Privacy Policy - Onelink.to (OLTO AB)
Effective from: June 30, 2026
Onelink.to is a Service provided by OLTO AB, a company incorporated in Sweden with company registration number 559151-6223. This privacy policy will explain how our organization uses the personal information we collect from You when You use the services, applications, websites, etc available through https://www.onelink.to.
By accessing or using our Service, you agree to this privacy policy.
1.Definitions
For the purposes of this Privacy Policy we use the same definitions as set out in our Terms of Service, see https://www.onelink.to/legal/terms.
2.Our role under data protection law
OLTO AB (Onelink.to) determines the purposes and means of the personal data processing described in this Privacy Policy and acts as a data controller.
For account and profile data, we are the controller of the personal data you provide when you create and use an account.
For statistics collected when someone clicks a Onelink or scans a QR code, we act as an independent data controller. We determine what aggregated, non-identifying statistics are collected and how they are used; we do not collect or process this data on behalf of the account holder who created the Onelink. The account holder does not instruct us on the means of this processing, and we are not a data processor in respect of it.
3.Information we collect - What, How, and Why?
3.1When You sign up for a Onelink.to Account
| Data Type | Description |
| User Data | The data we collect depends on the Onelink.to Account created and how You create Your Account. What This may include your: • email address • name • phone number How • The information is collected from forms You fill out on the Site • If a third party authentication service is used, e.g. "Google Sign-In", the data is collected from that service and depends on Your settings within that service. Why This data is needed to identify You in our systems, for legal purposes, and to contact You when needed. |
| Organization Data | If You register for a Company/Organization Account we will collect information about that Company/Organization. What This may include your: • legal name • tax ID number How • The information is collected from forms You fill out on the Site Why This data is needed for legal, invoicing, and accounting purposes. |
| Address Data | Depending on if the Account is Personal or a Company/Organization Account the address data is personal information or connected to the Company/Organization registered to the Account. What This may include your: • street address • postal address • country of residence or registration How • The information is collected from forms You fill out on the Site Why This data is needed for legal, invoicing, and accounting purposes. |
| Payment Data | If You sign up for a paid plan, information will be collected by the payment service provider Stripe. See their policy at https://stripe.com/privacy |
3.2When You invite additional users to Your Account
| Data Type | Description |
| User Data | When you invite an additional user to Your Account (availability depending on Account type) we require an email address to invite. What • email address of the person to invite How • The information is collected from forms You fill out on the Site Why This data is needed to address the email invitation and to send reminders. |
3.3When You create a Onelink
| Data Type | Description |
| Onelink Data | When you create a Onelink you add data into our systems. What • App download links (URLs to different app stores, etc) • Fallback link (an URL to any place) • Name (for Your identification of the onelink within the Service) How • The information is collected from forms You fill out on the Site Why This data is needed for the Service to work |
3.4When someone clicks a Onelink (URL) or scans a Onelink QR code
| Data Type | Description |
| High Level Statistics Usage Data | When someone interacts with Your Onelink we collect statistics regarding the interaction (depending on Your Account type).
The resulting statistics are aggregated and do not identify individuals. What This may include: • Device type (e.g. iPhone, Android, etc) • result of interaction • referring website • country of request origin • UTM campaign tokens How • The information is collected automatically from the request Why This data is collected to form statistics of the use of the Onelink in question. |
4.Purpose for using Your Personal Information
a.
To provide the Service to You.
b.
To communicate with You (outside of the Website)
c.
To process payments
d.
To comply with legal obligations
e.
To detect and prevent fraud
5.Lawful basis for processing
Under the General Data Protection Regulation, we rely on the following lawful bases for processing personal data:
| Processing activity | Lawful basis |
| Providing the Service to account holders (account management, authentication, Onelink creation and management) | Performance of a contract (Article 6(1)(b)) |
| Sending account-related communications | Performance of a contract (Article 6(1)(b)) |
| Processing payments and maintaining invoicing and accounting records | Compliance with a legal obligation (Article 6(1)(c)) and performance of a contract (Article 6(1)(b)) |
| Collecting aggregated click and interaction statistics when a Onelink is used | Legitimate interests (Article 6(1)(f)) — operating and improving the redirect Service. This data is aggregated and not used to identify individuals. |
| Marketing-site and dashboard analytics | Consent (Article 6(1)(a)), obtained via the cookie banner |
| Detecting and preventing fraud and protecting the security of the Service | Legitimate interests (Article 6(1)(f)) |
6.Sharing Your Personal Information
We will not disclose Your Personal Information to any person or entity without your consent, except as outlined in this clause.
6.1Sub-processors
We engage the following third parties to process personal data on our behalf. These sub-processors have access to personal data only to perform their contracted role and are bound by data protection obligations consistent with this Privacy Policy.
Infrastructure providers (compute and database hosting)
The Service runs on cloud infrastructure located within the European Union. We use the following providers for compute and database hosting; any provider may host any part of the Service:
| Sub-processor | Data centre location |
| UpCloud Ltd | European Union (Netherlands) |
| DigitalOcean LLC | European Union (Netherlands) |
| Scaleway SAS | European Union (Netherlands) |
These providers process account holder data and click-interaction data as part of operating the Service. Click-interaction data is processed transiently and aggregated immediately; no raw event or persistent identifier for an individual click is stored beyond the aggregated statistics described under Data Retention.
