Privacy Policy

Latonis Technologies LLC
Last updated: 19 September 2026 · Version 1.1

Your privacy controls — built into the portal

See what we hold. Your client portal shows the personal data associated with your account.
Take it with you. Download your account record, including briefs, messages, invoices, documents and signatures, through the portal.
Ask us to remove it. Send a removal request from the portal; we delete or anonymise eligible data and email you when it is done, subject to the lawful retention exceptions below.
No ad tracking. Our visitor statistics are anonymous and self-hosted. Non-essential analytics are opt-in, and declining stops that analytics collection.

1. Who We Are

Latonis Technologies LLC (“Latonis”, “we”, “us”, “our”) is a software development and digital marketing agency organised as a limited liability company under the laws of the State of Wyoming, United States. Our business correspondence address is 400 Rella Blvd 207-298, Montebello, NY 10901, United States. We also trade under the names “Latonis”, “Latonis Studios”, and “Latpax”.

Personal data collected through the Latpax digital products platform is governed by the separate Latpax Privacy Policy published on that website.

Except where Section 2 provides otherwise, Latonis Technologies LLC is the data controller of the personal data described in this policy. We process personal data in accordance with the laws applicable to our activities, including applicable United States federal and state privacy laws and, where applicable, the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), the Privacy and Electronic Communications Regulations 2003 (“PECR”), and the EU General Data Protection Regulation (“EU GDPR”), as amended.

This policy applies to visitors to our website(s), prospective, current, and former clients and their personnel, suppliers, contractors, and freelancers, applicants for roles or engagements with us, and anyone else who communicates or interacts with us.

Where another legal entity remains responsible for records collected under an earlier privacy notice, that entity remains responsible for its own processing. Any transfer of responsibility to Latonis Technologies LLC will be handled and communicated in accordance with applicable law.

2. Our Two Roles: Controller and Processor

Because Latonis is a business-to-business services company, we handle personal data in two distinct capacities, and it is important to understand which one applies to you.

(a) Latonis as controller. When we collect and use personal data for our own purposes — operating our website, responding to enquiries, marketing our services, managing client relationships, invoicing, recruitment, and complying with our own legal obligations — we act as a data controller, and this policy governs that processing.

(b) Latonis as processor. When we deliver services to a client — for example, developing, hosting, maintaining, or operating a software platform, or running a marketing campaign — we may process personal data contained in the client’s systems (such as data about the client’s end users, customers, or community members).

In that context, our client is the controller and Latonis acts as a processor on the client’s documented instructions and under a written data processing agreement meeting applicable legal requirements, including Article 28 of the UK GDPR or EU GDPR where applicable. The client’s own privacy notice governs that data, not this policy.

If your personal data is held in a platform or service that we build or operate on behalf of a client, please direct any privacy request to that client in the first instance; if we receive such a request directly and can identify the relevant client, we will forward it to them without undue delay and provide reasonable assistance.

3. How to Contact Us

You can reach our privacy team through the following channels. We have designated a privacy lead responsible for handling data protection enquiries.

Email: support@latonis.app

Post: Privacy Team, Latonis Technologies LLC, 400 Rella Blvd 207-298, Montebello, NY 10901, United States.

4. Personal Data We Collect

We collect only the personal data we genuinely need. Depending on your relationship with us, this may include the following categories.

Identity and contact data — name, job title, employer or organisation, business email address, telephone number, postal address, and social or professional media handles.
Business and commercial data — contract and proposal details, project briefs and requirements, meeting notes, correspondence, purchase history, and billing information, including bank account details for payments and invoicing records. We do not store full payment card numbers; card payments, where offered, are handled by third-party payment processors.
Technical and usage data — IP address, browser type and version, device and operating system information, referral source, pages visited, time spent on pages, and cookie or similar identifiers collected when you use our website, including information used for security and access logs.
Marketing and preference data — your subscription status, communication preferences, and how you interact with our communications.
Applicant data — CVs, portfolios, references, interview notes, and, where legally required, evidence of right to work, for individuals who apply for employment or freelance engagements with us.
Correspondence data — the content of emails, contact-form submissions, support tickets, and messages exchanged with us on platforms such as Discord, Telegram, Slack, or WhatsApp, together with call notes.

We do not intentionally collect special category data (such as data about health, religion, or ethnicity) or data relating to criminal convictions, and we ask that you do not send such data to us unless it is strictly necessary and lawful for you to do so.

Where information is necessary to provide a requested service, verify a payment or meet a legal obligation, we may be unable to proceed without it. We will explain this when relevant.

5. How We Collect Personal Data

We collect personal data directly from you when you contact us, complete a form on our website, negotiate or enter into a contract with us, or communicate with us during a project. We collect data automatically through cookies and similar technologies when you visit our website (see Section 7).

