery address, billing address and telephone number for queries about your order. If you create a Tonie account in our online shop, we store your personal data so you do not have to re-enter it for every order, saving time and preventing typing mistakes, and giving you personalised access to your order history and individual user settings. You also need a Tonie account to set up the Toniebox and use special functions including the Audio Library. When you create an account in the shop, all you need to begin is your email address and a password you choose, and later when you order, your title, forename, surname, delivery address, billing address, payment method and telephone number are additionally stored. Orders are fulfilled by a service provider as part of a fulfilment programme, and your personal data is shared with that provider exclusively for fulfilling your online order, transferred in line with the legal ground of contract performance and only to the extent necessary. We also obtain your data when you use that provider’s customer service in connection with your order. Any other data processing beyond this is the responsibility of that provider.

If you hold a Tonie account and log in at mytonies, you can use our Audio Library. When creating an account, all you need is your email address and a password you choose. For orders for Audio Library content, we also require personal data to fulfil your order, including your title if you choose to give it, forename, surname, billing address, the country to which your IP address belongs but not the IP address itself, and telephone number if you choose to provide it for queries about your order. If you use the Audio Library to assign previously purchased content to your Tonies and manage your purchased content, we do not require any personal data apart from your log-in details. We offer the option of commenting on our blog posts, and if you use it, your comment, the time it was submitted and the username or pseudonym you chose will be stored and published. The IP address assigned by your internet service provider will also be logged. We will also ask for your email address, and while we store it, we will not publish it. We store this personal data for security reasons and in case you violate third party rights through a comment or post unlawful content, which enables us to clear ourselves of wrongdoing in the event of a breach of law. We do not disclose your personal data to third parties except when such disclosure is legally required or serves as legal defence for us.

If you contact customer care by telephone, your telephone number and email address, along with other information you provide, are recorded, stored and assessed for processing your enquiry, which serves to answer it and improve our products and service quality. If you are required to provide your Toniebox ID as part of such a support request, the previously anonymous data about operational events may possibly be linked with the personal data you provide, but our staff will actively let you know before a link is made, and you can refuse it at any time. If you send us enquiries through our contact form, your information from the form, including the contact details you voluntarily provide, your name and email address, are automatically stored for processing your enquiry and in case of follow-up questions until the matter is conclusively resolved. We do not share this data without your consent. We also provide a chat function operated by a partner on our website, and no data for it is collected through our website or stored with us. If you ask a question through this chat, a real person from a selected group of customers answers you, and we are not responsible for content exchanged in chats. The data sent in chats is transferred directly to the chat provider and stored for analysis purposes, and the personal data provided is treated as confidential and regularly erased after the relevant enquiry is processed. Data is not forwarded to third parties for marketing purposes. Further information about the processing of data by that provider can be found in its privacy policy, and you can also contact its data protection officer directly.

Parts of our website use cookies, which do not cause any harm to your computer and do not contain any viruses. Cookies serve to make our offering more user-friendly, effective and secure. Cookies are small text files stored on your computer by your browser, and we notify you about their use, this policy and your options through a corresponding banner when you open our websites. Most cookies we use are session cookies that are automatically deleted after your visit, while others remain stored on your device until you delete them, enabling us to recognise your browser on your next visit so our websites are made more user-friendly. The data stored in such cookies and transferred includes items in the shopping basket and log-in details. Our websites also use cookies that enable analysis of your surfing patterns, with the aim of improving the quality of our websites and content and optimising our offering constantly. The data transferred may include frequency of page visits and utilisation of website functions. This user data is made pseudonymous through technical precautions we have taken, leaving us unable to match the data with the visiting user, and it is not stored together with other personal data. You can configure your browser’s settings to inform you when cookies are set and to allow cookies only in certain situations, to prohibit them in certain situations or in general, or to delete cookies automatically when you close your browser. You can also delete cookies already set at any time using your browser or other software programs. If you deactivate cookies, the functionality of our websites may be restricted. To change cookie settings on our websites, please use the respective link and activate or deactivate the preferred categories.

