# Accord de traitement des données

Dernière mise à jour le 9 novembre 2026. Ces conditions sont rédigées en anglais ; en cas de différence entre une traduction du site et ces conditions, le texte anglais s’applique.

This agreement explains how to.co handles personal data for your business, what each of us must do to protect it, and how we help you meet your data protection obligations. It forms part of our [terms of service](/fr-fr/terms).

## 1. Who this agreement covers

This agreement is between:

- **To.Co Technologies Limited**, registered in England and Wales under company number 14013936, with its registered office at 66 Paul Street, London, England, EC2A 4NA (called **to.co**, **we**, or **us**); and
- **your business** (called **you**).

When you use to.co to handle personal data about other people, you generally decide why and how that data is used. This makes you the **controller**. We process that data for you, which makes us the **processor**.

If you process personal data for another organization, you may be its processor and we may be your **subprocessor**. You confirm that you have permission to instruct us to process that data.

This agreement applies only when we process personal data for you. When we use personal data for our own purposes, we act as an independent controller, as explained in section 15 and our [privacy notice](/fr-fr/privacy).

In this agreement, **data protection law** means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable, the EU GDPR and related laws. Other data protection terms have the meanings given to them by those laws. Words defined in our terms of service have the same meanings here.

## 2. What personal data we handle

Depending on the features you use, we process personal data for you when:

- **Someone sends your business a message.** We check and deliver it, use an AI model to help detect spam and write a one-line summary, and store it for your business.
- **You use the API or the to.co MCP server.** We process the information needed to complete actions requested by you or by an application or AI assistant you authorize.
- **You set up webhooks.** We send event information to the HTTPS addresses you choose. A new-message event includes the sender’s name, contact details, and message.
- **You publish business content.** We host the personal data you put in your business record, page, or posts. If you connect WordPress or Ghost, we can send posts to your site as you instruct.
- **You use trading features, where available.** We handle personal data in documents, invitations, trading partner details, and shared information as you instruct.

Schedule 1 explains which people and types of data are involved, what we do with that data, who receives it, and how long we keep it. We do not use personal data we process for you for unrelated purposes.

## 3. We follow your instructions

We process personal data for you only on your documented instructions, unless the law requires us to do otherwise. Your instructions include:

- this agreement and our terms of service;
- your account settings and choices;
- actions you take in the app, API, or MCP tools;
- permissions you grant to applications and AI assistants;
- your choices about messages, webhooks, publishing, and deletion; and
- other written instructions we accept.

You can change or withdraw instructions through the service. Contact us if you need to give an instruction that the service does not support.

If we believe an instruction breaks data protection law, we will tell you and may pause it while the issue is resolved. If the law requires us to process data outside your instructions, we will tell you first unless the law prevents us.

We will not sell personal data we process for you. We will not use it to train AI models, advertise to people, or build advertising profiles.

## 4. Your responsibilities

You are responsible for deciding whether you can lawfully collect and use the personal data you give us. You must:

- have a valid legal basis for processing it;
- give people the privacy information required by law;
- use the data only for lawful purposes;
- give us lawful, accurate instructions;
- limit access to people and applications that need it;
- respond to requests from people whose personal data you control; and
- tell us when you need help meeting your legal obligations.

Do not use to.co to collect or process personal data unlawfully. Do not deliberately send us special category data, criminal offense data, or other highly sensitive personal information. The service is not designed to manage sensitive records. If someone includes sensitive information in an unsolicited message, we protect it under this agreement.

## 5. We keep your data confidential

We allow access to personal data only to people who need it to operate, support, or secure the service. Everyone we authorize to handle that data must keep it confidential, under an agreement or the law. This duty continues after their access ends.

We disclose personal data only on your instructions, to subprocessors under section 7, or when the law requires it under section 14.

## 6. How we protect personal data

We use technical and organizational security measures appropriate to the data and the risks involved. We consider the nature of the data, risks to people, available technology, and implementation costs. Our measures are designed to protect against unauthorized access, accidental loss, changes, disclosure, and destruction. Schedule 2 describes these measures.

We may improve or replace security measures, but we will not materially reduce the overall level of protection.

You must protect your own sign-in methods, API keys, authorized applications, connected AI assistants, and webhook servers.

## 7. Companies that process data for us

A **subprocessor** is a company that handles personal data on our behalf when we provide services to you. You authorize us to use the subprocessors listed in Schedule 3.

Before using a subprocessor, we require it to accept written data protection obligations that offer protection at least equivalent to this agreement. We remain responsible to you for its work.

**Changes to subprocessors.** We give you at least 30 days’ notice before adding or replacing a subprocessor that will handle your data. We publish the change on our [subprocessors page](/fr-fr/subprocessors) and email the Owners of every business on to.co.

