Privacy Policy for Tocolux

Last updated: October 31, 2025

Jurisdiction: United States (Miami, Florida)

Controlling language: English

1) Who we are

 Site owner: tocolux.com

 Contact email for privacy: hello@tocolux.com

 Postal address: Cutler Bay, FL 33189

2) Personal data we collect

 We collect only what’s necessary to operate the Site and respond to you:

 Newsletter subscription: email address.

 Contact form: name, email, phone, street address, city, state, ZIP code, and your message.

 Site analytics (WP Statistics): we use the WP Statistics plugin. By default, WP Statistics:

 Does not use cookies, Does not send data to external servers, and Stores analytics data locally on our own server (no data leaves our hosting).

Important: Some settings in WP Statistics can change what’s collected (e.g., IP handling). We keep default privacy-friendly settings; if we enable features that could collect personally identifiable information (PII), we’ll update this Policy.

 3) Why we use your data (purposes) and legal bases

 Responding to inquiries (contact form): to read and reply to your message, provide quotes, or follow up.

 Legal basis: Legitimate interests in communicating with users and/or taking pre-contractual steps at your request.

 Email newsletters/updates (subscription): to send you news and promotions about our services.

 Legal basis: your consent (you can withdraw any time via the unsubscribe link). We comply with the CAN-SPAM Act (clear identification, non-deceptive subject lines, valid physical address, and a working opt-out).

Federal Trade Commission

Analytics and security (WP Statistics): to measure traffic in aggregate, detect anomalies, and improve the Site.

Legal basis: our legitimate interests in operating, securing, and improving the Site. WP Statistics is designed to be privacy-friendly by default.

 4) How we obtain data

 Directly from you (forms you submit).

 Automatically through analytics measurements managed by WP Statistics; by default no analytics cookies are used and data stays on our server.

 5) Disclosures, processors, and transfers

 We share data only with service providers that help us run the Site and communications (e.g., web hosting, email delivery). They act as processors under our instructions. Hosting and tools may process data in the United States (and, where applicable, other jurisdictions) subject to reasonable contractual and security safeguards.

 6) Retention

 Contact form: we keep submissions only as long as needed to respond and for a limited follow-up period (typically 12–24 months), unless a business relationship continues.

 Newsletter: until you unsubscribe or we terminate the list.

 Analytics (WP Statistics): stored locally in our WordPress database; we retain only aggregated, non-cookie metrics under privacy-friendly defaults. (No external analytics storage by the plugin by default.)

 7) Security

 We implement reasonable organizational and technical safeguards (TLS encryption in transit, restricted admin access, regular updates to WordPress/plugins, least-privilege practices). No method of transmission or storage is 100% secure.

 8) Cookies and similar technologies

 Analytics: WP Statistics does not use cookies by default and keeps data on our server.

Core WordPress cookies: your browser may receive strictly necessary cookies if you log in as an admin/editor or leave comments (not typical for regular visitors). Cookie names/durations vary by setup. We keep our cookie footprint minimal.

If we add features that set non-essential cookies (e.g., embedded media, A/B testing), we’ll update this section and, where required, request consent.

 9) Your privacy choices and rights

 Email marketing: you can unsubscribe using the link in each email or by contacting us. We honor opt-out requests under CAN-SPAM.

Federal Trade Commission

California residents: CCPA/CPRA rights (access, deletion, correction, and opt-out of “sale/sharing”) apply if/when our business meets the law’s thresholds (e.g., revenue or volume of personal information). We will provide required request channels and verification if we fall in scope. See the CPPA’s official updates on thresholds.

 Florida residents: Florida’s Digital Bill of Rights (SB 262) creates consumer privacy rights, but applies narrowly primarily to very large companies and certain tech platforms; most small businesses are out of scope. If we become subject in the future, we’ll enable those request mechanisms.

 EU/EEA visitors: We voluntarily apply core GDPR principles (transparency, data minimization) and will consider reasonable requests for access, rectification, or deletion where feasible, particularly when processing is based on consent (newsletters) or our legitimate interests (first-party analytics). (This is a good-faith commitment and not a concession of legal establishment in the EU.)

 How to exercise: email us at hello@tocolux.com with the subject “Privacy Request.” We may need to verify your identity. Rights and timelines can vary by jurisdiction.

 10) Children

 The Site is not intended for children under 13. If you believe a child provided personal data, please contact us to delete it.

 11) “Do Not Track”

 Browsers may send Do Not Track (DNT) signals. There isn’t a consistent industry response. WP Statistics does not rely on third-party tracking; regardless, you can control cookies via your browser settings (see §8). (We will update this section if standards evolve.)

 12) Third-party links

 Our Site may link to third-party websites or tools with their own privacy practices (e.g., hosting provider, email service). Please review their policies when you leave our Site.

 13) Changes to this Policy

 We may update this Policy to reflect technical, legal, or operational changes. The “Last updated” date will indicate the latest version.

 14) Contact us

 Questions or requests about privacy:

 Email: hello@tocolux.com

 Mail: Cutler Bay, FL 33189

We use privacy-friendly analytics via WP Statistics that, by default, do not set cookies and do not send data to external servers; analytics data stays on our own server. We may use strictly necessary WordPress cookies for site operation (e.g., admin logins). You can control cookies in your browser.

Practical compliance notes

 Email newsletters: include a working unsubscribe link, your physical mailing address, and accurate “From/Subject” lines in every message to comply with CAN-SPAM.

Federal Trade Commission

WP Statistics configuration: keep privacy-friendly defaults (no cookies; local storage only). If you enable options that may collect PII or change IP handling, follow the vendor’s compliance guide and update this Policy.

State laws (FL/CA): today, small Miami-based sites often do not meet Florida SB 262 or CCPA/CPRA thresholds; if that changes (growth in revenue/scale or data sharing), implement request workflows and disclosures accordingly.