Website Privacy & Cookie Notice

1. Introduction

Token GmbH and Token.io Ltd (hereinafter referred to as “Token.io”, “we”, “our”, “us”) are always aware of the importance of the data entrusted to us.

The responsible handling, confidentiality and protection of your data is therefore of particular importance to us.

The Processing of your personal data is carried out exclusively within the framework of the statutory provisions, the applicable data protection law and this privacy Notice.

This Privacy Notice informs you which personal data is processed via our website, https://token.io/ (“website”; “Token.io website”).

2. Purpose of this Privacy & Cookie Notice

This privacy and cookie notice aims to provide you information on how Token.io collects and processes your personal data when you use this website, when you contact us or subscribe to our marketing services.

We ask you to take note of this privacy and cookie notice, alongside any other policies published on our website, which outlines the data we collect about you, so you’re fully informed and aware of how and why we are using your data.

This privacy and cookie notice supports and supplements other notices published on our website and is not intended to override them.

3. The subject of data protection

The subject of data protection is personal data. Individual specifications about the personal or objective relationships of a defined or definable natural person. Personal data is, therefore, information that can be used to draw conclusions about an identified or identifiable natural person. In principle, all information about which a personal reference can be established also falls under the concept of personal data. For example, a person’s name, address, e-mail address, telephone number, personnel number, vehicle registration number plate, appearance, or gait are all personal data. Furthermore, usage data also has a personal connection. Usage data means data that is required to use our website. This includes, for example, information about the start, end, and scope of your use.

4. Controller/Contact

Token.io are the Data Controller for information gathered by your use of our website and marketing services and responsible for this subset of your data.

As Token.io has operating subsidiaries across Europe, there are different supervisory authorities based on your location and therefore the contact information may vary; please see Section 4 ‘Contact Details’.

5. Contact Details

Full Name of Legal entities: Token GmbH and Token.io Ltd

Email: privacy@token.io

Postal Addresses:

Token GmbH, c/o Industrious, Schicklerstraße 5, 10179 Berlin

Token.io Ltd, 4th Floor, 70 St Mary Axe, London, England, EC3A 8BE

ICO Registration Number: ZA314995

BaFin Registration Number: 10158595

Token.io Ltd are registered with the Information Commissioner's Office (ICO) and Token GmbH are registered with Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin), and you have a right to make a complaint at any time to the supervisory authority where you live, work or believe a breach has occurred.

We would, however, appreciate the opportunity to manage your concerns directly, so please do contact us at the outset at privacy@token.io

6. Scope of personal data processing

We only process the personal data of our users if this is necessary to provide a functional website. Collection and utilisation of our users’ personal data is only undertaken periodically with the user’s consent.

An exception applies in those cases where prior consent cannot be obtained for legal or factual reasons and where the processing of the data is permitted by law.