You may object during the notice period for reasonable data protection reasons, through our [contact page](https://my.to.co/contact?purpose=privacy) with **Privacy** chosen. We aim to reply within 5 working days. We will consider the objection and try to find a reasonable solution. If we cannot, you may stop using the affected feature or end your plan without a penalty. We refund the prepaid amount for the service you can no longer use.

If an urgent change is needed to protect the service or comply with the law, we will tell you as soon as reasonably possible and explain why. You can still object.

## 8. Transfers to other countries

We and our subprocessors may handle personal data outside your country or the country where the people concerned live. When data leaves the UK or European Economic Area (EEA), we follow the applicable transfer rules.

Where required, we use an approved legal mechanism, such as:

- a UK or EU adequacy decision that covers the recipient and transfer;
- the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified and the transfer is covered;
- the UK International Data Transfer Agreement;
- the European Commission’s Standard Contractual Clauses, with the UK Addendum where needed; or
- another mechanism allowed by law.

We apply any additional safeguards required by law. Schedule 4 explains the transfers, destinations, and legal mechanisms.

**Transfers from the EEA to to.co in the UK.** Where applicable, these transfers rely on the EU’s adequacy decision for the UK. If that decision no longer applies, the European Commission’s Standard Contractual Clauses (module two: controller to processor) form part of this agreement. You are the data exporter, we are the data importer, and Schedules 1–3 provide the relevant annex information.

## 9. What happens after a personal data breach

A **personal data breach** is a security incident that results in personal data being lost, destroyed, changed, disclosed, or accessed accidentally or unlawfully.

If we become aware of a breach affecting data we process for you, we will tell you without undue delay, by email to the Owners of the affected businesses. We aim to send the first notice within 24 hours of becoming aware of the breach.

We will share the information available at the time, including:

- what happened and when we became aware of it;
- the people and personal data that may be affected;
- the likely consequences;
- the steps taken or planned; and
- how to contact us about the incident.

We may provide updates as we learn more. We will take reasonable steps to contain and investigate the breach, reduce its impact, and prevent a repeat. We will help you meet your reporting obligations.

As the controller, you decide whether to notify regulators or affected people, unless the law requires us to notify them ourselves.

## 10. Requests from people whose data you hold

People may have the right to access, correct, delete, restrict, or receive a copy of their personal data, or object to certain uses of it.

If someone asks us about data we process for you, we will pass the request to you without undue delay. We will not respond on your behalf or disclose that data without your instructions unless the law requires us to.

We help you handle valid requests. Where the app provides tools to find, export, correct, or delete relevant data, you can use them directly. Contact us if you need help with something the app cannot do.

## 11. How we help you meet your obligations

Taking account of the processing we carry out and the information available to us, we provide reasonable help with:

- keeping personal data secure;
- investigating and reporting breaches;
- handling requests from individuals;
- assessing data protection risks, including data protection impact assessments; and
- consulting a data protection regulator when required.

We may ask you for information needed to help. Ordinary help through the service is free. If your request needs substantial additional work, we will agree a reasonable fee with you in advance unless the law requires us to provide that help without charge.

## 12. How long we keep data and when we delete it

We keep personal data we process for you only as long as needed to provide the service, follow your instructions, or meet legal obligations. Schedule 1 gives the retention periods for each feature. You can manage or delete much of this information in the app.

When you close your account or stop using a feature, we delete the personal data processed for that feature, subject to legal retention requirements. You can ask us to return it first. The app provides export tools, and we give you a reasonable opportunity to obtain your data before deletion.

Some records, including certain trading documents, must be kept for a legally required period. We continue to protect this data under the agreement and do not use it for unrelated purposes.

Backup copies are deleted through the normal backup replacement cycle. Until then, they remain protected and are not used for other purposes. If we restore a backup, we apply the required deletions again.

We may separately retain data for which we are an independent controller, such as accounting, fraud prevention, security, and legal compliance records. See section 15 and our privacy notice.

## 13. Information and audits

We provide information you reasonably need to assess our compliance with this agreement and Article 28 of the UK or EU GDPR. This includes the agreement and its schedules, a summary of our security policies, and any independent assessment reports we hold.

If that information is insufficient, or a regulator requires it, you may audit our compliance yourself or through an independent auditor who is bound by confidentiality. We may first offer documents or reports that address your questions. If further inspection is necessary, we will allow and assist with it.

Normally, give us at least 30 days’ notice and cover the audit costs. Audits must protect other customers’ data, our confidential information, and the security and availability of the service. These arrangements do not limit any audit rights given to you by law.

We will promptly tell you if we can no longer meet our obligations under this agreement.

## 14. Requests from government and law enforcement

If a government body, court, or law enforcement agency requests data we process for you, we review the request before responding. Unless the law prevents us, we will tell you so that you can consider or challenge it.

