Privacy Policy

1. Introduction

This Privacy Policy explains how TOCA Method (operating tocamethod.com) collects, uses and protects personal data when you visit this website or interact with our services. It applies to all visitors and is written to comply with the EU General Data Protection Regulation (GDPR / RGPD) and applicable French law.

We believe in collecting as little personal data as possible — only what's necessary to run the site, answer your messages and let you book the TOCA Method Paris intensive.

2. Data controller

The data controller for the personal data processed via this site is the operator of TOCA Method. For all data-related requests, contact us at the addresses listed in Contact below or on the Legal notice page.

3. Data we collect

3.1 Data you provide directly

• Contact data — when you message us via WhatsApp, Instagram DM or email to register or ask a question: name, phone number, social handle, message content.
• Booking data — when you secure a spot for an event: name, email or phone, dance level, partner information you choose to share.

3.2 Data collected automatically

• Technical logs — IP address, browser type, OS, pages visited, referrer, timestamp. Collected by our hosting provider for security and reliability.
• Cookies — see our Cookies policy for the full list. We use essential cookies by default and load anonymous analytics only if you consent.

4. Purposes & lawful basis

We process your data for the following purposes, on the following legal bases under Article 6 GDPR:

• Responding to your messages and bookings — basis: performance of a contract (or pre-contract steps at your request).
• Operating, securing and improving the website — basis: legitimate interest.
• Analytics (if enabled) — basis: consent, which you can give or withdraw via the cookie banner.
• Complying with legal obligations — basis: legal obligation (e.g. accounting, tax records).

5. Sharing & processors

We do not sell your personal data. We share it only with processors that help us run the site and the event, including:

• Hosting provider — server logs and storage (see Legal notice for the host's identity).
• Messaging platforms — Meta (WhatsApp, Instagram) when you choose to contact us through them. Their own privacy policies apply.
• Analytics provider — only if you consent. Anonymous, aggregated data.

Data may be transferred outside the EU when a processor's infrastructure requires it. We rely on Standard Contractual Clauses or equivalent safeguards for any such transfer.

6. Retention

• Inquiry & booking data — kept for the duration of our relationship plus up to 3 years for follow-up communication.
• Accounting records — kept for 10 years where required by French law.
• Web logs — typically 6 to 12 months.
• Consent records — kept for as long as your choice is in effect, plus a short period for evidence.

7. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten") where applicable.
• Restrict or object to processing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time (without affecting prior lawful processing).
• Lodge a complaint with the French data protection authority — CNIL (cnil.fr).

To exercise any of these rights, contact us at contact@tocamethod.com. We respond within one month.

8. Cookies

We use a small number of cookies. See the dedicated Cookies policy for the full list and to change your preferences at any time. You can also reopen the cookie banner from the footer of any page.

9. Security

We use HTTPS everywhere on the site, secure headers (HSTS, CSP, X-Frame-Options, etc.) and limit access to personal data to people who need it to operate the service. No system is perfect, but we work to keep yours safe.

10. Changes to this policy

We may update this policy when our practices change. The "last updated" date at the top reflects the current version. Material changes will be flagged on the homepage or by direct notice.

11. Contact