We also receive data from third parties, including your organisation or colleagues when they nominate you as a contact; publicly available sources such as Companies House, LinkedIn, and professional portfolio platforms; marketplaces and platforms through which you engage us (for example Fiverr, Upwork, Behance, or Dribbble); referrals; and our service providers.

6. Purposes and Lawful Bases for Processing

We process personal data for the purposes below. Where the UK GDPR or EU GDPR applies, we rely on the relevant lawful basis under Article 6. A reference to performance of a contract applies where you are a party to that contract; for contacts acting for a business client, we generally rely on our legitimate interests in managing that business relationship. References to a legal obligation apply where the obligation is recognised under the applicable data protection law.

Responding to enquiries and providing quotes or proposals. Typical data: identity, contact, correspondence. Lawful basis: steps prior to entering a contract; legitimate interests in developing our business.
Delivering our services and managing projects and client relationships. Typical data: identity, contact, business, correspondence. Lawful basis: performance of a contract; legitimate interests in delivering services and managing business relationships.
Invoicing, payments, accounting, tax, and audit. Typical data: identity, contact, business. Lawful basis: legal obligation; performance of a contract; legitimate interests in maintaining appropriate financial and business records where relevant.
Business-to-business marketing, newsletters, and showcasing our work. Typical data: identity, contact, marketing. Lawful basis: legitimate interests in promoting similar services to business contacts, or consent where applicable marketing law, including PECR, requires it.
Operating, securing, and improving our website. Typical data: technical, usage. Lawful basis: legitimate interests in site security and improvement; consent for non-essential analytics and cookies.
Recruitment and freelancer engagement. Typical data: applicant data. Lawful basis: steps prior to entering a contract; legitimate interests; legal obligation for required checks.
Preventing fraud, enforcing our agreements, and establishing, exercising, or defending legal claims. Typical data: any relevant category. Lawful basis: legitimate interests; legal obligation.
Corporate transactions such as a merger, acquisition, or restructuring. Typical data: any relevant category. Lawful basis: legitimate interests, subject to applicable confidentiality, transparency and other legal requirements.

Where we rely on legitimate interests, we assess whether those interests are overridden by your rights and freedoms. You may request further information about these assessments using the contact details in Section 3.

7. Cookies and Similar Technologies

Our website uses strictly necessary cookies to function. Our visitor statistics are anonymous and self-hosted, and we do not use advertising trackers or cross-site behavioural advertising on our website.

Non-essential analytics and associated cookies or similar technologies are used only with your consent. You can manage your choices through our cookie banner and your browser settings. Declining or withdrawing consent stops non-essential analytics collection and does not prevent you from using the website. Necessary security and access logging may continue for the purposes described in this policy.

8. Marketing Communications

We send direct marketing only where applicable law permits, including with consent where required and to eligible corporate subscribers or existing business contacts under applicable rules. Where PECR applies, we follow its requirements. Every marketing message we send includes a simple way to unsubscribe, and you can opt out at any time by contacting us. When you opt out, we retain a minimal suppression record (typically just your email address) so that we can honour your objection permanently.

Opting out of marketing does not affect service communications that are necessary to deliver a contract, such as invoices or project updates.

9. Who We Share Personal Data With

We never sell personal data. We do not share personal data for cross-context behavioural advertising or process it for targeted advertising on our website. We disclose it only as follows, and only to the extent necessary.

Service providers and subprocessors — hosting and cloud infrastructure providers, email and communications platforms, payment processors, project management and collaboration tools, and professional software vendors. Where these providers process personal data on our behalf, they are bound by written contracts containing appropriate confidentiality and data protection terms, including Article 28 UK GDPR or EU GDPR processor terms where applicable.
Authorised personnel, contractors and Affiliates — where they assist with delivering services, administration or support, under appropriate confidentiality and data protection obligations and with access limited to what their work requires.
Professional advisers — lawyers, accountants, auditors, and insurers, under duties of confidentiality.
Clients — where we act as a processor (Section 2(b)), we make personal data available to the relevant controller client, and where you are a client contact we may share your business contact details within the project team.
Authorities and regulators — courts, law enforcement, tax authorities, and regulators, where disclosure is required by law or is necessary to establish, exercise, or defend legal claims.
Business transferees — a prospective or actual buyer or investor in connection with a corporate transaction, under appropriate confidentiality obligations and subject to applicable law.

10. International Transfers

Latonis Technologies LLC is a United States entity and operates internationally. Personal data may be processed in the United States and in other locations where our team members, contractors and service providers operate, including the United Kingdom, the European Economic Area, South Asia and the Middle East.