We disclose only what we are legally required to. Where we reasonably believe a request is unlawful or excessive, we challenge it when the law permits.

## 15. When to.co is the controller

For some activities, we decide how and why personal data is used. We then act as an independent controller, rather than your processor. These activities include:

- running accounts and sign-in, and managing account members;
- billing, payments, taxes, and accounting;
- checking identity and addresses;
- using official registers and creating records from them;
- reviewing your website to suggest details for your business record;
- preventing fraud, investigating misuse, and screening sanctions;
- measuring and improving how the service operates;
- managing our support records; and
- meeting legal and regulatory obligations.

Our [privacy notice](/fr-fr/privacy) explains this processing. This agreement does not change either party’s duties when acting as an independent controller.

## 16. When this agreement applies and how it changes

This agreement starts when you accept our terms of service and use a feature where we process personal data for you. It remains in effect while we process that data.

We may update it when the law or our services change. If a material change affects your rights or obligations, we give you at least 30 days’ notice unless the law requires us to act sooner.

If a change materially reduces your data protection rights and we cannot offer a suitable alternative, you may end the affected service before the change takes effect. We refund any prepaid amount for the service you can no longer use.

No change removes any protection required by data protection law.

## 17. How this agreement relates to our terms

This agreement forms part of our terms of service. If they conflict about personal data we process for you, this agreement takes priority. If applicable Standard Contractual Clauses conflict with this agreement, those clauses take priority.

Neither agreement limits individuals’ rights or either party’s duties under data protection law. The liability limits in section 18 of our terms of service apply to this agreement only where the law allows.

This agreement follows the law specified in our terms of service, except where applicable Standard Contractual Clauses require otherwise.

## 18. Contact us about data protection

For questions about this agreement or personal data we process for you:

- **Contact form:** our [contact page](https://my.to.co/contact?purpose=privacy), with **Privacy** chosen.
- **Post:** To.Co Technologies Limited, 66 Paul Street, London, England, EC2A 4NA (company number 14013936).

---

## Schedule 1. Personal data we process for you

**What this covers:** Our messaging, publishing, API, MCP, webhook, and available trading features.

**How long processing lasts:** While you use the relevant feature, followed by the retention and deletion periods below.

**Why and how we process data:** To receive, check, store, display, send, summarize, filter, export, and delete information as needed to provide your chosen features. We do not use it for unrelated purposes.

**Whose data is involved:** People who contact your business; customers and prospective customers; contacts at trading partners; people named in messages, documents, or business content; and people represented by authorized applications or AI assistants.

**Sensitive data:** The service is not designed for special category or criminal offense data. See section 4.

| Feature | Personal data | What we do | Who receives it | Retention |
| --- | --- | --- | --- | --- |
| **Messages** | Sender’s name, email or phone number, message, and time; an assistant’s name where relevant. We do not store the sender’s IP address or browser details with the message. | Check that the sender is a person or confirm their email address; check for spam and summarize with an AI model; store, display, and notify your business. | Your business and our subprocessors. | 12 months from receipt, or 24 months on Grow; spam held for 30 days; sooner if you delete it. |
| **API and MCP tools** | Personal data included in authorized requests and responses, such as messages. | Check authorization and permissions, carry out requested actions, and record usage for credits and security. | Applications and AI assistants you authorize. | Same as the underlying data. Usage counts are kept for 12 months and do not include message content. |
| **Webhooks** | Event details; new-message events include the sender’s name, contact details, and message. | Prepare, sign, send, retry, and log deliveries. | HTTPS endpoints you choose. | Event and delivery logs: 30 days. |
| **Business content** | Personal data you publish in your business record, page, or posts, such as names and photographs. | Store, resize, format, publish, cache, remove, and, where configured, send posts to your WordPress or Ghost site. | People who view the page and services you connect. | While published, until removed or released under section 5 of the terms; temporary cache and backup copies may remain for a limited time. |
| **Trading documents** (where available) | Contact names, business contact details, and personal data included in documents or shared files. | Encrypt, store, deliver, display to authorized people, and log access. | Document parties and people you authorize. | Documents created on to.co: 7 years from issue, or 10 years where either party is in Germany, France or Italy (the longer period of the two parties applies). Documents read live from your accounting system are not stored; we keep only their status and a reference to them. |
| **Trading partners, invitations, and profiles** (where available) | Names, roles, and business contact details for team members and invited businesses. | Store profiles, share them with chosen partners, send invitations with an opt-out link, and make safe copies of shared files. | Your chosen trading partners and invited businesses. | While the relationship or profile exists; invitation records while invitations remain open; opt-out records retained to honor the request. |

**Your responsibilities:** You decide the lawful purposes, provide instructions and privacy notices, and handle requests from people whose data you control. You may request information, assistance, data return or deletion, and audits under this agreement.

