TODL Intelligence OÜ
BRIDGE platform (bridges.company)
Effective date: 3 October 2026
1. General provisions
1.1. Operator: TODL Intelligence OÜ, registry code 17518468, registered address: Harju County, Tallinn, Kesklinna District, Tuukri St 19-202, 10120, Estonia. Contact: info@todl-int.com.
1.2. This policy describes which cookies and similar technologies are used on the website and in the BRIDGE platform (bridges.company and its subdomains), for what purposes, on what legal basis, for how long, and how you can manage them.
1.3. Similar technologies include browser local and session storage (localStorage, sessionStorage), session identifiers and authentication tokens, pixels, software development kits and server logs recording IP addresses and request parameters.
1.4. This policy applies together with the Privacy Policy and the Terms of use and forms part of the data processing framework on the platform. As regards the processing of personal data, the Privacy Policy prevails.
1.5. The policy is published in English, Romanian and Russian. In the event of divergence, the Romanian version prevails for users in the Republic of Moldova and the English version prevails for other users.
1.6. We apply a data-minimisation principle: we use only the technologies needed to operate, secure and improve the platform, and we do not use advertising trackers.
2. Applicable law
2.1. Storing information on your device and accessing it are governed by Article 5(3) of Directive 2002/58/EC (as amended by Directive 2009/136/EC), as implemented in Estonian electronic communications law, and, as regards personal data, by the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act.
2.2. For users in the Republic of Moldova, the following additionally apply: Law No. 195/2024 on personal data protection (consent — Article 6(1)(a) and Article 7), Law No. 241/2007 on electronic communications and Law No. 284/2004 on information society services.
2.3. The general principle we apply: technologies that are not strictly necessary are set only after we obtain your consent; strictly necessary technologies are used without consent, because the service cannot be provided without them.
3. What technologies we use
3.1. List
| Category | Technology | Purpose | Lifetime | Legal basis |
|---|---|---|---|---|
| Strictly necessary | __cf_bm cookie (first-party, set by the Cloudflare protection service) | Protection against automated attacks and bots, ensuring website availability | 30 minutes | Provision of the service; consent not required |
| Strictly necessary | Session cookie and authentication tokens (first-party, set only after signing in) | Access to the workspace, session continuity, account protection | Until sign-out or session expiry | Provision of the service; consent not required |
| Strictly necessary | sessionStorage (first-party) | Retaining interface and navigation state within the tab | Until the tab is closed | Provision of the service; consent not required |
| Analytics (own) | Our own performance and usage measurement script, proxied through our domain | Measuring load time, stability and interface usage in aggregated form | No persistent identifiers or cookies are set; service markers in sessionStorage last until the tab is closed | Legitimate interest in improving the product (Article 6(1)(f) GDPR); consent if persistent identifiers are introduced |
| Functional | Local interface settings (first-party) | Remembering your selected language and display preferences | Up to 12 months | Consent; where limited to the current session — provision of the service |
| External resources without device storage | Google Fonts (fonts.googleapis.com, fonts.gstatic.com) | Rendering of interface fonts | Not applicable (no storage takes place) | Legitimate interest in correct interface rendering; when loaded, the IP address and User-Agent data are transmitted to Google LLC (USA) |
| Payment-related (if paid plans are activated) | Payment provider technologies | Processing the payment, fraud prevention, meeting card scheme requirements | Per the payment provider's terms | Performance of the contract |
3.2. What we do not use
We do not use advertising or marketing trackers, social media pixels, cross-site tracking technologies, retargeting identifiers or device fingerprinting. We do not sell or share behavioural data with third parties for their own marketing.
3.3. Accuracy of the list
The list reflects the actual state as at the effective date. The exact names of strictly necessary cookies depend on the deployment configuration and are always visible in your browser's developer tools. When new technologies are added, this policy is updated and, for technologies that are not strictly necessary, fresh consent is requested.
3.4. Server logs
Our servers and content delivery network record the IP address, time, requested resource and User-Agent data to ensure the security and resilience of the service. Such data is processed as described in the Privacy Policy (retention — 6 months, or until an incident investigation concludes).
4. Consent and management
4.1. Before setting technologies that are not strictly necessary, we request consent through the consent management banner. Until you make a choice, only strictly necessary technologies are set.
4.2. Consent is given by category, separately for analytics and functional technologies. It is not pre-ticked, refusal is as easy as consent, and access to the platform is not conditional on consent to analytics technologies.
4.3. To demonstrate compliance, we record the fact of consent: date and time, banner text version, the scope of your choice and a technical session or account identifier.
4.4. You may withdraw consent at any time through the consent management banner or the platform settings. After withdrawal, non-essential technologies are no longer set and previously set ones are deleted.
4.5. You can also restrict or delete cookies through your browser:
- Google Chrome: Settings → Privacy and security → Third-party cookies and site data;
- Safari: Settings → Privacy → Manage website data;
- Mozilla Firefox: Settings → Privacy & Security → Cookies and site data;
- Microsoft Edge: Settings → Cookies and site permissions;
- in mobile browsers, through the relevant privacy settings sections.
4.6. Blocking strictly necessary technologies will make signing in and using the workspace impossible.
4.7. We honour privacy preference signals, including Global Privacy Control, to the extent supported by our technical architecture.
5. Third parties and data transfers
5.1. The technologies listed in clause 3.1 involve interaction with the following categories of providers: content delivery and attack protection (Cloudflare), the font service (Google LLC), cloud infrastructure providers, and, if paid plans are activated, the payment provider, and if email campaigns are activated, the email service provider.
5.2. Transfers of data to such providers take place on the conditions described in the Privacy Policy, including on the basis of the standard contractual clauses adopted by the European Commission (Decision 2021/914), under Article 46 GDPR and Article 46 of Law No. 195/2024.
5.3. Providers act under contracts limiting processing purposes and may not use the data for their own purposes, including model training and advertising.
6. Your rights
6.1. In relation to data processed through the technologies described, you have the rights provided by the GDPR and Law No. 195/2024: information, access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interests, withdrawal of consent, and the right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
6.2. Requests should be sent to info@todl-int.com; we respond without undue delay and within one month at the latest.
6.3. Supervisory authorities:
- Estonia (lead authority): Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn; phone +372 627 4135; email info@aki.ee; website aki.ee;
- Republic of Moldova: National Centre for Personal Data Protection (CNPDCP), MD-2004, Chișinău, 48 Serghei Lazo St; phone (022) 820 801; email centru@datepersonale.md.
7. Changes
7.1. The current version of this policy is published at bridges.company/cookies with the date of the last update.
7.2. We inform users of material changes, including the addition of new technology categories, through the consent management banner or the platform interface. Where a change requires consent, consent is requested again and the previous choice is not carried over automatically.
8. Contact
TODL Intelligence OÜRegistry code: 17518468
Registered address: Harju County, Tallinn, Kesklinna District, Tuukri St 19-202, 10120, Estonia
Email:info@todl-int.com