Privacy & Data Protection Policy
EU General Data Protection Regulation (GDPR) & Transparency Notice
Last Updated: September 20261. Data Controller & Processor Roles
Your employer or subscribing company (the Tenant) is the Data Controller. Tommlab Web Radio operates as the Data Processor, handling information exclusively to provide corporate audio streaming, verify concurrency limits, and manage seat allocations.
2. Categories of Personal Data Processed
Processing is strictly minimized under GDPR Article 5(1)(c): Corporate email, employee name, assigned role, and connection logs (timestamp, duration increment of 60 seconds). No sensitive personal data, biometric data, or location GPS data is collected.
3. Legal Basis for Processing
Processing is grounded in GDPR Article 6(1)(b) (Performance of a Service Agreement) and Article 6(1)(f) (Legitimate Interests) to guarantee isolated stream delivery and prevent seat quota abuse.
4. Data Residency & EU Infrastructure
All personal data and stream logs are stored exclusively in the European Union (europe-west8 Milan, Italy / local server infrastructure) under state-of-the-art technical and organizational measures (TOMs).
5. Data Subject Rights (Articles 15-22)
Under the GDPR, employees have the Right to Access (Art. 15), Right to Rectification (Art. 16), Right to Erasure / 'Right to be Forgotten' (Art. 17), and Right to Data Portability (Art. 20).
Cookie Taxonomy & Retention
| Cookie Name | Category | Purpose | Duration |
|---|---|---|---|
| __session | Strictly Necessary | Maintains authenticated user session state. | 7 Days |
| __user_role | Strictly Necessary | RBAC role enforcement (SUPER_ADMIN, TENANT_ADMIN, LISTENER). | 7 Days |
| __tenant_id | Strictly Necessary | Guarantees isolated tenant stream and admin routing. | 7 Days |
| __lang | Functional | Remembers selected language preference (EN, ES, IT). | 1 Year |
| tommlab_cookie_consent | Functional | Remembers cookie consent acknowledgement. | 1 Year |
6. Data Protection Contacts
To exercise your GDPR rights, please contact your organization administrator or reach our Data Protection team at privacy@tommlab.eu.