Last updated: 2 November 2026
TokoWorks respects the privacy of visitors, clients, contacts, suppliers and users of our digital services. We handle personal data with care and process it only when this is necessary for our services, communication, security, administration or legal obligations.
This privacy statement explains which personal data we process, why we do so, how long we keep data, with whom we may share data and what rights you have.
1. Who are we?
TokoWorks is a Dutch software studio. Among other things, we build custom software, websites, CMS systems, customer portals, internal tools, automations, dashboards and integrations with existing systems such as CRM, ERP, accounting and other business software.
TokoWorks
Bisschop Notgerstraat 1
4012 ER Kerk Avezaath
The Netherlands
Email: info@tokoworks.com
Phone: +31 6 53 98 54 86
KvK number: 90773691
VAT number: NL865448553B01
For questions about privacy or this privacy statement, you can contact us at info@tokoworks.com.
2. Who does this privacy statement apply to?
This privacy statement applies to:
visitors to our website tokoworks.com;
people who contact us via the website, email, phone, WhatsApp or another communication channel;
clients and prospective clients;
contacts at suppliers, partners and clients;
users of systems, dashboards, portals or CMS environments that we manage ourselves or make available to clients;
people whose data we process in the context of project delivery, support, hosting, management or maintenance.
Please note: when we build, host or maintain software for a client, we may process personal data on behalf of that client. In that case, the client is usually the controller and we are the processor. The client's privacy statement then governs for the end users of that platform. Where necessary, we make separate arrangements on this in a data processing agreement.
3. Which personal data do we process?
We only process personal data that is necessary for the purpose for which it was collected. Depending on your relationship with TokoWorks, we may process the following data.
3.1 Data when you visit our website
When you visit our website, we may process technical data, such as:
IP address;
browser and device type;
operating system;
pages visited;
click behaviour on the website;
date and time of the visit;
referring website or source;
error messages and technical logs;
cookie preferences.
We use this data to make the website work properly, to secure it, to measure performance and to improve the user experience.
3.2 Data when you contact us
When you contact us via the website, email, phone, WhatsApp or another channel, we may process the following data:
name;
company name;
job title;
email address;
phone number;
content of your message;
information about your project, question or request;
files or attachments you send us yourself;
communication history.
We use this data to answer your question, schedule a meeting, prepare a proposal or otherwise follow up on your request.
3.3 Data of clients
When you become a client or we carry out a project for you, we may process additional data, such as:
names and contact details of contacts;
company details;
billing details;
payment details;
contract details;
project documentation;
notes from conversations;
technical specifications;
access credentials or user rights for systems, insofar as necessary;
data about support requests, bugs, change requests and maintenance.
We use this data to perform our agreement, manage projects, provide support, send invoices and keep our records in order.
3.4 Data in software, platforms and systems
TokoWorks builds and manages custom software, customer portals, dashboards, internal tools, CMS systems, integrations and similar digital solutions. In doing so, we may gain access to personal data held in those systems.
Examples include:
user accounts;
names and email addresses of users;
roles and permissions;
login details;
customer data;
order, planning, reporting or process data;
messages, forms or uploads;
log files;
technical metadata;
data exchanged with other systems via integrations.
We only process this data insofar as necessary for development, testing, management, hosting, support, maintenance, security or resolving technical problems.
Where this data comes from a client's systems, we in principle only process it on that client's instructions. In that case, we do not use this data for our own commercial purposes.
3.5 Data for support, management and maintenance
When we provide support or maintenance, we may process data such as:
name and contact details of the person reporting the issue;
description of the problem;
screenshots or files you provide;
technical logs;
user IDs;
error messages;
browser and device data;
time of actions in the system.
This data is needed to analyse problems, fix bugs, investigate security incidents and improve how software works.
3.6 Data of suppliers and partners
For suppliers, freelancers, partners and other business contacts, we may process:
name;
company name;
job title;
business contact details;
contract details;
billing details;
bank account number;
communication data.
We use this data for collaboration, administration, payments and contract management.