7. The Data we collect about you

Type of interaction	Data Captured	Purpose of Processing	GDPR / Data Protection Act / BaFin reference	Retention Period	Objection & Removal Option
Automated Data Collection	Date and time of access ⁃ Browser type/version ⁃ Operating system used ⁃ Resource retrieved ⁃ Quantity of data transmitted ⁃ The user’s IP address	The data is stored in log files to ensure the website’s functionality. The data is also used to optimise the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes is undertaken in this context.	Art. 6 Para. 1 lit. f GDPR (EU) - Legitimate interest of allowing the website to function for the users purpose.	As soon as no longer necessary and after 31 days as a maximum timeframe.	No, as the collection of data for this purpose is necessary for the operation of the website.
Direct contact by you (Webforms)	⁃ Email Address ⁃ Name ⁃ Phone number Any other personal information you provide to us as part of your communication via our webforms.	Due to legal regulations, the Token.io website contains information that enables quick electronic contact to our company, in particular a general e-mail address. Such personal data transmitted to us on a voluntary basis will be stored for the purposes of contacting or dealing with the matter for you.	Art. 6 para. 1 lit. a GDPR (EU) - Implied Consent as you have asked us to contact you and willingly provided us this information.	After 5 years of no contact	Yes - A user who has contacted us by email/our webforms can object at any time to the storage of his or her or their personal data. It will not be possible to continue the conversation in this case.
Direct contact by you (Webforms)	⁃ Email Address ⁃ Name ⁃ Phone number Any other personal information you provide to us as part of your communication via our webforms.	The data is stored in log files to ensure the website’s functionality. The data is also used to optimise the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes is undertaken in this context.	Art. 6 Para. 1 lit. f GDPR (EU) - Legitimate interest of allowing the website to function for the users purpose.	After 5 years of no contact	No, as the collection of data for this purpose is necessary for the operation of the website.
Token Newsletter	⁃ Email address ⁃ Name	Token.io informs business partners at regular intervals by means of a newsletter about company news and insights. Data processing in connection with this activity is only done if you have given your explicit consent to receive marketing information. We save this information in our CRM platform, HubSpot.	Art. 6 Para. 1 lit. a GDPR (EU) - You have provided us explicit consent to process your information in order to receive this letter.	The user’s email address will therefore be stored as long as the subscription to the newsletter has not been revoked.	Yes - a user can revoke consent at any time.
Customer Due Diligence	Publically available company information.	To carry out initial due diligence on prospective customers to ensure they are within Token’s risk appetite levels.	Art 6. Para 1. Lit C. - Compliance with legal obligations for companies on anti-money laundering.	5 years	No - records need to be kept and maintained to comply with anti-money laundering regulations.

8. Third Party Sub-Processors

Token.io may share your personal data with one of the following 3rd Parties solely for the purpose of providing you with functioning services.

Token.io ensures GDPR compliance with these processors by having standard contractual clauses and data processing agreements with all parties.

Processor	Description	Location of Services
AWS	Cloud computing infrastructure to support the successful operation of Token	European Economic Area
Hubspot	Customer Management system used to store sales information, customer insights and marketing preferences.	United States of America
Microsoft	Productivity and analytics suite used across the business for communication, document creation, collaboration, data analysis, reporting, forecasting.	European Economic Area
Google	Cloud-based productivity suite (G Suite) used for communication, day-to-day operations, shared document management and team coordination across the business.	The United States of America and European Economic Area
Zendesk	Customer communication tool used to respond to queries, complaints, issues with customers to ensure correct running of Token services	The United States of America
Slack	Internal communication tool used for cross-department coordination to ensure correct running of Token services	The United States of America and Ireland
Atlassian	Customer communication tool used to respond to queries, complaints, issues with customers to ensure correct running of Token services	Ireland
Signicat	Anti-Money Laundering relevant checks	United Kingdom of Great Britain and Northern Ireland
Matomo	Cookieless Website Tracking/Webapp Tracking	European Economic Area
Payever GmbH.	Only Applicable for payments from Shop systems such as Shopify, Woo Commerce & others.	Germany
Modulr	Only applicable for Settlement Account Services	European Economic Area
CreditSafe	Anti-Money Laundering relevant checks	European Economic Area
Sage	Financial management and accounting system used to support core finance operations, including invoicing and reporting	European Economic Area
Draftspotting	Cloud‑based Contract Lifecycle Management (CLM) platform	The Netherlands

9. International Transfers

Information captured on our website may be stored in our internal systems or within our databases, solely for the purposes mentioned above.

Some of our providers have support services outside of the European Economic Area (EEA), however, they are covered by an Adequacy Decision, which states that the level of protection is comparable to that of the European Union so no additional protocols are required for this data transfer.

All of Token.io’s processors have clearly defined contractual requirements on their roles and responsibilities in processing this data. This is captured in Art. 45 Para. 1 GDPR (EU).

10. Cookies

What are Cookies?

Cookies are small text files that make it possible to store specific device-related information on the user’s device.

On the one hand, they serve the user-friendliness of websites and thus the users.

On the other hand, they serve the collection of statistical data for the use of the website and analysis of these for the purpose of improving the offer.