Do Not Track is a privacy preference that users can set in certain web browsers, and we do not respond to or honour DNT signals or similar mechanisms transmitted by web browsers. We place Microsoft Bing for personalised online ads based on interests and location, and advertisements are displayed based on search requests on websites in the Microsoft Ad Network. When a user clicks on an ad, Bing places a cookie on the user’s device. With this technology, Bing and we as their customer receive the information that a user clicked on an ad and was redirected to our websites, and the information acquired is used solely for statistical analysis related to ad optimisation. We do not receive any information that would allow us to personally identify a visitor. The statistics provided to us include the total number of users who clicked on one of our ads and, where applicable, whether they were redirected to a page with a conversation tag, allowing us to track which search terms most often lead to clicks and which ads lead to contact. If you do not want this, you can prevent the storage of the required cookies through your browser or app settings, in which case your visit will not be incorporated into user statistics. You also have the option to choose the types of Bing ads or deactivate interest-based ads through ad settings, or to deactivate third party use of cookies using the Network Advertising Initiative’s opt-out tool.

We use the functions of the Google Analytics service on our website and in the apps, provided by Google Inc. Google Analytics uses cookies, which are small text files stored on your computer to enable analysis of your use of this website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the United States and stored there. However, if IP anonymisation is enabled on this website, Google will truncate your IP address within member states of the European Union or in other countries party to the Agreement on the European Economic Area beforehand. Only in exceptional cases is the full IP address transferred to a Google server in the United States and truncated there. Google uses this information on behalf of the operator of this website to analyse your use of the website, compile reports on website activity and perform other services associated with website activity and internet usage. The IP address transmitted from your browser through Google Analytics will not be merged with other Google data. You can stop cookies being stored by choosing the relevant settings in your browser, though you should be aware that you may not be able to use all functions fully in that case. Furthermore, you can stop Google from storing and processing the cookie-generated data relating to your usage of this website, including your IP address, by downloading and installing the browser plug-in available over the relevant link. Further information and Google’s applicable data protection provisions can be viewed in the privacy policy and terms of service.

Plug-ins for the Facebook social network are integrated into our website, and you can identify a Facebook plug-in through the Facebook logo or like button. If you do not live in the United States or Canada, the controller for the processing of personal data is Facebook Ireland Ltd. A direct connection between your browser and the Facebook server is established through the plug-in when you visit our website, which provides Facebook with the information that you have visited our website with your IP address. If you click on the like button while logged in to your Facebook account, you can link to the content on our website from your profile, and Facebook will be able to match your visit with your user account as a result. We would like to point out that we as the website provider have no knowledge of the content of transferred data nor the way in which Facebook uses it. Further information about the collection, processing and use of personal data by Facebook and possible settings for protecting your privacy can be found in Facebook’s privacy policy. If you do not wish for Facebook to be able to match your visit with your account, please log out of your Facebook account before visiting our website. Also used on our website is the Website Custom Audiences beacon from the Facebook social network, which involves the use of a web beacon to identify website visitors. A direct connection between your browser and the Facebook server is established through this web beacon when visiting our website, which provides Facebook with the information that you have visited our website with your IP address. Facebook can then match the visit with your user account and use this information to personalise the display of Facebook advertisements. We as the website provider have no knowledge of the content of transferred data nor the way in which Facebook uses it. For further information, please look at Facebook’s privacy policy. You can of course opt out from the collection of data through Custom Audiences.

We place Google AdWords display advertisements and use Google conversion tracking for the purposes of personalised online ads based on interests and location. Advertisements are displayed based on search requests on websites in the Google ad network. When a user clicks on an ad, Google places a cookie on the user’s device. With this technology, Google and we as their customer receive the information that a user clicked on an ad and was redirected to our websites. The information acquired is used solely for statistical analysis related to ad optimisation. We do not receive any information that would allow us to personally identify a visitor. The statistics provided to us include the total number of users who clicked on one of our ads and, where applicable, whether they were redirected to a page with a conversation tag, allowing us to track which search terms most often lead to clicks and which ads lead to contact. If you do not want this, you can prevent the storage of the required cookies through your browser or app settings, in which case your visit will not be incorporated into user statistics. You also have the option to choose the types of Google ads or deactivate interest-based ads through ad settings, or to deactivate third party use of cookies using the Network Advertising Initiative’s opt-out tool.

We use Google Optimize to carry out so-called A/B tests on our online offering, which involves various versions being published and measured simultaneously. When testing different versions, data such as the operating system used, the browser’s user agent and the time of viewing may be collected to measure the success of a version. Web-tracking technologies are used to connect the aforementioned data with the version undergoing testing. The use of Google Optimize is based on our legitimate interests in optimising our online offering. We cannot influence the actual duration for which processed data is stored, as this is determined by Google LLC. More information can be found in the Google Optimize privacy policy.