3.7 Data in a referral
If someone introduces you to us via our referral form, we receive your name, company name and an email address or phone number. We ask the person making the referral to do so only if you are aware of it. We only use this data to contact you about our services. Don't want to be contacted further? Let us know and we will delete your data.
4. Special categories of personal data
We do not actively ask for special categories of personal data, such as data about health, religion, political opinions, criminal records or other sensitive information.
Do you nevertheless send us special or sensitive data, for example in a document, project file, screenshot or support ticket? Then we only process it insofar as necessary to carry out your request or assignment. Where possible, we ask you not to share such data with us, or to anonymise or redact it.
For projects in which special categories of personal data are processed on a structural basis, we make separate arrangements in advance on security, roles, responsibilities, retention periods and data processing terms.
5. Why do we process personal data?
We process personal data for the following purposes:
making our website function;
answering questions and contact requests;
scheduling meetings;
preparing and following up on quotes;
performing agreements;
building, testing, delivering and maintaining software;
providing hosting, management and support;
managing client relationships;
improving our website, services and processes;
securing our systems;
investigating and resolving technical problems;
preventing misuse, fraud or security incidents;
keeping our records;
complying with legal obligations;
handling complaints or disputes.
6. On which legal bases do we process personal data?
We only process personal data when there is a valid legal basis for doing so.
Performance of a contract
We process data when this is necessary to perform a contract with you, for example for project delivery, support, hosting, maintenance, invoicing and client communication.
Steps prior to entering into a contract
When you contact us about a possible project, we process data to assess your request, answer questions and prepare a proposal.
Legal obligation
We process certain data because we are legally required to keep it, for example for our financial records and tax obligations.
Legitimate interest
We may process data on the basis of our legitimate interest, for example for security, logging, improving our services, relationship management, evidence and preventing misuse. In doing so, we always take your privacy interests into account.
Consent
For certain processing we ask for your consent, for example for non-essential cookies, marketing cookies or newsletters. You can withdraw your consent at any time.
7. Cookies and similar technologies
Our website may use cookies and similar technologies. Cookies are small files placed on your device when you visit our website.
We may use:
Functional cookies
These cookies are needed for the website to work properly. Examples include remembering preferences or technically enabling certain functions.
Analytical cookies
These cookies help us understand how visitors use our website. We use this information to improve the website. Where possible, we configure analytical cookies in a privacy-friendly way.
Marketing and tracking cookies
These cookies track visitors across websites or are used for advertising, remarketing or profiling. We only place these cookies if you have given your consent.
When we use tools such as analytics, pixels, embedded content, chat widgets or other external scripts, we state this in our cookie settings or cookie statement.
You can delete or block cookies via your browser settings. Please note that certain parts of the website may then work less well.
8. Newsletters and commercial communication
We only send you commercial emails or newsletters if you have signed up for them, if you are a client and the communication is relevant to our services, or if there is another valid legal basis for doing so.
You can always unsubscribe from commercial communication. In that case, we will no longer use your data for that purpose.
9. Use of AI tools
In certain cases, TokoWorks may use AI tools to support software development, documentation, analysis, prototypes, debugging, text suggestions or process improvement.
We approach this critically. We do not simply enter personal data, client data, confidential business information, source data or production data into external AI tools. When AI tools are used in a project in which personal data or confidential data may be processed, we make separate arrangements on this where necessary.
Where possible, we work with anonymised, pseudonymised or fictitious data. Production data is only used when this is necessary, appropriately secured and contractually permitted.
10. With whom do we share personal data?
We do not sell personal data to third parties.
We may, however, share personal data with parties that are necessary for our services, such as:
hosting providers;
email providers;
domain and DNS service providers;
analytics or monitoring tools;
project management tools;
accounting and invoicing software;
payment providers;
cloud platforms;
database and storage services;
suppliers of security and logging tools;
external developers or specialists working on a project;
legal, tax or administrative advisers;
government authorities when we are legally required to share data.
With parties that process personal data on our behalf, we make data processing arrangements where necessary.
