Privacy notice

Draft — pending review by counsel. Not yet in force.

Last updated: 7 November 2026

1. Who is responsible

Describe IT AB, Sweden [organisation number — to be confirmed] [registered address — to be confirmed] is the controller of your personal data. Contact: support@toga.tv. [Data protection contact or representative — to be confirmed.]

2. What we hold

• Your email address.
• A password hash, or one-time sign-in codes.
• Your date of birth, and your country and subdivision of residence.
• Eligibility decisions and the facts they were based on, kept as an audit trail.
• Identity-verification outcomes from Stripe. We keep the outcome, not the documents.
• Bids, slot awards and ledger entries.
• Contest answers and scores.
• Moderation reports.
• Service logs.

3. Why we use it and our legal basis

We use it to run your account and the service (contract), to check age and eligibility and keep audit trails (legal obligation and legitimate interests), to take payments and make payouts (contract), to keep the platform safe and handle reports (legal obligation and legitimate interests) and to keep the service running (legitimate interests). [Legal basis per purpose — to be confirmed by counsel.]

4. Who processes it

Our processors are Amazon Web Services and Stripe. We host on AWS in eu-north-1 (Stockholm). Live video uses Amazon IVS in eu-west-1 (Ireland). Email is sent through Amazon SES. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

5. How long we keep it

Service logs are kept for 14 days in CloudWatch and archived to S3 for up to 13 months. [Retention for other data — to be confirmed.]

6. International transfers

[Transfers outside the UK and EEA, and the safeguards used — to be confirmed.]

7. Your rights under UK GDPR and EU GDPR

You can ask for access to your data, correction, erasure and portability, and you can object to our use of it. Write to support@toga.tv. You can complain to the Information Commissioner's Office (ICO) in the United Kingdom or to the Swedish Authority for Privacy Protection (IMY).

8. Canada (PIPEDA)

If you are in Canada you can ask to see and correct your personal information and can ask how we handle it. You can complain to the Office of the Privacy Commissioner of Canada.

9. California (CCPA/CPRA)

We do not sell or share personal information as those terms are defined in California law. California residents can ask to know, delete and correct their personal information, and we will not treat you worse for asking.

10. Children

toga.tv is for people aged 18 and over. We refuse accounts where the date of birth shows otherwise.

11. Changes

We will change the date at the top of this page when we update this notice.