Where a transfer of personal data is restricted under the UK GDPR or EU GDPR, we use a lawful transfer mechanism appropriate to that transfer. This may include an applicable adequacy decision or regulation covering the destination and recipient; the ICO’s International Data Transfer Agreement (IDTA); the EU Standard Contractual Clauses, with the UK International Data Transfer Addendum where required for UK transfers; or another mechanism permitted by applicable law. We carry out required transfer assessments and apply supplementary technical and organisational safeguards where needed.

You may request a copy or information about the relevant safeguards, redacted where necessary to protect confidential information, using the contact details in Section 3.

11. Data Security

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit and, where appropriate, at rest; role-based access controls and the principle of least privilege; multi-factor authentication on core systems; secure credential and secret management; code review and automated vulnerability scanning in our development pipelines; due diligence on vendors and subprocessors; and confidentiality obligations for all personnel and contractors.

No system can be guaranteed to be completely secure. If a personal data breach occurs, we will investigate and act in accordance with applicable breach-notification laws. Where the UK GDPR or EU GDPR applies, this includes notifying the relevant supervisory authority within 72 hours of becoming aware of a breach where required and informing affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Where we act as a processor, we notify the relevant client without undue delay.

12. How Long We Keep Personal Data

We keep personal data only for as long as necessary for the purposes described in this policy, after which it is securely deleted or irreversibly anonymised. Our standard retention periods are set out below; specific records may be kept for longer where applicable law requires it or where they are relevant to an active or reasonably anticipated legal claim.

Enquiries and proposals that do not lead to a contract: up to 24 months from last contact.
Client contracts, project records, and related correspondence: duration of the relationship plus 6 years, subject to any longer applicable legal requirement or legal-claims need.
Accounting, invoicing, and tax records: normally 6 years from the end of the relevant financial year, or longer where applicable law requires it.
Marketing data: until you opt out or withdraw consent; a minimal suppression record is kept indefinitely to honour your objection.
Unsuccessful applicant data: up to 12 months from the decision, or longer with your consent to be considered for future roles.
Website analytics and technical data: up to 13 months.
Security and access logs: up to 12 months.
Encrypted backups: deleted on a rolling cycle of up to 90 days after removal from live systems (see Section 14.4).

13. Your Rights

Subject to the conditions and exemptions in applicable data protection law, you have the following rights in respect of personal data for which Latonis is the controller where those rights apply to you.

Right of access — to obtain confirmation that we process your data and a copy of it, together with information about the processing.
Right to rectification — to have inaccurate data corrected and incomplete data completed.
Right to erasure — the “right to be forgotten”, addressed in detail in Section 14.
Right to restriction — to require us to limit processing in certain circumstances, for example while an accuracy dispute is resolved.
Right to data portability — to receive data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means.
Right to object — to object to processing based on legitimate interests, and an absolute right to object to direct marketing, which we will always honour.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Rights relating to automated decision-making — see Section 16.
Right to complain — see Section 20.

Where applicable United States state privacy laws provide additional rights, these may include access, correction, deletion, obtaining a copy, opting out of sale, sharing, targeted advertising or certain profiling, and appealing a decision on a privacy request. We do not discriminate against you for exercising applicable privacy rights and honour legally required opt-out preference signals. Our practices concerning sale, sharing and advertising are described in Sections 7 and 9.

Exercising your rights is free of charge except where applicable law permits otherwise (see Section 15).

14. Right to Erasure — the “Right to Be Forgotten”

We treat erasure requests as a priority and have designed our systems and vendor relationships so that deletion can be carried out thoroughly, including across large or complex environments.

14.1 When the right applies

Where applicable law provides these rights, you may ask us to erase your personal data where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent and no other lawful basis applies; you object to processing based on legitimate interests and there are no overriding legitimate grounds, or you object to direct marketing; the data has been unlawfully processed; erasure is required to comply with a legal obligation; or the data was collected from a child in connection with online services.

14.2 How to make a request

Send your request to the contact details in Section 3, ideally with the subject line “Erasure Request”, describing the data or context concerned (for example, “newsletter subscriber” or “project contact for X engagement”). You can also submit a removal request through your client portal. You do not need to use any particular form, cite any legal provision, or give a reason.

We may ask for proportionate information to verify your identity, solely to ensure we do not delete or disclose data at the request of the wrong person; we will not use that information for any other purpose.

14.3 What we will do

We will acknowledge your request within 5 working days and respond to it within one calendar month of receipt, completing any required erasure within that period unless a lawful extension applies. For particularly complex or numerous requests, we may extend this by up to two further months where applicable law permits, in which case we will tell you within the first month and explain why. Where applicable law requires a shorter deadline or a more limited extension, we follow that requirement.

