Last updated: 28 October 2026
This policy explains which personal data we collect when you visit our websites or use the
Toscana ERP and CRM system, why we process it and what rights you have. We process personal data
in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR).
1. Who is the controller
| Company | TOSCANA systems d.o.o. |
|---|
| Registered office | Svetoklarska 26b, 10020 Zagreb, Croatia |
|---|
| VAT number | HR37847480286 |
|---|
| Company registration number | 080826705 |
|---|
| E-mail | support@toscana-systems.eu |
|---|
2. Data protection officer
Our data protection officer is Andy Džinić. For any question about the processing of
your data, and to exercise the rights listed in section 9, write to
support@toscana-systems.eu.
3. What data we collect
When you visit the website. Our server records the IP address, date and time of the
request, the requested address, browser and operating system type and the referring page.
These logs serve security and troubleshooting.
When you fill in a form. Through the contact form, the presentation request, webinar
registration or newsletter sign-up we collect your name, company name, e-mail address,
telephone number and the content of your message.
When you are our customer. To conclude and perform the contract we process company
data, contact details of the people responsible for the project, user accounts in the system and
the data needed for invoicing.
Cookies. See section 10.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|
| Answering an enquiry and preparing a quotation | Steps taken at your request prior to entering into a contract (Art. 6(1)(b)) |
| Concluding and performing the contract, customer support | Performance of a contract (Art. 6(1)(b)) |
| Issuing invoices and keeping business records | Legal obligation (Art. 6(1)(c)) |
| Newsletter and product announcements | Consent (Art. 6(1)(a)), which you may withdraw at any time |
| System security and prevention of misuse | Legitimate interest (Art. 6(1)(f)) |
5. When we act as a processor
For the data our customers enter into the Toscana ERP and CRM system — data about their own clients,
suppliers and employees — the customer is the controller and we are the processor.
We process that data solely on the customer's instructions and under a data processing agreement,
to the extent required to provide the service and technical support. We do not use it for our own
purposes and do not disclose it to third parties other than as described in section 6.
The Marketing module of the Toscana ERP system lets a customer's authorised users connect the customer's own
accounts on YouTube (Google), Facebook and Instagram (Meta), LinkedIn and TikTok, and publish the customer's own
content to them. A connection is made only when an authorised user clicks "Connect" and signs in with the platform
and grants access on the platform's own consent screen.
What we receive and keep. Access and refresh tokens issued by the platform, the identifier, name and address of
each connected channel, page, profile or account, the permissions granted, and the identifier, address and status
of each post published from the system. Tokens are stored only in encrypted form on our servers in Germany, are
never shown to users and are used only to perform the actions the customer's users start in the system: uploading
and publishing videos and texts, setting thumbnails and captions, reading the status of those posts and, only on an
explicit request, hiding or deleting a post that was published from the system. We do not read, store or analyse
the followers, messages, comments, analytics or other content of the connected accounts, and we do not use data
received from the platforms for advertising, profiling or training of AI models, and do not sell or transfer it to
third parties.
Roles. For the content and accounts of a customer, the customer is the controller and we are the processor
(section 5). The video and text files the customer prepares are kept in the customer's archive within the system on
storage in the European Union.
Platform terms. The Marketing module uses YouTube API Services. By connecting a YouTube channel the user also
agrees to be bound by the YouTube Terms of Service
(https://www.youtube.com/t/terms);
Google's handling of data is described in the Google Privacy Policy
(http://www.google.com/policies/privacy).
Toscana ERP's use and transfer to any other app of information received from
Google APIs will adhere to the Google API Services User Data Policy
(https://developers.google.com/terms/api-services-user-data-policy),
including the Limited Use requirements.
Publishing to TikTok, Facebook, Instagram and LinkedIn is subject to those platforms' own terms and policies.
Disconnecting and deletion. A user can disconnect an account at any time in the system (Marketing -> Social media
channels -> Disconnect): the tokens are deleted immediately and, where the platform supports it (Google, TikTok),
access is also revoked at the platform. Access can also be removed on the platform: Google -
https://security.google.com/settings/security/permissions; Facebook - Settings & privacy -> Settings -> Business
integrations; Instagram - Settings -> Website permissions / Apps and websites; LinkedIn - Settings & Privacy -> Data
privacy -> Permitted services; TikTok - Settings and privacy -> Security -> Apps and websites. Data received from a
platform about a connected account is deleted within 7 days after the account is disconnected in the system or after
a deletion request, and within 30 days after access is removed on the platform; data we keep from the platforms is
refreshed or deleted at least every 30 days. To request deletion, write to
support@toscana-systems.eu (data
protection officer, section 2). The record of what was published from the system (date, platform, link, the text
the user approved) stays in the customer's ERP as part of its business records until the customer deletes it or the
contract ends (section 8); deleting data in the system does not delete posts on the platforms, which the user can
remove in the system (Remove from platform) or on the platform.
6. Who else can see the data
We do not sell personal data. We share it only with those we need in order to provide the service:
- the provider hosting our servers in Germany, within the European Union;
- e-mail and newsletter delivery providers;
- our accountants and auditors, within their statutory duties;
- competent authorities, where required by law.
We have data processing agreements in place with all processors.
7. Transfers outside the European Economic Area
Data is stored and processed on servers in Germany. We do not transfer it outside the
European Economic Area. Should such a transfer ever become necessary, it would take place only under
the appropriate safeguards of Chapter V of the GDPR and you would be informed in advance.
8. How long we keep data
- Enquiries and quotations — up to 2 years from the last contact, unless a contract results from them.
- Contracts and invoices — 11 years, as required by tax legislation.
- Data in the ERP system — for the duration of the contract and no more than 90 days after it ends,
after which it is deleted or returned to the customer according to their instruction.
- Newsletter — until consent is withdrawn.
- Server logs — up to 12 months.
9. Your rights
At any time you have the right to:
- request access to your data and a copy of it;
- request rectification of inaccurate data;
- request erasure where there is no longer a basis for processing;
- request restriction of processing;
- object to processing based on legitimate interest;
- request portability of your data in a machine-readable format;
- withdraw consent, without affecting the lawfulness of processing before withdrawal.
Send your request to support@toscana-systems.eu.
We respond within one month at the latest. If you believe your rights have been infringed, you may
lodge a complaint with the Croatian Personal Data Protection Agency (AZOP),
Selska cesta 136, 10000 Zagreb, azop.hr,
or with the supervisory authority in your country of residence.
10. Cookies
We use cookies that are strictly necessary for the site and for signing in to the system, without which
the site cannot work, and analytics cookies that show us which pages are read. You can block or delete
cookies in your browser settings; if you block the necessary ones, signing in will not work.
11. Security
Traffic to our websites and to the system is protected by TLS encryption. Access to data is limited to
employees who need it for their work and who are bound by confidentiality. Database backups are made
every 8 hours and backups of files stored on disk once a week; all backups are kept within the
European Union.
12. Changes to this policy
We may amend this policy from time to time. The date of the last change is shown at the top of the page.
We will notify customers of the system by e-mail about any material change.