Privacy Policy

Privacy Policy

Last updated: August 2026

This Privacy Policy explains how Tobys CS (“we,” “us,” or “our”) collects, uses, and protects information when you visit tobyscs.com (the “Website”).

1. What we collect and why

Server and security logs. When you visit the Website, our hosting server and Cloudflare (our security and content delivery provider) automatically record your IP address, browser type, device information, pages requested, referring URL, and date/time of access. We use this to operate and secure the Website, prevent abuse, and diagnose technical problems. Legal basis: our legitimate interest in running a secure, functioning website. Logs are retained only for as long as necessary for these purposes.

Contact form. If you use our contact form, we collect your name, email address, IP address, and the content of your message. This is sent to us by email and is not stored on the Website. We use it solely to respond to your enquiry. Legal basis: our legitimate interest in responding to you (or, where relevant, steps taken at your request before entering into a contract). We retain the email only for as long as needed to handle your enquiry.

Advertising (Google AdSense). We display ads served by Google. Google and its partners may use cookies and similar technologies to show ads based on your visits to this and other websites. In the EU, UK, and other regions where required, personalised ads are only shown with your consent, which you can give or withdraw via our cookie banner. Without consent, Google may show non-personalised ads. Legal basis: your consent. Learn how Google uses data at https://policies.google.com/technologies/partner-sites, and manage ad settings at https://adssettings.google.com.

Analytics (Google Analytics). We use Google Analytics to understand how visitors use the Website (pages viewed, time on site, approximate location, device type). IP addresses are anonymised/truncated. Analytics cookies are only set with your consent. Legal basis: your consent. You can opt out at https://tools.google.com/dlpage/gaoptout.

Comments. If you leave a comment, we collect your name, email address, website (optional), the comment text, and your IP address (to help detect spam). Your name and comment are displayed publicly; your email is not. If you have a Gravatar account, an anonymised hash of your email may be sent to Gravatar to display your profile picture. Legal basis: your consent, given when you submit the comment. Comments are retained indefinitely so that follow-up comments can be recognised, or until you ask us to delete them.

Embedded content (YouTube). Some pages contain embedded YouTube videos. When you play a video, YouTube (Google) may set cookies and collect data about you, such as your IP address and viewing behaviour, in the same way as if you had visited YouTube directly. We use YouTube’s privacy-enhanced mode where possible, which limits tracking until you press play. Legal basis: your consent to load third-party content. See Google’s privacy policy at https://policies.google.com/privacy.

2. Cookies

We use:

  • Strictly necessary cookies, e.g. Cloudflare security cookies, which do not require consent.
  • Functional cookies set when you leave a comment, to remember your name and email for next time (opt-in via a checkbox on the comment form).
  • Advertising cookies (Google AdSense), analytics cookies (Google Analytics), and third-party cookies from embedded content (YouTube), which are set only after you consent via our cookie banner.

You can change or withdraw your consent at any time through your browser settings. Blocking cookies may affect some Website features.

3. Who we share data with

We share data only with service providers needed to run the Website:

  • Hosting provider — web hosting and server logs
  • Cloudflare, Inc. — security, performance, and content delivery
  • Google LLC — advertising, analytics, and YouTube embeds
  • Automattic Inc. — Gravatar profile pictures and, if used, Akismet spam filtering

We do not sell your personal data. We may disclose data if required by law or to protect our legal rights.

4. International transfers

Some of our providers (including Google and Cloudflare) process data in the United States and other countries outside the EU/EEA and UK. Where this happens, transfers are protected by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses, or another lawful mechanism.

5. Your rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion of your data
  • Restrict or object to our processing
  • Receive your data in a portable format
  • Withdraw consent at any time (without affecting earlier processing)

To exercise these rights, email us. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

US residents: Where state privacy laws apply (e.g. California), you have similar rights, including the right to opt out of the “sale” or “sharing” of personal data for targeted advertising. You can do this via our cookie banner or by contacting us. We do not discriminate against you for exercising your rights.

6. Data security

We use reasonable technical and organisational measures, including HTTPS encryption and Cloudflare protection, to safeguard your data. No method of transmission over the internet is completely secure.

7. Children

The Website is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with data, contact us and we will delete it.

8. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be posted on this page with the “Last updated” date above.

9. Contact

Questions about this policy or your data? Email us via our contact form.