When we action an erasure request we will: delete or irreversibly anonymise eligible personal data across our live production systems, CRM, mailing lists, and internal records; instruct our processors and subprocessors holding the data to erase it as well; notify recipients to whom the data has been disclosed as required by applicable law and tell you about those recipients if you ask; and, where we have made the data public, take reasonable steps, taking account of available technology and cost, to inform other controllers processing it that you have requested erasure of any links to, or copies of, that data where required by applicable law.

We will confirm to you in writing when erasure is complete and explain any lawful retention.

14.4 Backups and archives

Erased data may persist for a limited period in encrypted backups maintained for disaster recovery. Backups are isolated, access-restricted, and never used for active processing. Erased data is purged from backups on a rolling cycle of no more than 90 days, and if a backup containing erased data ever has to be restored, the erasure is re-applied immediately as part of the restoration procedure.

14.5 Where we may retain data — lawful exemptions

The right to erasure is not absolute. We rely on lawful exemptions narrowly, document our reasons, and retain only the data necessary for the relevant purpose. Depending on applicable law, these may include:

Legal obligation — records we are required by law to keep, such as accounting, invoicing, and tax records, for the applicable retention period.
Legal claims — data necessary for the establishment, exercise, or defence of legal claims, for example records relating to a contractual dispute, retained for the relevant period.
Active contracts — data we genuinely need to continue delivering services you or your organisation still receive, where applicable law permits continued retention; in this case we will explain the consequences and discuss available options.
Freedom of expression and information, public interest, archiving, research, or statistical purposes — in the rare cases where a relevant legal exemption applies.
Suppression records — the minimal record needed to honour your marketing opt-out permanently.

Where we rely on an exemption, we will still erase everything the exemption does not cover, restrict the retained data so it is used only for the exempt purpose, tell you which exemption we are relying on and why, and explain any applicable right of appeal, complaint or judicial remedy.

14.6 Manifestly unfounded or excessive requests

Where applicable law permits, if a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable administrative fee or refuse to act on it. If we do, we will explain our reasons and you may challenge the decision through the routes in Section 20.

14.7 Data held in client systems

Where the data concerned is held in a platform or environment that we operate as a processor for a client (Section 2(b)), the decision on your request belongs to that client as controller, subject to applicable law. We will forward your request to the client without undue delay, assist them in fulfilling it, and carry out any lawful deletion they instruct.

15. Exercising Your Rights — Practical Details

Rights requests are free of charge unless applicable law permits a fee. We may need to verify your identity before acting. Our standard response period is one calendar month, extendable by up to two further months for complex or numerous requests only where legally permitted and with an explanation. Any shorter applicable deadline or stricter limit on extensions takes priority.

If someone makes a request on your behalf, we may ask for evidence of their authority in accordance with applicable law. If we decline a request in whole or in part, we will tell you why and explain any applicable right to appeal, complain to a regulator or seek a judicial remedy.

To appeal a decision where an appeal right applies, contact support@latonis.app with the subject “Privacy Appeal”. We will review the decision and respond within the period required by applicable law.

16. Automated Decision-Making and Profiling

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. Any analytics or profiling we carry out (for example, understanding how visitors use our website) is limited in scope and does not have such effects.

17. Children

Our services are provided primarily to businesses and are not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us and we will take appropriate steps to delete it in accordance with applicable law.

18. Third-Party Websites

Our website and communications may contain links to third-party websites, plug-ins, and applications. We do not control those third parties and are not responsible for their privacy practices. Please review their privacy notices before providing them with personal data.

19. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or in the law. The “Last updated” date at the top shows when it was last revised. Where a change is material, including a change in the controller responsible for your data, we will take reasonable steps to bring it to your attention, for example by email or a prominent website notice, and obtain consent where required by applicable law.

20. Complaints

If you have any concern about how we handle your personal data, please contact us using the details in Section 3 — we take every concern seriously and will do our best to resolve it. Contacting us does not prevent you from approaching a competent regulator.

Where the UK GDPR applies, you may complain to the Information Commissioner’s Office (ICO) through ico.org.uk (https://ico.org.uk/) or its other published contact channels.

Where the EU GDPR applies, you may lodge a complaint with the supervisory authority in your country of habitual residence, place of work, or the place of the alleged infringement.

In the United States, you may contact your state Attorney General or another privacy or consumer protection regulator with jurisdiction over your concern. Any applicable appeal or court rights remain unaffected.

21. Governing Framework

This policy is subject to the privacy and data protection laws applicable to the processing described, including applicable United States federal and state laws and the UK GDPR and EU GDPR where applicable. Nothing in this policy or our Terms of Service limits any mandatory privacy or data protection rights you enjoy under applicable law.

Latonis Technologies LLC · Organised in Wyoming, United States
Business correspondence address: 400 Rella Blvd 207-298, Montebello, NY 10901, United States
Email: support@latonis.app