The user can control the use of cookies. Most browsers have an option which limits or completely prevents storage of cookies.

What Cookies does Token.io use and why?

We use cookies across our site to help improve its performance, to enhance the user experience and to support some key site functionality.

Necessary - Necessary cookies are crucial for the basic functions of the website and the website will not work in its intended way without them. These cookies do not store any personally identifiable data. These cookies are opt-out.

Functional - Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collecting user feedback, and other third-party features. These cookies are opt-in.

Analytics - Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc. These cookies are opt-in.

Performance - Performance cookies are used to understand and analyse the key performance indexes of the website, which helps in delivering a better user experience for the visitors. These cookies are opt-in.

Advertisement - Advertisement cookies are used to deliver visitors with customised advertisements based on the pages they visited before, and to help analyse the effectiveness of advertising campaigns.

The user data collected in this way is pseudonymised via technical provisions. It is therefore no longer possible to assign the data to the accessing user.

The data is not stored together with users’ other personal data.

When accessing our website, users are informed by an information banner on the use of cookies for analytical purposes and referred to this data protection declaration. A note is also included in this context as to how the user can disable the storage of cookies in the browser settings.

Third-Party Cookies

By using some areas of our website, ‘Necessary’ Cookies may be stored that are not controlled by us; this is usually when that particular part of the website makes use of third-party analytics or technical tools such as load balancing.