On our website, we use the Amplitude service, a product and usage analysis tool that enables us to better understand the behaviour of our users and optimise our digital offering. It collects information about the use of our website, such as pages visited, click behaviour, length of stay, technical characteristics of the end device used and the time and frequency of use. The processed data is analysed pseudonymously and is not used to identify individual users. The processing takes place exclusively on the basis of your express consent, which you can give through our cookie banner and withdraw at any time, and withdrawal does not affect the lawfulness of processing based on consent before withdrawal. Since Amplitude is a US provider, data transfer to third countries cannot be excluded, and to ensure an adequate level of data protection, we have concluded the standard contractual clauses approved by the European Commission with Amplitude. Further information can be found in the provider’s privacy policy.

We have integrated Hotjar Behaviour Analytics on our website, a service that provides optimisation tools analysing the behaviour and feedback of users through analysis and feedback tools. We use Hotjar to better understand our users’ needs and optimise this service and experience, helping us understand how much time they spend on which pages, which links they choose to click and what users do and do not like, enabling us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices, including a device’s IP address processed during your session and stored in a de-identified form, device screen size, device type, browser information, geographic location by country only and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymised user profile and is contractually forbidden to sell any of the data collected on our behalf. Hotjar Behaviour Analytics uses cookies and other browser technologies to evaluate user behaviour and recognise users, and this information is used among other things to compile reports on website activity and statistically analyse visitor data. Hotjar also records clicks, mouse movements and scroll heights to create so-called heat maps and session replays, and your data is passed on to the operator of Hotjar Behaviour Analytics. We process your data with the help of Hotjar for the purpose of optimising our website and for marketing purposes based on your consent. The concrete storage period of the processed data cannot be influenced by us but is determined by Hotjar Ltd, and further information can be found in the privacy policy for Hotjar Behaviour Analytics.

Our website uses plug-ins from the Instagram social network. You can recognise the Instagram plug-in through the Instagram button. When you click on the Instagram button while logged in to your Instagram account, links to the content on our website may be published on your Instagram profile, and Instagram will be able to match your visit with your user account as a result. We as the website provider have no knowledge of the content of transferred data nor the way in which Instagram uses it. If you do not wish for this information to be transferred in the described manner, you can stop it by logging out of your Instagram account before visiting our website. Further information about the collection, processing and use of personal data by Instagram can be found in the Instagram privacy policy.

We have integrated components of Klaviyo into our website, a service that offers marketing automation software for marketing services and products, including SEO, content creation, lead management, newsletters, marketing via email and SMS, and web analytics. Klaviyo uses cookies and other browser technologies to analyse usage patterns and recognise users, and this information is used for purposes including the compilation of reports about activity on the website. Klaviyo is also used to store and transfer data entered in forms using cookies and to store and transfer your IP address, and in this case your data is disclosed to the operator of Klaviyo. We process your data with the help of Klaviyo for the purpose of optimising our website and for marketing purposes based on your consent. We cannot influence the actual duration for which processed data is stored, as this is determined by Klaviyo, Inc. More information can be found in the Klaviyo privacy policy.

To use the features of the app, you are required to log in, and to log in you need a user account. When you register in our app or on mytonies, we store the information you provide, such as your email address, first and last name. For these purposes, we use a CRM service provided by Braze Inc, which acts for us as a data processor. The processing of personal data in the context of registration, logging in and the use of functions is carried out for the performance of our service offered via the app and is therefore based on the legal ground of contract performance. We use Braze in our app and on mytonies to analyse your usage behaviour, which allows us to draw conclusions in order to improve our notifications and ensure you only receive information of interest to you. When you use the app or services, the information listed below is collected and analysed by Braze, which uses an identifier allowing analysis of your use of our services. Braze collects information about your newsletter registration, your user behaviour regarding the newsletter, push notifications such as open rates, the use of our app and website, purchase information and campaign information for the purpose of direct targeting as well as analysis and campaign optimisation. The legal basis for this processing activity is a legitimate interest. The legitimate interest we pursue is our interest in a user and needs oriented design of our offers, and a conflicting interest is not apparent because you can object to the processing at any time. If you no longer wish to be recorded by Braze in the future, you can contact us at any time. When using Braze, there is no transfer of personal data processed by Braze to a third country, as Braze is based in a third country, and your data is stored and processed exclusively on European servers. Nevertheless, due to the company’s headquarters in the USA, a data transfer to the USA cannot be completely excluded, and the transfer of data to Braze is permissible because we have concluded the standard contractual clauses of the European Commission. For more information about Braze’s compliance with data protection laws, please visit its privacy page.