Other sub-processors
| Sub-processor | Purpose |
| Amazon Web Services EMEA SARL (Luxembourg; data centre in Germany) | Outbound transactional and marketing email (SES) |
| Stripe Payments Europe Ltd (Ireland) | Payment processing, subscription billing, invoicing |
| Google Ireland Limited | Google Analytics 4 for the public website and customer dashboard, activated only with cookie consent; not used on the redirect/click path |
Optional integrations engaged by the user
If you choose to sign in to your account using a third-party identity provider, your authentication occurs directly with that provider under their own privacy policy. These providers are not Onelink.to sub-processors:
•
Google LLC (Sign in with Google)
•
Microsoft Corporation (Sign in with Microsoft)
6.2Payment Providers
We may share Your Personal Information to payment providers in order to create invoices and process payments, and for anti-fraud purposes.
6.3Compliance With Laws
We will disclose your Personal Information where required to do so by law or subpoena or if we believe that such action is necessary to comply with the law and the reasonable requests of law enforcement or to protect the security or integrity of our Service.
7.Data Storage and Safety
Onelink.to securely stores your data within data centers located within the EU.
The security of your Personal Information is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.
In the event of a personal data breach, OLTO AB complies with its obligations under the General Data Protection Regulation, including notifying the competent supervisory authority within 72 hours under Article 33 where applicable and notifying affected data subjects under Article 34 where the breach is likely to result in a high risk to their rights and freedoms.
8.Data Retention
We will keep your personal information only as long as necessary to provide you with the Service and for legitimate and essential business purposes of Onelink.to.
If you choose to close your account, we will delete or anonymise your personal information within 30 days of account closure. Where we are required by law to retain certain records — in particular invoices and accounting records, which we retain for 7 years in accordance with the Swedish Bookkeeping Act (Bokföringslagen) — we will keep only the data necessary for that legal obligation and delete the remainder.
Aggregated click statistics described in section "When someone clicks a Onelink (URL) or scans a Onelink QR code" are retained for up to 760 days and then deleted by an automated process.
Records of the transactional emails we send you (such as their delivery, open and bounce status) are retained for up to 24 months and then deleted by an automated process.
9.International Transfer
Your information, including Personal Information, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those from your jurisdiction.
If you are located outside the European Union ( EU) and choose to provide information to us, please note that we transfer the information, including Personal Information, to the EU and process it there.
Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.
10.How we use Cookies (and similar technologies)
Onelink.to uses Cookies in a range of ways to improve your experience on our website, including:
a.
Keeping you signed in
b.
Storing settings when reloading the Website
c.
Performance enhancement (data caching)
d.
Understanding how our Service is being used (analytics)
10.1How to manage cookies
You can select which type of cookies to accept from the settings on the Website. However, some of our Website features may not function as a result.
11.Children’s Privacy
Our Service does not address anyone under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from children under 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Information, please contact us. If we become aware that we have collected Personal Information from a child under age of 18 without verification of parental consent, we take all possible steps to remove that information from our servers.
12.Changes to our privacy policy
Onelink.to keeps its privacy policy under regular review and places any updates on the Website.
13.Privacy policies of other websites
The Onelink.to Website may contain links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.
14.What are your data protection rights?
Onelink.to would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:
| The right to | Description |
| access | You have the right to request Onelink.to for copies of your personal information. This is provided free of charge, though we may charge a reasonable fee for additional copies or for manifestly unfounded or excessive requests. |
| rectification | You have the right to request that Onelink.to correct any information you believe is inaccurate. You also have the right to request Onelink.to to complete the information you believe is incomplete. |
| erasure | You have the right to request that Onelink.to erase your personal information, under certain conditions. |
| restrict processing | You have the right to request that Onelink.to restrict the processing of your personal information, under certain conditions. |
| object to processing | You have the right to object to Onelink.to’s processing of your personal information, under certain conditions. |
| data portability | You have the right to request that Onelink.to transfer the data that we have collected to another organization, or directly to you, under certain conditions. |
The rights above apply to account holders and to any individual whose personal data we hold in identifiable form. Statistics collected when someone clicks a Onelink or scans a QR code are aggregated and do not identify individuals; because we cannot link this data to a specific person, we are generally unable to action access, rectification, or erasure requests for it, as there is no identifiable personal data to retrieve or remove. We will, of course, action all such requests in respect of the account and profile data we hold about you.
Where we rely on your consent, you may withdraw it at any time via the cookie settings on the Website or by contacting us; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at our email: privacy@onelink.to
15.How to contact us
If you have any questions about Onelink.to’s privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us at our email: privacy@onelink.to
16.How to contact the appropriate authority
Should you wish to report a complaint or if you feel that Onelink.to has not addressed your concern in a satisfactory manner, you may contact the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY). They are found at https://www.imy.se