Privacy Policy

1. Overview & Data Controller

Tukan Holdings and its affiliated group operating entities (collectively, "Tukan", "we", "us", or "our") design and execute promotional campaigns, collectible series, loyalty programmes, and retail activations for store networks worldwide.

This Privacy Policy applies to personal information gathered through our website (www.tukanholdings.com), through electronic communications with our teams, and via our "Talk to us" B2B inquiry forms.

Depending on your location and the office you engage with, Tukan adheres to the provisions of the UK Data Protection Act 2018 / UK GDPR, the European Union General Data Protection Regulation (EU GDPR), the Swiss Federal Act on Data Protection (FADP / DSG), and the Brazilian General Data Protection Law (LGPD — Lei nº 13.709/2018).

2. Information We Collect

We collect information strictly necessary to provide information on our B2B promotional capabilities and respond to campaign inquiries:

• Contact & Identification Data: Your full name, professional/business email address, telephone number, job title, and company or retail brand name.
• Campaign & Store Network Details: Retail sector (supermarkets, fuel stations, pharmacies, auto-service, specialist chains), store count estimates, campaign timelines, and briefing notes submitted through our contact forms.
• Communications: The substance of any emails, questions, requests for proposals, and correspondence exchanged with our team.
• Technical & Usage Data: Anonymized or pseudonymous technical telemetry including Internet Protocol (IP) address, browser type and version, language preference, operating system, and timestamp of visit.
• Local Storage: Functional preferences such as your chosen site language (stored in localStorage under tukan-lang) to preserve your browsing language.

We do not collect sensitive personal data (special category data) through our website.

3. Purposes & Legal Grounds for Processing

We process your personal data under the following recognized legal bases:

• Pre-contractual Steps & Inquiries: Processing is necessary to review your campaign specifications, evaluate retail network suitability, and deliver proposed mechanics, calendars, and initial numbers prior to entering into a formal agreement (GDPR Art. 6(1)(b); LGPD Art. 7º, V).
• Legitimate Interests: Managing ongoing B2B business relationships, defending against fraudulent submissions, maintaining the security of our website, and auditing our marketing outreach (GDPR Art. 6(1)(f); LGPD Art. 7º, IX).
• Legal Compliance: Retaining correspondence and records to comply with statutory commercial, corporate, accounting, and tax requirements (GDPR Art. 6(1)(c)).

4. Data Sharing & International Transfers

We do not sell, rent, or trade your personal information to data brokers or third-party marketers.

Your data may be shared only with:

• Tukan Group Entities: Our operating offices in London (UK), Munich (Germany), Madrid (Spain), Zurich (Switzerland), and Rio de Janeiro (Brazil) to the extent required to coordinate your campaign proposal.
• Service Providers: Vetted third-party suppliers who provide website hosting, technical maintenance, email routing, and spam prevention services under strict data processing agreements.
• Statutory Authorities: Law enforcement or governmental bodies only when compelled by valid legal process or statutory requirements.

When data is transferred across international borders outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are implemented, including standard contractual clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office, or adequacy decisions recognizing reciprocal data protection levels.

5. Data Retention

We retain business inquiries and contact form submissions only for as long as is necessary to address your project request, conduct commercial discussions, and fulfill statutory retention periods under applicable commercial and tax law (typically up to 3 to 6 years following the conclusion of commercial discussions).

If an inquiry does not result in a commercial relationship, the contact details and briefing data are routinely purged or anonymized in accordance with our internal data retention schedules.

6. Your Legal Rights

Depending on your jurisdiction (UK, EU, Switzerland, Brazil), you hold specific statutory rights regarding your personal information:

• Right of Access: You can request a confirmation of whether we process your data and obtain a copy of your personal data.
• Right to Rectification: You can request immediate correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your personal data when it is no longer required for the purpose for which it was collected.
• Right to Restrict or Object to Processing: You can object to processing based on legitimate interests or request limitation of processing.
• Right to Data Portability: You may request the transmission of your data in a structured, commonly used format.
• Right to Revoke Consent: Where processing was based on consent, you may withdraw it at any time.

To exercise any of these rights, contact our privacy team at [email protected]. We respond to all verified requests within thirty (30) days without undue delay.

You also have the right to lodge a complaint with your competent data protection supervisory authority (e.g., the Information Commissioner's Office in the UK, the Federal Data Protection and Information Commissioner in Switzerland, the Spanish AEPD, the German state DPAs, or the ANPD in Brazil).

7. Cookies & Storage Preferences

Our website is designed with a privacy-first ethos. We do not use third-party tracking cookies or behavioral advertising trackers across our site.

We utilize browser localStorage solely to record your selected viewing language (e.g. English, Portuguese, German, Spanish). This ensures that when you navigate across our pages or return in a subsequent session, the website displays in your preferred language.

8. Security & Confidentiality

We maintain appropriate organizational and technical security measures to protect personal data against accidental loss, unauthorized access, disclosure, alteration, or misuse. All data transmissions across our site are encrypted using modern Transport Layer Security (TLS / HTTPS).

9. Contact Us

If you have any questions regarding this Privacy Policy, your rights, or our data handling practices, please contact us:

We may update this policy periodically to reflect changes in our operational practices or applicable statutory regulations. The latest version will always be accessible on this page.