Privacy Statement
1. Who we are
Toddoo B.V. ("Toddoo", "we") runs the Toddoo platform: an online platform for exhibitions and events. Organisers use it to sell booths, products and services; exhibitors use it to book, order and manage their participation.
Toddoo B.V., Zekeringstraat 36B, 1014 BS Amsterdam, the Netherlands. Chamber of Commerce (KvK) number KvK number, VAT number NL864003377B01. Privacy questions: privacy@toddoo.com.
2. Our role: controller or processor
- Toddoo is the controller for your Toddoo account (name, email address, password, sign-in security), for our own invoices to our customers, and for keeping the platform secure.
- The event organiser is the controller for the data processed for its event: exhibitor company details, contact persons, orders, bookings, quotations and invoices the organiser sends through Toddoo. Toddoo processes that data on the organiser's behalf, under a data processing agreement. For questions about that data, contact the organiser of the event; we will help them answer you.
3. What data we process, why, and on what basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: name, email address, password (stored only as a secure hash), preferred language, profile photo (optional), job title (optional), mobile number (optional) | Create and run your account, sign you in, send account emails (verification code, password reset, invitations) | Contract (art. 6(1)(b)) |
| Company details: company name, address, website, email, phone, sectors, logo, contact persons, billing addresses, fiscal identity (legal name, VAT and registration number) | Take part in events, place orders and bookings, issue quotations and invoices | Contract; for invoices also a legal obligation (art. 6(1)(c)) |
| Orders, bookings, booths, quotations, invoices, credit notes and payment status | Deliver what was ordered, invoicing and bookkeeping | Contract; legal obligation (tax law) |
| Team membership and invitations: who belongs to an exhibitor or organiser team, their role, invitations sent and accepted | Let a company give its people access to an event portal | Contract; legitimate interest of the company that invites you (art. 6(1)(f)) |
| Security and usage logs: time, the action or page used, success or failure, session and request identifiers, your member id, sign-in attempts | Keep the platform secure (e.g. limit password guessing), find and fix errors, prove what happened in case of a dispute | Legitimate interest (security and reliability) |
| Change history: which record was changed, when, by whom (passwords and secret links are never stored in it) | Audit trail for orders, invoices and settings | Legitimate interest; legal obligation for financial records |
| E-invoicing data: invoice contents and the buyer's electronic address (Peppol) | Deliver invoices electronically where the buyer or the law requires it | Contract; legal obligation where e-invoicing is mandatory |
| Messages you send through the platform (e.g. to an organiser) and files you upload | Deliver the message or file to the person it is meant for | Contract |
We do not sell personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing. The platform no longer collects gender or date of birth at sign-up; decide whether to delete these fields for existing accounts.
4. Who receives data
- The organiser of an event you take part in, and the people in your own company team.
- Service providers that work for us under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Scaleway SAS (from the move; today Akamai/Linode) | Hosting, database and file storage | EU (France / the Netherlands) |
| AhaSend (today Brevo) | Sending platform emails | EU |
| Storecove | Sending and receiving e-invoices over the Peppol network | location and transfer basis |
| OpenAI | Matching duplicate company records: a company's name, country and website are turned into a search vector. No contact persons are sent. Keep, replace with an EU/self-hosted model, or remove? | USA, under the EU–US Data Privacy Framework / Standard Contractual Clauses confirm |
| Adobe (Adobe Fonts / Typekit) | Loading the EA Exhibitions brand font (IvyEpic) in the EA console; your browser contacts Adobe directly, which shows Adobe your IP address | USA / worldwide, under the EU–US Data Privacy Framework confirm |
| OpenStreetMap Foundation (map tiles) and Cloudflare (cdnjs, script libraries) | Showing venue maps and loading some editor and export libraries; your browser contacts them directly, which shows them your IP address | UK / worldwide or self-host these files |
Sign-in is run on our own infrastructure (no third-party sign-in provider receives your password). We share data with authorities only when the law requires it.
5. Transfers outside the EU
We keep data in the European Union where we can. Where a provider is outside the EU/EEA, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
6. How long we keep data
| Data | Retention |
|---|---|
| Invoices, credit notes and the records behind them | 7 years after the end of the financial year (Dutch tax law) |
| Your account | As long as you have an account; deleted or anonymised 30 days after you ask, except data we must keep by law |
| Event data (orders, bookings, team membership) | As long as the organiser needs it for the event and its follow-up, then deleted or anonymised as agreed with the organiser default period |
| Security and usage logs | 12 months |
| Password reset links and sign-up codes | Valid for 60 and 30 minutes; usable once |
7. Cookies and local storage
We use only what the platform needs to work: a session cookie that keeps you signed in, a security token against cross-site requests, and a setting in your browser that remembers light or dark mode. We do not use analytics or advertising cookies, so we do not ask for cookie consent. Revisit if analytics are added.
8. Security
Passwords are stored only as secure hashes. Sign-in attempts are limited, password reset links work once and expire, and sessions are renewed at sign-in. Connections are encrypted (HTTPS). Access to production data is limited to the people who need it. If a data breach is likely to affect you, we inform the Dutch Data Protection Authority and, where required, you.
9. Your rights
You may ask us to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. Where processing relies on consent, you may withdraw it at any time. Send your request to privacy@toddoo.com; we answer within one month. For data an organiser controls (section 2), we pass your request on to the organiser.
You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl.
10. Changes
We may update this statement. The date at the top shows the latest version; for important changes we notify account holders by email.