Privacy policy

The controller of this website is the operator identified in the legal notice, which also provides contact details.

Providing the website

When you visit this website, technical connection data such as your IP address, time, requested URL and browser/device information is transmitted to the hosting infrastructure involved. This is necessary to deliver content and operate the website securely. The legal basis is Article 6(1)(f) GDPR (legitimate interest in a secure, functioning website).

Necessary storage and chosen preferences

Your optional analytics decision is stored in the “tomato.website-consent” cookie for 180 days, without assigning a visitor ID. After you explicitly select a language or colour scheme, we store “tomato.locale” and “tomato.ui-theme” as cookies for one year and in local storage without automatic expiry. No new language or theme preferences are stored without a selection. You can remove these entries in your browser settings. Storage implements your decision and settings you requested (Section 25(2)(2) TDDDG); to the extent personal data is processed, the basis is Article 6(1)(f) GDPR.

Optional analytics with Vercel

Only with your consent do we load Vercel Web Analytics (visitor statistics) and Vercel Speed Insights (loading times and performance metrics). Visited URLs, referrers, time, browser/device characteristics and technical performance data may be transmitted to Vercel; your IP address is involved in transmission. Vercel describes Web Analytics as cookieless measurement using a short-lived identifier derived from request data. Cookieless does not mean no data processing. The legal bases are Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. Without consent both services remain off, including in editorial blog previews.

Withdrawal and changes

Use “Cookie settings” in the footer at any time to change or withdraw consent for the future. The page then reloads completely to remove previously loaded measurement scripts. Withdrawal does not affect the lawfulness of processing before withdrawal. We ask again after 180 days or after you delete the decision.

Blog and editorial preview

Blog content is provided using Sanity. Published text is fetched on the server; images are delivered through the website image optimiser. The separate Sanity Studio is an editorial tool. Protected draft previews use additional temporary security cookies, including “tomato_blog_preview” (one hour) and the Next.js Draft Mode cookie. These are necessary for the requested preview and are removed when you exit preview.

Contacting us

If you use our contact form, we process your information to handle and answer your enquiry. Please do not submit confidential model data or credentials. The legal basis is Article 6(1)(b) GDPR for contractual enquiries, otherwise Article 6(1)(f) GDPR (responding to enquiries). Data is needed only for handling the enquiry and any applicable statutory retention obligations.

Recipients and international processing

Vercel is involved in technical delivery and optional measurement; Sanity provides blog content. These services may involve processing outside the EU/EEA. The provider notices linked below give additional information on data categories, retention and international processing. This page covers the public website, not all processing within the TOMATo application.

Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests. You may withdraw consent at any time for the future and lodge a complaint with a data protection supervisory authority. For requests, use the contact details in the legal notice.

Last updated: 26 October 2026