Privacy policy

Controller

Johann Borchardt
Tolkoi
c/o Galerie Borchardt
Hopfensack 19
20457 Hamburg
Germany

Email: info@tolkoi.com

Scope

This privacy policy applies to tolkoi.com and to the websites of Tolkoi's Apps that refer to it. Each App also has its own privacy policy, linked below.

Visiting the website

The website is delivered by Cloudflare. On every visit, Cloudflare processes the data your browser sends for technical reasons: your IP address, date and time, the address requested, the referring page and details of your browser and operating system. This is used to deliver the pages and to protect the website against attacks and misuse.

We do not keep access logs ourselves and use no analytics or tracking tools. Where Cloudflare processes traffic data for its own purposes, for example to detect attacks on its network, Cloudflare's privacy policy applies.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to provide the website securely and reliably.

Cookies and browser storage

The website sets no cookies.

If you switch between the light and dark theme, the website stores your choice in your browser's local storage (an entry "theme" with the value "light" or "dark"). The entry stays on your device and is not sent to us. It is strictly necessary for the function you asked for (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). You can delete it in your browser at any time.

Contact form and email

When you write to us through the contact form, we process the App concerned, your email address, your message and the language of the page. The form sends these details by email, through Cloudflare's email service, to our mailbox at Google Workspace. When you send it, we briefly use your IP address to fend off too many requests in a short time; we do not store it.

The same applies when you write to us directly at support@tolkoi.com or info@tolkoi.com.

We use your details only to answer your request. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in answering requests. If your request concerns your use of one of our Apps, the legal basis is Art. 6(1)(b) GDPR.

We cannot answer you without an email address. No other details are required.

We delete your request 6 months after it is closed. Requests in which you exercise your data protection rights are kept for 3 years so that we can show that we handled them (Art. 5(2) and Art. 6(1)(c) GDPR).

Spam protection with Cloudflare Turnstile

On the Support pages, where the contact form is, we use Cloudflare Turnstile to tell requests from people and from automated programs apart. Turnstile loads when you open these pages. It reads properties of your browser and device and processes your IP address. Usually you will not notice it; only in case of doubt does a short check appear. When you send the form, our server passes the check result and your IP address to Cloudflare to have it confirmed.

Accessing information in your browser is strictly necessary for the contact form you want to use (§ 25(2) no. 2 TDDDG). Further processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to protect the form and our mailbox against spam and misuse.

For detecting and blocking automated programs, Cloudflare acts on our behalf. Cloudflare also uses the signals collected (IP address, TLS fingerprint, browser identifier and the website visited) under its own responsibility to improve Turnstile's detection; the legal basis there is Art. 6(1)(f) GDPR. Cloudflare does not state a retention period. Details are in Cloudflare's Turnstile privacy notice.

Recipients and transfers to third countries

We use the following service providers as processors (Art. 28 GDPR):

• Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA): delivering the website, Turnstile and sending the form emails.
• Google (Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland): the mailbox for email, through Google Workspace.

Data is transferred to the USA in the process. Cloudflare, Inc. and Google LLC are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Should it lapse, the contracts with both providers provide for the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Beyond this, we do not pass on your data and we do not sell it.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). To exercise them, write to info@tolkoi.com.

Right to object: Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

No automated decisions

We make no automated decisions and do no profiling (Art. 22 GDPR).

Last updated: November 2026