## Schedule 2. Security measures

These measures apply to the processing listed in Schedule 1.

### Access controls

- Requests are checked against the business that owns the data, including checks for individual records. Automated tests check for missing authorization on API routes.
- Account members have one of four roles, each with limited access.
- Sensitive changes, including bank details, API keys, and account membership, require a recent sign-in.
- Production and administrative access is limited to authorized staff. Administrative actions are logged.
- Access is removed when no longer needed. Removing an account member ends their account sessions and revokes keys and tokens they created for that account.

### Sign-in and secrets

- Sign-in does not use passwords.
- Session tokens, sign-in codes and links, agent tokens, and API keys are stored as hashes.
- Sessions use secure, host-only cookies and protections against forged requests.
- Service secrets are kept in a secret store, not in source code. Automated checks scan code changes for exposed secrets.

### Data protection

- Connections use TLS. HTTP traffic is redirected to HTTPS, with HSTS.
- Hosting and database providers encrypt stored data.
- Documents created on to.co have per-document encryption keys, wrapped for each party.
- Shared files are encrypted while quarantined and are shared only after a safe copy is rebuilt.
- Business data is associated with the owning business and filtered by access permissions.
- Messages do not store the sender’s IP address or browser details. Application logs use request identifiers rather than message contents or contact details.

### System security

- Dependencies are checked for known problems and updated. Code changes go through automated tests, type checks, and secret scans before release.
- Rate limits, checks that a sender is a person, and spam filters help protect the service.
- Service availability and failed background jobs are monitored, with alerts for staff.

### Backups and recovery

- The database provider maintains backups of the database.

### Operational security

- Staff and contractors must keep data confidential and follow written security policies.
- An incident response policy sets out who assesses and reports personal data breaches.
- Suppliers are reviewed before use and recorded in a vendor register.
- Security controls are reviewed against a control catalog.

## Schedule 3. Subprocessors

The current list and any announced changes are published on our [subprocessors page](/fr-fr/subprocessors). The list below must be kept consistent with that page.

| Company | Service | Personal data | Processing location | Added |
| --- | --- | --- | --- | --- |
| Cloudflare, Inc. | Hosting, storage, queues, background tasks, message spam checks and summaries, and checks that a sender is a person. | Data in Schedule 1, in transit or at rest as relevant. | Cloudflare's global network. Stored data is not pinned to a region. | 2026 |
| PlanetScale, Inc. | Managed PostgreSQL database hosting. | Data in Schedule 1, excluding files. | Our production database uses a primary and two replicas in AWS London (eu-west-2), United Kingdom. PlanetScale may process personal data from other countries to provide support and operate its service. | 2026 |
| Resend (Plus Five Five, Inc.) | Sending message alerts, invitations, and service notices by email. | Email addresses and message contents sent through email. | United States. | 2026 |

A service you connect yourself, such as an accounting platform, WordPress, Ghost, or your own webhook endpoint, receives data under your instructions and your agreement with that service. It does not become our subprocessor solely because you connect it to to.co. Stripe acts as an independent controller for card payments and identity checks under its own terms.

## Schedule 4. International transfers

| From and to | Data | Purpose | Destination | Legal mechanism |
| --- | --- | --- | --- | --- |
| to.co → Cloudflare, Inc. | Relevant Schedule 1 data. | Hosting, storage, and AI processing. | United States and Cloudflare’s global network. | Cloudflare's data processing addendum (version 6.4, 3 April 2026): the EU–US Data Privacy Framework and its UK Extension where Cloudflare's certification covers the transfer; otherwise the EU Standard Contractual Clauses with the UK Addendum. |
| to.co → PlanetScale, Inc. | Schedule 1 data, excluding files. | Database hosting. | United Kingdom (AWS London, eu-west-2) for the database; other countries for PlanetScale's support and operations. | The EU–US Data Privacy Framework and its UK Extension: PlanetScale is listed as an active participant on the official register (checked 9 November 2026). Its data processing addendum (15 October 2026) also includes the EU Standard Contractual Clauses. |
| to.co → Resend | Email addresses and email content. | Email delivery. | United States. | The EU Standard Contractual Clauses with the UK Addendum, as incorporated into Resend's data processing addendum dated 31 December 2025. Resend is also listed on the official Data Privacy Framework register as an active participant under the EU–US Data Privacy Framework and its UK Extension (checked 9 November 2026). |
| You (EEA) → to.co (UK) | Schedule 1 data. | Providing the service. | United Kingdom. | EU adequacy decision for the UK; Standard Contractual Clauses (module two) if needed, as described in section 8. |

Where required, we keep a transfer risk assessment for each transfer and make it available on request.