Privacy policy

Last updated: 21 October 2026

Topo is an online tool that lets communication agencies split their projects into phases, share them with their clients and collect their feedback and approvals, phase by phase. This page explains what data Topo processes, why, for how long, and how to exercise your rights.

Who we are

Topo is published by Camelidae Group SRL (alpaga agency), Rue d'Havré 140, 7000 Mons, Belgium, company number BE 0500.585.029.

For any question about your data: hello+privacy@alpaga.agency.

Who is responsible for your data?

• You work at an agency that uses Topo: Camelidae Group is the controller for your account.
• You are an agency's client: your agency decides to invite you and what it shares with you. It is the controller, and Camelidae Group acts as its processor. You can contact your agency or us, and we will pass your request on.

What data do we process?

• Agency accounts: name, email address, role, chosen language, password (stored as an irreversible hash), two-factor authentication settings.
• Client contacts: first name, last name, email address, chosen language, whether they may approve, date of last visit.
• Projects and exchanges: phases, dates, deliverables, files uploaded by the agency or the client, items provided, comments and attachments. For a comment left on a test site: the page, the element targeted, the screen size and the browser used.
• Proof of decisions: for each approval, change request or accepted extra charge, the date, time and IP address of the person, and the exact text they read and accepted. This proof protects both the client and the agency in case of disagreement.
• Billing follow-up: amount of each approved phase and accepted extra charge, and their status (to invoice, invoiced, paid). Topo does not issue invoices and makes no payments.
• Business cheque application: for a project funded by the Walloon Region's business cheques (chèques-entreprises), the client's company number, contact person (first name, last name, email address, phone number) and IBAN, which the client enters in their own space.
• Activity log: who did what and when in the agency's workspace, with the IP address.

Topo contains no tracking, audience measurement or advertising tools. Data is never sold, shared with third parties (except for the business cheque application described below) or used to train artificial intelligence models.

Why, and on what basis?

• Providing the service (accounts, projects, exchanges, approvals): performance of the contract between the agency and Camelidae Group, and between the agency and its client.
• Keeping the proof of decisions and the log: legitimate interest of the agency and its client in tracing who approved what, and on what terms.
• Filing a business cheque application: performance of the contract between the agency and its client. At the client's request, the agency enters this information on the Walloon Region's business cheque platform. This is the only transfer to a third party, and only for that project.
• Security (login codes, limited attempts, two-factor authentication): legitimate interest in protecting accounts.
• Emails (invitations, login codes, phases to approve, reminders, approval summaries): performance of the service. These emails contain no advertising.

Where is the data?

Topo is hosted in the European Union, and the data does not leave it. Files are stored outside the public part of the server and are only served to signed-in people. Fonts are served by Topo itself, without calling any third-party service.

For how long?

• Projects, exchanges, files and decisions are kept as long as the agency keeps the client in Topo.
• When the agency deletes a project or a client, its data and files are erased.
• When a contact asks for erasure, their name, email address and IP addresses are deleted. Their messages and decisions remain in the history as "Deleted contact", so that the agency and the client keep track of what was approved.

Cookies

Topo only uses cookies that are needed for it to work, which require no consent:

• a session cookie (current sign-in, chosen language);
• a client sign-in cookie, valid for 30 days, so that a code is not requested at every visit;
• a cookie that remembers light or dark display, valid for one year.

Your rights

You can ask to access your data, correct it, receive it in a file, have it erased or restrict its processing, and object to processing based on legitimate interest. Write to hello+privacy@alpaga.agency: we reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels.

Changes

We will update this page if Topo changes the way it processes data. The update date is shown at the top of the page.