When we work on behalf of a client and process data within that client's software or systems, we only share data insofar as necessary for the assignment and in accordance with the arrangements made with that client.
11. Processing outside the European Economic Area
We aim to process personal data within the European Economic Area as far as possible. However, certain suppliers or sub-processors may process data outside the European Economic Area, for example in the case of international cloud, analytics, support or software services.
When this happens, we ensure that appropriate safeguards are used, such as standard contractual clauses, additional security measures or other mechanisms permitted under data protection law.
12. Security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
Depending on the service or project, these measures may include:
access control;
strong passwords;
two-factor authentication where possible;
encrypted connections;
roles and permissions;
logging and monitoring;
backups;
secure hosting environments;
updates and patch management;
restricting access to personal data;
arrangements with suppliers and processors;
careful handling of test and production data.
No system is entirely free of risk. We do our best to secure data properly and also expect clients and users to handle accounts, passwords and access rights with care.
13. Data breaches
In the event of a security incident or data breach, we assess what happened, which data is involved and what risks exist for the data subjects.
Where legally required, we report a data breach to the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) and/or to the data subjects concerned. When we act as a processor for a client, we inform the client as quickly as possible in accordance with the arrangements in the data processing agreement.
14. How long do we keep personal data?
We do not keep personal data longer than necessary for the purpose for which it was collected, unless we are legally required to keep data longer or there is a legitimate interest in keeping data longer.
In principle, we apply the following retention periods:
contact requests: up to a maximum of 2 years after the last contact, unless a client relationship arises from it;
quotes and commercial communication: up to a maximum of 2 years after the last contact, unless otherwise necessary for evidence or follow-up;
client and project data: for as long as the client relationship or agreement runs and thereafter for as long as necessary for administration, support, warranty, evidence or legal obligations;
financial records: 7 years, due to the statutory tax retention obligation;
support data: for as long as necessary to handle the request and thereafter for as long as necessary for quality improvement, evidence or security;
technical logs: as briefly as possible, unless longer retention is necessary for security, error analysis or investigating misuse;
backups: for the normal backup cycle, unless longer retention is necessary;
job application data, where applicable: up to 4 weeks after the end of the procedure, unless you consent to longer retention.
Different retention periods may apply in client projects. We set these out in the agreement, data processing agreement or project arrangements.
15. Your rights
Under data protection law you have various rights. You can ask us for:
access to your personal data;
rectification of inaccurate or incomplete data;
erasure of your data;
restriction of processing;
portability of your data;
objection to processing;
withdrawal of consent previously given.
You can submit a request via info@tokoworks.com. We may ask you to confirm your identity, so that we can be sure we are providing data to the right person.
We respond as quickly as possible, and in any event within the statutory period.
Please note: we cannot delete some data immediately, for example when we are legally required to keep it or when data is needed for the performance of an agreement, administration, security or legal evidence.
16. Privacy in client projects
Because TokoWorks builds software, privacy can be part of the product we develop for clients. Think of account structures, roles, permissions, logging, retention periods, exports, deletion requests, integrations and data minimisation.
We help think this through, but the client remains responsible for the proper set-up of their own processes, legal bases, privacy statement and internal compliance, unless otherwise agreed in writing.
For projects in which personal data is processed, we recommend clearly recording in advance:
which personal data is processed;
who the controller is;
who the processor is;
which sub-processors are used;
where data is stored;
which retention periods apply;
who has access;
how data subjects' rights are handled;
how backups, logs and test data are managed;
what happens when the collaboration ends.
17. Links to external websites
Our website may contain links to external websites or services. TokoWorks is not responsible for the way external parties handle personal data. We advise you to read the privacy statements of those parties.
18. Changes to this privacy statement
We may change this privacy statement when our services, systems, suppliers or legal obligations change. The most recent version is always available on our website.
When changes are significant, we may actively inform clients or users about them.
19. Complaints
Do you have a complaint about the way we handle personal data? Then contact us via info@tokoworks.com. We will try to resolve it together.
You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens.