Legal

Privacy policy

Information under the EU General Data Protection Regulation (GDPR). This English version is a translation for convenience; the German Datenschutzerklärung is legally binding.

1. Controller

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Overview and legal bases

We process personal data only where this is necessary to run this website, to answer your enquiries or to take steps before entering into a contract, or where you have given your consent. The relevant legal bases under the GDPR are:

• Art. 6(1)(a) GDPR — your consent
• Art. 6(1)(b) GDPR — a contract or steps before entering into one, e.g. a project enquiry or an intro call
• Art. 6(1)(c) GDPR — legal obligations, e.g. retention duties under tax law
• Art. 6(1)(f) GDPR — our legitimate interests, e.g. running the website securely and reliably

Where information is stored on or read from your device, § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies.

The connection to this website is encrypted with TLS (you can tell by “https://” in the address bar).

3. Hosting and server log files

This website is hosted by Netlify, Inc. (USA) and delivered through its global content delivery network. When you open the website, Netlify automatically processes information your browser sends:

• IP address
• date and time of access
• the page or file requested and the amount of data transferred
• referrer URL (the page you came from)
• browser type, operating system and device type

This processing is necessary to deliver the website and keep it secure, for example to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Netlify processes this data as a processor on our behalf. More information: netlify.com/privacy.

4. Contact by email or phone

If you contact us by email or phone, we process the details you give us (e.g. name, email address, phone number, the content of your enquiry) to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).

Emails to info@tonsolutions.dev are received and stored through the “Private Email” service of Namecheap, Inc. (USA). More information: namecheap.com – Privacy Policy.

5. Booking a call with Calendly

To let you book an intro call, we embed the scheduling tool of Calendly LLC (USA) on our home page and on our offer page for beauty studios. When you open these pages, the scheduler is loaded from Calendly's servers, and your IP address and technical information about your browser are sent to Calendly. Calendly may use cookies or similar technologies in the process.

If you book an appointment, Calendly processes the details you enter (e.g. name, email address, the time you chose, what you'd like to discuss) and makes them available to us. The legal basis for the booking is Art. 6(1)(b) GDPR (steps before entering into a contract); for loading the scheduler it is Art. 6(1)(f) GDPR — our interest in making it easy to arrange a call. More information: calendly.com/privacy.

6. Web analytics with PostHog

To understand how our website is used and to improve it, we use the analytics service PostHog (PostHog Inc., USA). The data is processed in PostHog's EU cloud (data centre in Frankfurt am Main).

In particular, the following data is collected:

• pages visited, clicks and time spent
• referrer URL and any campaign parameters in the URL
• browser, operating system, device type and screen size
• approximate location (country/city), derived from the IP address
• a randomly generated identifier stored in a cookie or in your browser's local storage, used to recognise returning visits

We do not create user profiles with names or email addresses and do not combine the data with other data sources. The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can stop the tracking at any time with effect for the future:

The setting is stored in your browser and applies until you clear your browser data. More information: posthog.com/privacy.

7. Google Fonts

For a consistent appearance we use the “Inter” typeface, which is loaded from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, when you open a page. In the process, your IP address is sent to Google; a transfer to Google LLC in the USA cannot be ruled out. The legal basis is Art. 6(1)(f) GDPR — our interest in a consistent and appealing presentation. More information: policies.google.com/privacy.

8. Links to other websites

Our pages link to third-party websites, for example our reference project obeauty-space.de. Simply displaying these links does not send any data to their operators. Only when you follow a link does the privacy policy of that website apply.

9. Transfers to third countries

Netlify, Namecheap, Calendly and PostHog are based in the USA, so access to data from the USA cannot be ruled out. Transfers are based on an adequacy decision of the European Commission (EU-US Data Privacy Framework) where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

10. Retention

We keep personal data only for as long as the respective purpose requires. We delete enquiries once they have been fully dealt with, unless statutory retention duties apply — for business letters and accounting records, § 147 AO and § 257 HGB set periods of six and eight to ten years respectively. Netlify deletes server log files automatically after a short time.

11. Your rights

You have the following rights with regard to your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawing consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a short message to info@tonsolutions.dev is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia: ldi.nrw.de.

Last updated: September 2026