Cookie Identifier	Purpose	Duration
Necessary Cookies
__hssrc	This cookie is set by HubSpot whenever it changes the session cookie. The __hssrc cookie set to 1 indicates that the user has restarted the browser, and if the cookie does not exist, it is assumed to be a new session.	Session
CRAFT_CSRF_TOKEN	This cookie is set by the provider Craft CMS. This cookie is used for the purpose of website security that is Cross-Site-Request forgery prevention whenever a form is used.	Session
cookieyesID	CookieYes sets this cookie as a unique identifier for visitors according to their consent.	1 year
cky-consent	The cookie is set by CookieYes to remember the users' consent settings so that the website recognises the users the next time they visit.	1 year
cookieyes-necessary	CookieYes sets this cookie to remember the consent of users for the use of cookies in the 'Necessary' category.	1 year
cookieyes-functional	CookieYes sets this cookie to remember the consent of users for the use of cookies in the 'Functional' category.	1 year
cookieyes-analytics	CookieYes sets this cookie to remember the consent of users for the use of cookies in the 'Analytics' category.	1 year
cookieyes-performance	CookieYes sets this cookie to remember the consent of users for the use of cookies in the 'Performance' category.	1 year
cookieyes-advertisement	CookieYes sets this cookie to remember the consent of users for the use of cookies in the 'Advertisement' category.	1 year
cookieyes-other	CookieYes sets this cookie to remember the consent of users for the use of cookies in the 'Other' category.	1 year
cky-action	This cookie is set by CookieYes and is used to remember the action taken by the user.	1 year
AWSALBCORS	This cookie is managed by Amazon Web Services and is used for load balancing.	7 days
__cfruid	Cloudflare sets this cookie to identify trusted web traffic.	Session
Performance Cookies (not mandatory)
_gat	This cookie is installed by Google Universal Analytics to restrain request rate and thus limit the collection of data on high traffic sites.	1 minute
AWSALB	AWSALB is an application load balancer cookie set by Amazon Web Services to map the session to the target.	7 days
Analytics Cookies (Not mandatory)
_dc_gtm_UA-62082987-	The _dc_gmt_UA-62082987-1 cookie, installed by Google Tag Manager, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.	1 minute
_ga	The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.	1 yr 1 month 4 days
_gid	Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously.	1 day
__hstc	This is the main cookie set by HubSpot, for tracking visitors. It contains the domain, initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session).	5 months 27 days
hubspotutk	HubSpot sets this cookie to keep track of the visitors to the website. This cookie is passed to HubSpot on form submission and used when deduplicating contacts.	5 months 27 days
sid	The sid cookie contains digitally signed and encrypted records of a user’s Google account ID and most recent sign-in time	Session
_gat_gtag_UA_*	Google Analytics sets this cookie to store a unique user ID.	1 minute
_ga_*	This cookie is provided by Google Tag Manager to experiment advertisement efficiency of websites using their services.	1 year 1 month 4 days
_gcl_au	This cookie is provided by Google Tag Manager to experiment advertisement efficiency of websites using their services.	3 months
ln_or	Linkedin sets this cookie to register statistical data on users' behaviour on the website for internal analytics.	1 day
Functional Cookies
UserMatchHistory	LinkedIn sets this cookie for LinkedIn Ads ID syncing.	1 month
bcookie	LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognise browser ID.	1 year
lidc	LinkedIn sets the lidc cookie to facilitate data center selection.	1 day
__hssc	HubSpot sets this cookie to keep track of sessions and to determine if HubSpot should increment the session number and timestamps in the __hstc cookie.	30 minutes
__cf_bm	This cookie, set by Cloudflare, is used to support Cloudflare Bot Management.	30 minutes
bscookie	LinkedIn sets this cookie to store performed actions on the website.	1 year
Advertisement Cookies (Not mandatory)
AnalyticsSyncHistory	LinkedIn sets this cookie for LinkedIn Ads ID syncing	1 month
li_gc	LinkedIn sets this cookie for LinkedIn Ads ID syncing.	5 months 27 days
YSC	YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages.	Session
VISITOR_INFO1_LIVE	A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface	5 months 27 days
yt-remote-device-id	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video.	Never
yt-remote-connected-devices	YouTube sets this cookie to store the video preferences of the user using embedded YouTube video.	Never
test_cookie	The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies	15 minutes
IDE	Google DoubleClick IDE cookies are used to store information about how the user uses the website to present them with relevant ads and according to the user profile.	1 year 24 days
Others (Not mandatory)
next-i18next	This cookie provides the functionality and management for the translation of multiple languages, enabling the localisation of content from web to mobile and desktop.	1 year
lightstep_guid%2Fdeveloper-portal-service	Lightstep sets this cookie to improve access and navigation for returning users of the developer portal (dashboard.sandbox.token.io)	7 days
lightstep_session_id	Lightstep sets this cookie to help web pages to load faster and improve navigation for returning users (dashboard.sandbox.token.io).	7 days
cf_clearance	Cloudflare sets this cookie for when CAPTCHA or Javascript challenge is solved such as for a Firewall Rule or IP Access Rule, a cf_clearance cookie is set in the client browser. cf_clearance specifies the duration our website is accessible to a visitor that successfully completed a previous Captcha or JavaScript challenge.	1 year

For all other types of cookie, you can see their use by visiting ‘Preferences’ on the Cookie Consent banner, where descriptions are provided for all cookie types, along with duration of storage.

What is the legal basis for the Cookies Token.io uses?

For necessary Cookies - The legal basis for processing personal data using cookies is Art. 6 para. 1 lit. f GDPR (EU). Legitimate interest of allowing the website to function for the users purpose.

For all other cookies - The legal Art. 6 Para. 1 lit. a GDPR (EU) as well as incorporated in the DPA 2018, Chapter 2, Article 6, A (UK) - You have provided us explicit consent to use these cookies by opting-in, either via the ‘preferences’ button on our banner or by choosing ‘accept all’ on our banner. Please ensure you have read and understood what each non-necessary cookie does before clicking ‘accept all’ so you are fully informed of which first and third party cookies are being used.

Duration of storage, objection and removal option

Cookies are stored on the user’s computer and transmitted to our site.

Therefore, as a user you have full control of the use of cookies.

By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies.

Cookies that have already been saved can be deleted at any time. This can also be done automatically.

Users can, for example, find information about how to manage Cookies in the most commonly used browsers at the following addresses:

⁃ Google Chrome

⁃ Apple Safari

⁃ Microsoft Internet Explorer

⁃ Microsoft Edge

If cookies are deactivated for our website, it may no longer be possible to use all of the website’s features in full.

11. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and DPA2018, and you have the following rights with respect to Token.io:

The right to be informed

As a data subject, you have the right granted by the European Directive and Regulator, UK law and other national data protection rights within the EEA to receive free information from Token.io about your stored personal data and a copy of this information at any time.

Furthermore, the European Directive and Regulator and other regulators have granted you, as the person concerned, access to the following information:

⁃ the purposes of processing;

⁃ the categories of personal data concerned;

⁃ the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;

⁃ where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

⁃ the existence of a right to rectification or erasure of the personal data concerning you or of a restriction of the processing by the person responsible or of a right to object to such processing;

⁃ the existence of the right to lodge a complaint with a supervisory authority;

⁃ where the personal data is not collected from the data subject, any available information as to their source;

⁃ the existence of automated decision-making, including profiling, in accordance with Article 22 Para.1 and 4, GDPR and as incorporated in the DPA 2018, Chapter 3, Section 49 and – at least in these cases – meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.

Furthermore, you have a right of access to information as to whether personal data has been transferred to a third country or to an international organisation. If this is the case, you have, in addition, the right to obtain information about the appropriate guarantees in connection with the transfer.

If you would like to make use of this right to information, you can contact us via privacy@token.io at any time.

The right of rectification

You also have the right, granted by the European legislator, UK law and other national data protection rights within the EEA to request the immediate rectification of inaccurate personal data concerning you. You also have the right, taking into account the purposes of the processing, to request the completion of incomplete personal data, including by means of a supplementary declaration.

If you would like to make use of this right to information, you can contact our privacy@token.io at any time.

The right to limitation of processing

You have the right, granted by the European legislator of directives and regulations, to require Token.io to restrict processing if one of the following conditions is met:

⁃ The accuracy of your personal information is contested by you for a period of time that allows us to verify the accuracy of your personal information.

⁃ The processing is unlawful, you refuse to delete the personal data and instead demand a restriction on the use of the personal data.

⁃ We no longer need the personal data for the purposes of processing, but you do need it to assert, exercise or defend legal claims.

⁃ You have objected to the processing pursuant to Art. 21 Para. 1 GDPR (EU) and as incorporated into the DPA 2018 Article 16 and 18 (UK) and it is not yet clear whether Token.io’s legitimate reasons outweigh yours.

If one of the above conditions is fulfilled and you wish to request the restriction of personal data stored by Token.io, you can contact us under privacy@token.io at any time.

Right to erasure

You also have the right, granted by the European legislator, UK law and other national data protection rights within the EEA, to require Token.io to delete your personal data immediately, provided that one of the following reasons applies and insofar as the processing is not necessary:

⁃ The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.

⁃ You revoke your consent on which the processing pursuant to Art. 6 Para. 1 Letter. A GDPR or Art. 9 Para. 2 Letter. A GDPR (EU) or as incorporated into the DPA 2018 Article 16, 18, 21 (UK) and there is no other legal basis for processing.

⁃ You submit an objection to the processing according to Art. 21 Para. 1, GDPR, and there are no overriding legitimate grounds for processing, or you submit an objection according to Art. 21 Para. 2 GDPR (EU) or as incorporated into the DPA 2018 Article 16, 18, 21 (UK) objecting to the processing.

⁃ The personal data has been unlawfully processed.

⁃ The personal data must be erased for compliance with a legal obligation under Union or Member State law to which the responsible person is subject.

⁃ The personal data concerning you has been collected in relation to services offered by the information society according to Art. 8 Para. 1 GDPR (EU) or as incorporated into the DPA 2018 Article 16, 18, 21 (UK).

If one of the above conditions is fulfilled and you wish to request your right to erasure, you can contact us under privacy@token.io at any time.