We use Braze to link advertising campaigns to registration and subsequent use of the services and to measure their success. We also use the functionality provided by Braze to contact you and provide you with news about our products and services and our campaigns in various ways. For these purposes, we use your email address, your first and last name, a pseudonymised user ID automatically generated by Braze and your advertising IDs automatically generated by your mobile device’s operating system. If you have given your consent, you will receive personalised advertising and marketing content via email, SMS, push notification and in-app notifications. The legal basis for this is your consent, which is optional and can be revoked at any time. You can unsubscribe from push notifications at any time by changing the settings on your mobile device. We use your email address, which we have received in the context of the sale of a good or service, for the electronic sending of advertising for our own goods or services that are similar to those you have already purchased, unless you have objected to this use. The legal basis for the processing is our overriding legitimate interest in direct advertising, and you can object to this use at any time by notifying us, with the contact details for exercising the objection found in the imprint, or by using the link provided in the advertising medium. Data used for marketing purposes will be stored in pseudonymised form and passed on to Braze, and this data will be deleted as soon as you have revoked your consent given for marketing purposes. We delete data relevant to the contract, such as your email address and name, five years after the termination of the contract for the use of our service, which ends for example by deleting your mytonies account.

A visitor pixel provided by Outbrain Inc. is used on our website to measure conversion rates. This allows us to track the actions of users after they have been redirected to our website by clicking on an Outbrain advertisement. This process serves to analyse the effectiveness of our advertisements for statistical and market research purposes and can contribute to the optimisation of future marketing activities. The collected data is anonymous for us and cannot be used by us to infer user identities. Further information about data protection at Outbrain can be found in its policy, and you can object at any time to tracking for the purpose of displaying interest-based recommendations by using the opt out field in the Outbrain privacy policy.

We use social plug-ins from the Pinterest social network on our website. When you visit a page that contains such a plug-in, your browser establishes a direct connection with the Pinterest servers. The plug-in transfers log data to the Pinterest server in the United States when it does this. This log data can potentially include your IP address, the addresses of pages visited that also contain Pinterest functions, the browser’s type and settings, the date and time of the request, the way you use Pinterest and cookies. Further information about the collection, processing and use of personal data by Pinterest and your rights and options for protecting your privacy can be found in the Pinterest privacy policy.

Functions for the Twitter service are integrated into our website. By using Twitter and the retweet function, the websites you visit will be linked with your Twitter account and shared with other users, and data will also be transferred to Twitter as part of this. We would like to point out that we as the website provider have no knowledge of the content of transferred data nor the way in which Twitter uses it. Further information about the collection, processing and use of personal data by Twitter can be found in the Twitter privacy policy. You can change your privacy settings for Twitter in your account settings, and you can also stop information being transferred to Twitter by logging out of your Twitter account before visiting our website.

To process customer enquiries, we use the Zendesk ticket system, a customer service platform. The required data, such as your name and email address, is collected through our website for this purpose. Further information about the processing of data by Zendesk can be found in the Zendesk privacy policy, and if you have questions, you can also contact the Zendesk data protection officer directly. By sending the form, the data is transferred to our section at Zendesk and serves the sole purpose of processing the relevant enquiry. The collected data is stored on servers located within the EU and treated as confidential in accordance with the GDPR. The data is archived at Zendesk for documentation purposes after the relevant enquiry has been processed, and data is not forwarded to third parties for marketing purposes.

A visitor pixel provided by Awin is used to record visits from particular sites. This allows us to track the actions of users after they have been redirected to our website after clicking on an Awin partner site. This process serves to analyse the effectiveness of our partner placements for the optimisation of future marketing activities. Further information about the collection, processing and use of personal data by Awin and your rights and options for protecting your privacy can be found in the privacy policy of the Awin Group.

The personal data collected by us is disclosed to the delivery company contracted for delivery as part of the performance of the contract, provided this is necessary for the delivery of the goods. We forward your payment data to the contracted financial institution for the purpose of processing payments. When paying with PayPal in our online shops or Audio Library, we forward your payment data to PayPal for the purpose of processing payments. By selecting the PayPal payment option, you give your consent to the transfer of personal data required to process payment. This personal data usually includes your forename, surname, address, email address, IP address, telephone number, mobile number and other data required to process payment and fulfil the order. The data is transferred for the purpose of processing payment and preventing fraud. Further information related to privacy law, including the credit agencies used by PayPal and your rights as a data subject, can be found in the PayPal privacy policy. If you have decided to pay in our online shops with credit or debit cards issued by Visa or Mastercard, the payment will be processed by a payment services provider. By selecting this payment option, you give your consent to the transfer of personal data required to process payment, and the data is transferred for the purpose of processing payment.

We only process and store your personal data for as long as it is required to fulfil our contractual and legal obligations. If the reason for storage ceases to apply, your personal data will be erased by us on a regular basis unless it is necessary to keep processing it for a further limited period to satisfy retention obligations under commercial and tax laws or to preserve evidence in accordance with statutes of limitation. We endeavour to implement appropriate protective measures to ensure the security, integrity and confidentiality of the information you provide. For this reason, we have established technological security strategies intended to protect the personal information we draw from you, and we uphold security measures that require compliance with applicable data protection regulations. Your personal data is transferred over the internet via SSL in an encrypted format during the order process and in mytonies. We secure our website and other systems against loss, destruction, access, modification and dissemination of your data by unauthorised persons using technical and organisational measures. It is only possible to access your Tonie account after entering your personal password, and the same applies to the app. You should always treat your log-in details as confidential and close your browser window when you have finished communicating with us, especially if you share your computer, tablet or smartphone with others.

You can also apply for a job within our company by electronic means. We have contracted Personio GmbH to support us with IT services for the application and recruitment processes. Detailed information about data protection at Personio can be found in its policy. Your details are only ever used to process your application and generally are not shared with third parties. Please note that emails sent without encryption are transferred in a manner that is not protected against unauthorised access. For this reason, you should use the application form provided by us for the purpose and consider the dedicated privacy policy applicable to applications sent to us, which contains extensive information about data protection in connection with job applications.

Although our services are intended to be enjoyed by users of all ages, we only collect personal information from adult users, and we do not knowingly collect personal information from children under thirteen or any other age required under applicable law as part of our services. Users may not upload audio of a child or other personal information that may identify a child without first obtaining the explicit consent of that child’s parent or guardian. Parents or guardians should supervise their children’s use of our services at all times. If you are a parent or guardian and learn that your child has provided us with personal information without your consent, you may contact us as set forth below. If we learn that we have collected any personal information from a child in violation of applicable law, we will promptly take steps to delete such information, unless we have a legal obligation to retain it, and terminate the child’s account as applicable.

The following section applies to our US customers. This section only applies to our processing of personal information that is subject to the California Consumer Privacy Act of 2018. You may stop or restrict the placement of cookies and similar technologies on your device or remove them by adjusting your preferences as your browser or device permits. The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programmes. You can access these and learn more about targeted advertising and consumer choice and privacy at the relevant industry sites. To separately make choices for mobile apps on a mobile device, you can download the relevant app choices application from your device’s app store. Alternatively, for some devices you may use your device’s platform controls in your settings to exercise choice.

The CCPA provides California residents with the right to know what categories of personal information have been collected about them and whether that personal information was disclosed for a business purpose to a service provider in the preceding twelve months. California residents can find this information in the relevant section. For purposes of the CCPA, we do not sell personal information, nor do we have actual knowledge of any sale of personal information of minors under sixteen years of age. In addition to the rights described above, California residents have the following rights. Non-discrimination means California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA. Authorised agent means you, or someone legally authorised to act on your behalf, may make a verifiable consumer request related to your personal information. To designate an authorised agent, please contact us as set forth above and provide written authorisation signed by you and your designated agent. Verification means that to protect your privacy when you make a request, we will ask you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorised representative, which may include asking you to answer questions regarding your use of our services. Refer a friend and similar incentive programmes may be offered, and we may offer incentives such as discounts or promotional items or credit in connection with these programmes, wherein you provide your personal information in exchange for a reward, or provide personal information regarding your friends or colleagues and receive rewards when they sign up to use our services. These programmes are entirely voluntary and allow us to grow our business and provide additional benefits to you. The value of your data to us depends on how you ultimately use our services, whereas the value of the referred party’s data to us depends on whether the referred party ultimately becomes a user of our services. Said value will be reflected in the incentive offered in connection with each programme. If you are a California resident and would like to exercise any of your rights under the CCPA, please contact us as set forth above, and we will process such requests in accordance with applicable laws.

