Privacy Policy

Privacy Notice

Updated as of 11-03-2026

1. When does this privacy statement apply?

This Privacy Statement is applicable to the processing of personal data in the context of:

• Visiting our website (https://www.restaurants.toqan.ai/- the Toqan Website/the Website);

• Your engagements with Toqan;

• Your interactions with the MIH AI BV (we/us) in the context of support and deployment of Toqan.

For interactions or engagements with Prosus (for e.g., if you choose to attend an event organized by Prosus in relation to Toqan), please refer to the Prosus Privacy Statement available at www.prosus.com/privacy

Use of Toqan is subject to the Terms of Use including the Toqan Fair Use Policy.

This Privacy Statement may be changed over time. The most up-to-date Privacy Statement is published on the Website. This Privacy Statement was last changed on 13-03-2026.

2. Who is responsible for your personal data?

MIH AI BV, a company of the Prosus Group, is the controller responsible for processing personal data in relation to Toqan. This Privacy Statement provides you with the information on what personal data we may collect, for which purposes and under which legal grounds, as well as whom may have access to your personal data.

We collect your personal data:

• Directly from you, when you become a Toqan user;

• If you register for and attend events organised by us;

• Through your engagements with Toqan when you interact with the product and services, including when connecting Toqan with any application of your choosing;

• Through your visits to the Toqan Website; this also includes the use of cookies to support technical aspects of the website. For more information, please consult our Cookie Notice.
  
  

3. For which purposes do we process your personal data?

3.1. To operate, maintain and improve Toqan

I. What does this purpose entail?

When you use Toqan, we process your personal data for the following purposes:

• To enable access to Toqan. This also includes processing personal data to manage our relationship with customers and to complete due diligence processes when required;

• To allow users to connect applications of their choosing with Toqan and processing related content data;

• To detect potential misuse of Toqan in violation of the Toqan Fair Use Policy. This is done via automated systems without the use of human review;

• Analytics on the usage of Toqan features, and to conduct further research to evaluate how Toqan is used;

• To improve Toqan in the following ways:
  
  - The ability to respond to messages in the same thread/channel
  - Personalisation of certain product features (e.g., through user feedback to Toqan responses)
  - To maintain Toqan agents; custom versions of Toqan that perform specific tasks. In this context, personal data may be processed for the following additional purposes:
  - To enable agents to access and perform actions on applications or files that a user chooses to give access to via integration or file upload
  
  

• To respond to user queries, troubleshooting and other forms of providing technical support.

Personal data will not be used to train or improve any third-party AI large language models. Further, we will not process personal data in the context of Toqan for any personalised advertising.

II. On what legal ground do we process personal data for this purpose?

We process your personal data whilst using Toqan either (i) for the performance of a contract to the extent the processing is indispensable to enable your access and use of Toqan; (ii) based on our legitimate interest to improve Toqan; (iii) to comply with applicable legal obligations and/or enforceable governmental requests. Where we process your personal data based on our legitimate interest, we have conducted a legitimate interest’s assessment to ensure that our legitimate interest are not overridden by your interests or rights and freedoms.

III. Which personal data do we process for this purpose?

We process the following categories of personal data in the context of your use of Toqan:

• Username, email address, affiliation (employing company);

• Content of your engagements (prompts) with Toqan, including any files, pictures, videos, web searches generated along with specific user feedback to the generated output;

• Usage and performance metrics, including frequency and duration of use of Toqan;

• Other types of feedback and details of support queries;

• Authentication data for any applications you wish to integrate with Toqan, for access control purposes;

• Any personal data contained within files, databases and repositories that you choose to give Toqan access to when using certain features;

• For agents:
  
  - Any personal data contained within any files directly uploaded to the agent, or within any applications, files, databases, repositories or other systems a user may choose to give their agent access to. 