If the personal data has been made public by us and our company is responsible, pursuant to Art. 17 Para. 1 GDPR (EU) or as incorporated in the DPA 2018, Chapter 3, Section 47 (UK) to delete personal data, we will take appropriate measures, including technical measures, taking into account available technology and implementation costs, to inform other data processors who process the published personal data, that you have requested the deletion of all links to such personal data or of copies or replications of such personal data from those other data processors, where processing is not necessary. Our employees will do what is necessary in individual cases.

Right to data portability

You also have the right, granted by the European legislator, UK law and other national data protection rights within the EEA to receive the personal data concerning you that you have provided to Token.io in a structured, common and machine-readable format. You also have the right to transfer this data to another data controller without obstruction by Token.io, provided that the processing is based on the consent provided for in Art. 6 para. 1 Letter A GDPR or Art. 9 para. 2 Letter A GDPR or on a contract in accordance with Art. 6 para. 1 letter b GDPR or as incorporated in the DPA 2018 Chapter 3, Section 3 Article 20 and processing is carried out by means of automated procedures, except where processing is necessary for the performance of a task in the public interest or in the exercise of official authority conferred on the controller.

Furthermore, when exercising your right to data transferability pursuant to Art. 20 para. 1 GDPR, or as incorporated in the DPA 2018 Chapter 3, Section 3 Article 20 the right to require that the personal data is transmitted directly from Token.io to another responsible person, as far as technically feasible and provided that this does not affect the rights and freedoms of others.

To assert the right to data transferability, you can contact us under privacy@token.io at any time.

Right of appeal

You also have the right, granted by the European legislator, UK law and other national data protection rights within the EEA for reasons arising from your particular situation, to object at any time to the processing of personal data relating to you, which may be processed on the basis of Art. 6 para. 1 letters e or f GDPR or as incorporated in the DPOA 2018 Chapter 8, Article 77. This also applies to profiling based on these provisions.

Token.io no longer processes personal data in the event of an objection, unless we can prove compelling reasons worthy of protection for the processing, which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If Token.io processes personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data for the purpose of such advertising. This also applies to any profiling connected with such direct advertising. If you object to Token.io processing for direct advertising purposes, Token.io will no longer process your personal data for these purposes.

Furthermore, for reasons arising from your particular situation, you have the right to object to the processing of personal data concerning you which Token.io uses for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 para. 1 GDPR or as incorporated in the DPA 2018, Chapter 9, Article 89 unless such processing is necessary to fulfil a task in the public interest.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

To exercise your right of objection, you can contact privacy@token.io at any time.

Automated individual decision-making including profiling

You also have the right, granted by the European legislator, UK law and other national data protection rights within the EEA, not to be subject to a decision based exclusively on automated processing – including profiling – which has legal effect against you or which significantly affects you in a similar manner, provided that the decision (1) is not necessary for the conclusion or performance of a contract between you and Token.io, or (2) is admissible under Union or Member State legislation to which Token.io is subject and contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or (3) takes place with your express consent.

If the decision (1) is necessary for the conclusion or performance of a contract between you and us or (2) is made with your express consent, Token.io will take reasonable measures to protect your rights and freedoms as well as your legitimate interests, including at least the right to obtain the intervention of a person by Token.io, to state their own position and to challenge the decision.

If you wish to assert rights relating to automated decisions, you can privacy@token.io at any time.

Right to withdraw data protection consent

You have the right to revoke your consent to the processing of personal data at any time as granted by the European Directive and Regulator.

If you would like to exercise your right to revoke your consent, you can contact privacy@token.io at any time.

12. The right of appeal to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or where the infringement is suspected, if you believe that the processing of personal data that concerns you is in contravention of GDPR.

The supervisory authorities responsible for Token.io are:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

Alt-Moabit 59-61

10555 Berlin

Phone: +49 30 13889-0

Fax: +49 30 2155050

E-Mail: mailbox@datenschutz-berlin.de

The supervisory authority with which the appeal has been lodged shall inform the appellant of the status and results of the appeal, including the possibility of a judicial remedy under Art. 78 GDPR.

===============================

The Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

Phone +44 (0)303 123 1113

Last updated: October, 2024