At Tomatovation, we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, share, transfer and store your information when you interact with us through our website.

Introduction

Tomatovation is an IT company with teams in the Czech Republic, India and the United States. We understand that you need to know how your information is handled, so we have written this Privacy Policy to explain our practices in plain language.

Who We Are

The company responsible for the personal data described in this policy (the “data controller”) is:

• Legal entity: Tomatovation Private Limited, a company incorporated under the Companies Act, 2013
• Country of incorporation: India
• Corporate Identity Number (CIN): U62099GJ2026PTC180101
• Contact, including for privacy questions: privacy@tomatovation.com / info@tomatovation.com

Purpose

We are committed to following the data protection laws that apply to us. As a company established in India, we are a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023. Where we offer our services to people in the European Economic Area, the EU General Data Protection Regulation (GDPR) also applies to us. This policy applies across all Tomatovation teams and is based on globally recognised data protection principles: we collect only the data we need, use it only for clear purposes, keep it accurate and secure, and delete it when it is no longer needed.

This policy also sets out the responsibilities of our employees, vendors and other third parties when they collect, use, store, transfer, disclose or delete personal data.

“Personal data” means any information that relates to an identified or identifiable person, such as a name, an email address or an IP address. Our leadership is committed to enforcing this policy, and anyone who breaches it may face disciplinary action or the end of their contract.

Scope

This Privacy Policy describes how Tomatovation uses your personal data when you interact with our website. Here we act as a data controller, which means we decide why and how your data is used.

When we deliver projects for our clients, we often handle personal data on the client’s instructions. In those cases the client is the controller and we act as a data processor under our contract with them. That processing is governed by the client’s own privacy notice and by our agreement with them, not by this policy.

This policy does not cover the practices of third parties whose links appear on our site. We recommend that you read their privacy policies to understand how they handle your personal data.

In this policy, “you” and “your” refer to individuals using our website. “We”, “us” and “our” refer to Tomatovation.

What Personal Data Do We Collect?

We collect the following personal data:

• Contact details: your name, email address, phone number and company name, when you fill in the contact form on our website.
• Enquiry information: the service you are interested in and the message you send us, along with the date of the enquiry and the page it was sent from.
• Job applications: if you apply through our Careers pages, the details you enter in our application form — your contact details, location, experience, current employer, links to your CV and professional profiles, your availability and any compensation expectations you choose to share. These forms are hosted on our own website and the entries are stored in our own database.
• Files and links you send us: if you share a link to your CV, or attach a document to an email, we receive that file or document and the information in it.
• Account information: usernames, passwords and account preferences for the internal admin area of our website. These accounts are for Tomatovation staff only; visitors to the website do not create accounts.
• Technical and device data: your IP address, browser type and version, operating system, device type, the pages you request, the page that referred you, and the dates and times of your visit.
• Server logs: our web server and hosting provider automatically keep access and error logs that contain the technical data above. We use them to run, troubleshoot and secure the website, not to identify you.
• Communications: the emails, phone calls and messages you exchange with us.
• Blog images: the cover images on our blog are delivered by an external image provider, which receives your IP address and browser information when you read a blog post.
• Cookies and similar technologies: see the section “Cookies and Tracking Technologies” below.

Please do not send us sensitive information, such as health data, religious beliefs or government ID numbers, unless we specifically ask for it.

Cookies and Tracking Technologies

Current status: our website sets only strictly necessary technical cookies essential for security, load balancing, and secure session operation. We do not use third-party advertising cookies or cross-site commercial tracking scripts. We verified this on 26 October 2026 by inspecting the live website environment.

Before any non-essential cookie (such as functional, preference, or analytics cookies) is placed on your device, we will:

• Present a cookie consent banner that offers explicit options to accept, customise, or reject non-essential cookies;
• Ensure rejecting non-essential cookies is as simple as accepting them;
• Block non-essential cookies by default until explicit affirmative consent is received;
• Record consent preferences securely and allow you to update or withdraw choices at any time;
• Update this policy, its version number, and its effective date accordingly.

Categories of cookies used or planned, together with our full consent framework, are set out in our Cookie Policy. You can also manage or block cookies through your web browser settings. Note that disabling strictly necessary cookies may affect website functionality.

How Do We Use Your Personal Data?

We use your personal data to:

• Provide, maintain, and improve our services;
• Reply to your enquiry and communicate with you about updates, support, and your questions;
• Send you an automatic email confirming that we received your message;
• Consider your job application;
• Run, troubleshoot, and secure our website; and
• Meet our legal obligations and defend legal claims.

Legal Basis for Processing

• Consent (GDPR Article 6(1)(a) / DPDP Act 2023): when you provide us with your data voluntarily, for example by submitting a contact or careers form.
• Contractual necessity (Article 6(1)(b)): to take steps at your request before entering into a contract, and to fulfil service agreement obligations.
• Legitimate interests (Article 6(1)(f)): for administrative purposes, responding to enquiries, and keeping our platform secure.
• Legal obligation (Article 6(1)(c)): to comply with statutory laws, tax regulations, and regulatory demands.

Where we rely on consent, you may withdraw it at any time. We do not sell or rent your personal data.

How Do We Keep Your Personal Data Secure?

At Tomatovation, we treat the confidentiality and security of your personal data as a priority. We use physical, technical, and organisational security measures to protect your information from unauthorised access, loss, or misuse:

• Secure connections: encrypted HTTPS (TLS 1.3) across all web channels.
• Access control and MFA: role-based access control on a least-privilege basis, and multi-factor authentication for authorised personnel.
• Incident management: incident response procedures aligned to SOC 2 / ISO 27001 standards. If a data breach affecting your rights occurs, we notify competent authorities and affected individuals within statutory timeframes, for example 72 hours under GDPR.

For Minors

Our website and services are intended for businesses and professionals and are not directed at children. We do not knowingly collect personal data from children under applicable legal ages (18 in India, 16 in the EEA, and 13 in the US). If a minor has provided us with personal data, a parent or guardian should contact us at info@tomatovation.com for prompt deletion.

How Do We Share and Disclose Your Personal Data?

We do not sell or rent personal data. We share data strictly on a need-to-know basis with:

• Authorised team members: staff handling your enquiries or job applications.
• Service providers (processors): cloud databases, hosting providers, authentication services, and mail delivery tools bound by data processing agreements.
• Professional advisers and legal authorities: auditors, legal counsel, or government authorities when required by law or court order.

International Data Transfers

Tomatovation Private Limited operates globally with primary operations in India, supporting clients in the EEA and the US. For international data transfers, we rely on standard legal safeguards including European Commission Standard Contractual Clauses (SCCs), technical encryption (TLS 1.3 / AES-256), and access controls.

How Long Do We Store Your Personal Data?

We retain personal data only as long as necessary:

• General enquiries: retained up to 24 months after last contact.
• Client records: retained for the duration of the business relationship plus 8 financial years, as mandated by Indian Companies and Tax Acts.
• Job applications: retained for 6 months post-recruitment, or 24 months with consent for future roles.
• Server logs: retained up to 30 days for security analysis, after which data is purged or anonymised under our Data Return & Deletion Policy (TVT-HR-011).

What Rights Do You Have?

Depending on your jurisdiction, you have rights to access, correct, erase, restrict, object to processing, or port your data, as well as to withdraw consent.

To exercise these rights, email info@tomatovation.com, or privacy@tomatovation.com for data protection matters. We respond within 30 days, or 90 days for Indian DPDP Act grievances.

Contact Us

If you have any questions or concerns regarding this Privacy Policy, or if you wish to exercise your data protection rights, please contact us at info@tomatovation.com or visit our contact page.