If you are a resident of Nevada, you have the right to opt out of the sale of certain personal information to third parties who intend to license or sell that personal information. You can exercise this right by contacting us at help@toniesa.it.com with the subject line Nevada Do Not Sell Request and providing us with your name and the email address associated with your account. You can also call 866-387-7898 if you prefer to speak with someone directly. Please note that we do not currently sell your personal information as sales are defined in Nevada Revised Statutes Chapter 603A.

This policy applies to our presence on social media platforms including Facebook, Instagram, Pinterest, LinkedIn, YouTube and TikTok. We operate publicly accessible profiles on various social media networks. When you visit one of our profiles, various data processing activities may occur. If you are logged into your social media account, the network operator can associate your visit to our profile with your account. Even if you do not have an account or are not logged in, your data may still be collected, for example via cookies or your IP address. The collected data is used by the network operators to create user profiles, which may be used for personalised advertising. If you have an account with the network, this advertising can appear on all devices where you are or have been logged in. Please note that we cannot fully track or influence all processing activities conducted by the networks, and for more details, please refer to the privacy policies of the respective providers.

Our social media presence is based on our legitimate interest in ensuring a comprehensive online presence. However, the data processing by the networks themselves may rely on other legal bases, such as your consent. If you visit one of our social media profiles, we are jointly responsible with the social media platform operator for the data processing triggered by your visit. You can exercise your rights, including access, rectification, deletion, restriction of processing, data portability and filing a complaint, either with us or with the operator of the respective social media platform. Please note that despite the shared responsibility with the platform operators, we have limited control over their data processing, and our influence is primarily determined by the policies of the respective provider. Data collected directly through our social media presence is deleted from our systems as soon as you request its deletion, withdraw your consent, or the purpose for storage no longer applies. Stored cookies remain on your device until you delete them, and mandatory legal provisions, especially retention periods, remain unaffected. We have no control over how long your data is stored by the social media network operators for their own purposes, and for details, please refer directly to the privacy policies of the respective networks. You can contact us or the operator of the social media platform at any time if you have questions about your data. You have the right to access your data, rectify, block or delete your data, restrict processing, data portability and file a complaint with a supervisory authority.

We have a profile on Facebook, provided by Meta Platforms Ireland Limited. According to Meta, the collected data is also transferred to the USA and other third countries. We have entered into an agreement with Meta regarding joint processing, which defines the data processing responsibilities when you visit our Facebook page. You can adjust your advertising preferences in your user account by logging in to your settings. Data transfers to the USA are based on the standard contractual clauses of the European Commission, and further information can be found in Facebook’s privacy policy. Meta is certified under the EU-US Data Privacy Framework, an agreement between the European Union and the USA to ensure compliance with European data protection standards.

We have a profile on Instagram, provided by Meta Platforms Ireland Limited. Data transfers to the USA are based on the standard contractual clauses of the European Commission, and further information can be found in Instagram’s privacy policy. Meta is certified under the EU-US Data Privacy Framework. We have a profile on Pinterest, provided by Pinterest Europe Ltd, and details on how your data is handled can be found in Pinterest’s privacy policy. We have a profile on LinkedIn, provided by LinkedIn Ireland Unlimited Company, which uses advertising cookies. If you want to disable LinkedIn’s advertising cookies, you can do so in your settings. Data transfers to the USA are based on the standard contractual clauses of the European Commission, and further information can be found in LinkedIn’s privacy policy. LinkedIn is certified under the EU-US Data Privacy Framework. We have a profile on YouTube, provided by Google Ireland Limited, and details on how your data is handled can be found in YouTube’s privacy policy. Google is certified under the EU-US Data Privacy Framework. We have a profile on TikTok, provided by TikTok Technology Limited, and details on how your data is handled can be found in TikTok’s privacy policy. Data transfers to non-secure third countries are based on the standard contractual clauses of the European Commission. This document was last updated in December 2024.