That Open Company — Privacy Policy
Effective date: 27 October 2026
1. Who is responsible for your data
The controller of your personal data is TOC Systems, SL, a company registered in the Principality of Andorra, with registered address at Urbanització Solà del Tarter, Edifici Bellesguard, Bloc C, 3r 1a, AD100 El Tarter, Canillo, Andorra, NRT L-718520-Z, registered with the Andorran Companies Register under no. 23444 (“That Open Company”, “we”). This policy covers our website, That Open Platform, our community and learning content, our newsletters and our professional services.
For any privacy question or request, write to [email protected].
Representatives. Because we are established outside the European Union and the United Kingdom, we are appointing representatives in the EU (Article 27 GDPR) and in the UK (Article 27 UK GDPR). Their names and contact details will be published here as soon as they are appointed.
We comply with Andorran Law 29/2021 on personal data protection and its implementing regulation and, where they apply to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR. We have not appointed a data protection officer because the law does not require one for our activities.
2. What data we collect and why
| Data | Purpose | Legal basis | How long we keep it |
|---|---|---|---|
| Name, email, company, login data | Create and manage your platform account and workspaces | Performance of contract | While your account is active, then deleted within 30 days |
| Usage data (features used, credit consumption, IP address, logs) | Provide and secure the platform, measure credit usage, bill correctly | Performance of contract; legitimate interest in security | Logs 90 days; usage data aggregated or deleted after 24 months |
| Purchase data (credits purchased, amount, country, transaction status) | Sales, taxes and accounting | Legal obligation; performance of contract | 6 years after the end of the financial year, blocked |
| Contact and company details of business contacts and service clients | Answer requests, prepare proposals, perform and invoice our services | Steps prior to a contract; performance of contract; legitimate interest in managing business relationships | 24 months after our last interaction, or 6 years after the end of a contract |
| Name and email of newsletter subscribers, and opens and clicks | Send news about our products, events and courses | Consent; for existing customers, our legitimate interest in offering similar products, which you can refuse at any time | Until you unsubscribe; then we keep only your email on a suppression list so we do not write to you again |
| Community and course data (profile, posts, progress, certificates) | Give you access to the community and courses and issue certificates | Performance of contract | While you have access, and 12 months after you leave |
| Cookies and similar technologies | Website operation and, with your consent, analytics and advertising measurement | Legitimate interest (necessary cookies); consent (others) | See our Cookie Policy |
We do not use your content to train machine-learning models. We do not sell your personal data. We do not make decisions about you based solely on automated processing.
When we delete or correct your data, Andorran law requires us first to block it: we keep a minimal record that is no longer used for any purpose and is only available to courts and public authorities, for 3 years or for any longer period the law requires (for example 6 years for invoices), and then destroy it.
Our services are intended for professionals. You must be at least 16 years old to create an account.
Do you have to give us your data? The data marked as required in our forms and in sign-up is necessary to create your account, answer your request or perform the contract; without it we cannot provide the service. Everything else is optional.
Where we get data from. Most data comes from you. We also receive data from your organisation when it invites you to a workspace, from Paddle about your purchase, from That Open Company LLC about earlier purchases (see section 4), and business contact details you share with us at events or through professional networks such as LinkedIn.
3. Payments
Platform purchases are processed by Paddle.com, our reseller and Merchant of Record. Paddle collects and processes your payment and billing details as an independent controller under its own privacy policy. We receive from Paddle the information needed to manage your purchase (for example, your name, email, country, credits purchased and transaction status), but never your full card details.
Professional services contracted directly with TOC Systems, SL are invoiced by us.
4. Earlier purchases and learning content
The Master BIM Software Developer, Get The Code and the Founding Members programme were sold by That Open Company LLC, a subsidiary of TOC Systems, SL, using Stripe as payment provider. That Open Company LLC is the controller of the records of those sales and keeps them for as long as instalments remain outstanding and then for the period required by tax law. You can exercise your rights regarding that data, and contact That Open Company LLC, at [email protected].
TOC Systems, SL now provides access to the content and benefits included in those purchases. For that purpose, That Open Company LLC has shared with us the account details of former students and Founding Members, and we process them as controller under this policy.
5. Who we share data with
We share personal data with the following categories of recipients:
- Service providers who process it on our behalf under contract, including Amazon Web Services (hosting, Germany), MongoDB Atlas (database), Auth0 (sign-in), Grafana Labs (monitoring), Cloudflare (website hosting and bot protection), Google Workspace (email and documents), HubSpot (CRM), MailerLite (newsletter), Circle (community and courses), Sertifier (course certificates), Zapier (automations), Holded (invoicing) and our accountants. The list of providers that process platform customer data is available on request at [email protected].
- Advertising and analytics providers (Google, LinkedIn, Meta, TikTok and X), only if you accept the corresponding cookies, as described in our Cookie Policy.
- Paddle, as Merchant of Record for platform purchases, and Stripe, for earlier purchases and community payments.
- Other users of your workspaces, who see the content and activity you share there.
- Professional advisers (lawyers, accountants, auditors) under confidentiality.
- Authorities, when required by law.
AI tools you connect. If you connect a third-party AI tool (for example ChatGPT or Claude) to the platform through our APIs or connectors, the data you give it access to is sent to that provider on your instructions. That provider is not our service provider: it processes the data under its own terms and privacy policy, under your account with it.
6. International transfers
Andorra is recognised by the European Commission and the United Kingdom as providing an adequate level of data protection. The platform is hosted in the EU (Frankfurt). Some of our providers process data in the United States. In those cases we rely on the EU-US Data Privacy Framework, where the provider is certified and Andorran law recognises it, or on the European Commission’s Standard Contractual Clauses, with the UK Addendum where applicable. According to the Andorran Data Protection Agency, the redress mechanisms of the Data Privacy Framework are not available to Andorran citizens. You can ask us for a copy of the safeguards at [email protected].
7. Your rights
You have the right to access your data, rectify it, erase it, restrict or object to its processing, receive it in a portable format, and withdraw your consent at any time without affecting earlier processing. You can also ask for a copy of our record of processing activities. To exercise your rights, write to [email protected]. We will answer within one month, extendable by two months for complex requests, and free of charge.
You can complain to the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades, C/ Doctor Vilanova 15-17, planta -5, AD500 Andorra la Vella, [email protected], www.apda.ad) or to the supervisory authority of your country of residence in the EU or the UK.
8. Security
We apply technical and organisational measures to protect your data, including encrypted connections (HTTPS), encryption at rest provided by our hosting and database providers, individual accounts and access controls, written confidentiality commitments from everyone with access, and backups. No system is completely secure; if a breach affects your data, we will notify you and the authorities as required by law.
9. Data we process for our customers
When organisations use the platform, we process the personal data contained in their projects on their behalf, as processor. In that case the organisation is the controller, and our Data Processing Agreement applies.
10. Changes
We may update this policy. We will publish the new version here with its effective date and, for material changes, notify account holders by email.