IV. For what period do we retain your personal data for this purpose?

Your data will be retained for only as long as necessary to provide our services to you, or for other legitimate business purposes such as safety and security reasons or complying with our legal obligations. You can always delete your data on request.

4. Who has access to your personal data?

4.1 Access to your personal data within the Prosus Group

As a global company, data we collect may be transferred internationally. Your personal data may be exchanged with the parent company of MIH AI BV, i.e., the Prosus Group located in the Netherlands, as well as with other entities within the Prosus Group, including its affiliates and subsidiaries, which you can view here. Where this entails an international data transfer outside the European Economic Area, the transfer shall take place in accordance with applicable data privacy requirements, particularly, when transferred to a non-adequate country, in conformity with the European Commission Standard Contractual Clauses (SCCs) (. You may request access to our SCCs, by contacting your Toqan representative. 

Employees in the group are authorised to access your personal data only to the extent necessary to serve the applicable purposes we describe above and to perform their jobs.

4.2 Access to your personal data by our suppliers

If the nature of services provided by our suppliers requires access to your personal data, we will take the appropriate contractual, technical and organisational measures, in line with our SOC 2 Type II and ISO 27001 commitments, to ensure that your personal data is securely processed only to the extent that this processing is necessary for the provision of such services.

If such third parties act under our instructions (as data processors), we enter into an agreement with such data processors and include obligations to ensure that your personal data is processed by the data processor solely to provide products or services to us.

5. How is your personal data secured?

Toqan is SOC2 Type II and ISO27001 compliant. We have taken adequate safeguards to ensure the confidentiality and security of your personal data. We have implemented appropriate technical, physical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access as well as all other forms of unlawful processing (including, but not limited to, unnecessary collection) or further processing.

6. Retention of your personal data

Your personal data will be retained only for as long as necessary to provide our services to you, to comply with applicable legal retention obligations, or for other legitimate business purposes, such as ensuring safety, preventing fraud, and enforcing our Fair Use Policy and Terms and Conditions.

Retention periods for your personal data depends on the type of data, how we use it, and also your settings.

7. Your rights

Under applicable data protection and privacy laws, you may have the right to:

• Access your personal data.
  You may ask us whether we process any personal data that relates to you. If this is the case, you may ask us to provide you with a copy of the personal data we process of you insofar as required by applicable data protection laws.
  
  

• Correct and erase your personal data.
  You may request that we correct any inaccurate personal data we process about you. Also, you may ask us to erase the personal data that relates to you if it is no longer necessary for the purposes for which we processed them, if your personal data have been unlawfully processed, or if your personal data must be erased following applicable EU or EU Member State laws.
  
  

• Object to processing your personal data.
  You may object to our processing of your personal data based on our legitimate interest. We will then no longer process your personal data for this purpose, unless we have an overriding legitimate interest to do so. You may also ask us to erase your personal data, unless there is an overriding legitimate interest for the processing.
  
  

• Data portability.
  Where applicable, you may request the receipt or transmission to another organisation in a machine-readable form, of the personal information that you have provided to us.
  
  

• Lodge a complaint with the appropriate Data Protection authority.
  If you feel that we do not comply with the applicable data protection and privacy laws, you have the right to lodge a complaint with your local supervisory authority. In the Netherlands this would be the Autoriteit Persoonsgegevens.

  
  

• Restrict the processing of your personal data.
  You may request restriction of the processing of your personal data where you contest its accuracy, where the processing is unlawful but you oppose erasure, where you require the data for legal claims, or where you have objected to processing based on our legitimate interest pending our verification.

How to exercise your data protection rights.

If you would like to exercise any of your data protection rights, please contact your Toqan representative. Your request should contain a description of the personal data you want to access to and/or other right you want to exercise. You will need to provide us with information that allows us to authenticate your identity, as appropriate. 

8. Contact information and changes to this privacy statement

Should you have any questions regarding the processing of your personal data, or if you want to exercise any of your individual rights, please reach out to your Toqan representative.