Privacy Policy
Last updated: 15 July 2026
1. Data Controller and Contact
Data controller: TUSH Oy (Business ID / Y-tunnus: XX XXXXX-X), address: [street address, postal code, city], Finland. For privacy-related inquiries, contact privacy@tush.fi. If a Data Protection Officer has been appointed, their contact details will be listed here.
2. Personal Data We Collect
We process the following categories of personal data: (a) contact details such as name, email, and phone number; (b) company and job-role information; (c) order and contract data; (d) communication records, including email correspondence and contact form submissions; and (e) technical data collected automatically, such as IP address, browser type, and on-site behavior via cookies.
3. Purposes and Legal Bases for Processing
We process personal data on the following legal bases under Article 6 of the EU General Data Protection Regulation (GDPR): (i) performance of a contract, including processing orders (Art. 6(1)(b)); (ii) our legitimate interests, such as managing customer relationships, business-to-business marketing, and improving the website (Art. 6(1)(f)); (iii) compliance with legal obligations, such as accounting requirements (Art. 6(1)(c)); and (iv) consent, for example for non-essential cookies and direct marketing (Art. 6(1)(a)).
4. Disclosure and International Transfers
We may disclose personal data to the following categories of recipients: logistics and freight-forwarding partners for delivery purposes; IT and hosting service providers; accounting and audit service providers; and public authorities where legally required. We do not sell personal data to third parties. Where personal data is transferred outside the European Economic Area (EEA) — for example, to logistics partners in Africa — we ensure the transfer is lawful by relying on the European Commission's Standard Contractual Clauses or another valid transfer mechanism under Chapter V of the GDPR.
5. Data Retention
Data submitted via contact forms is retained for a maximum of two (2) years from the last point of contact. Correspondence and order records related to a customer relationship are retained for the duration of the business relationship and thereafter for the six-year period required under the Finnish Accounting Act (1336/1997). Marketing consent remains valid until withdrawn.
6. Your Rights
Under the GDPR, you have the right to: (a) access your personal data; (b) request rectification of inaccurate data; (c) request erasure where the legal conditions are met; (d) object to or request restriction of processing; (e) request data portability; and (f) withdraw consent at any time where processing is based on consent. To exercise these rights, contact privacy@tush.fi. You also have the right to lodge a complaint with the competent supervisory authority — in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi) — if you believe your personal data has been processed in violation of applicable law.
7. Cookies
Our website uses essential cookies, which are necessary for the site to function and do not require consent, as well as analytics and, where applicable, marketing cookies, for which we request your consent via a cookie banner on your first visit, in accordance with the Finnish Act on Electronic Communications Services and the GDPR. You can manage your cookie preferences at any time via the site's cookie settings or your browser settings. A detailed list of cookies used and their purposes is available in our cookie settings panel.
8. Security
We implement appropriate technical and organizational measures, including access controls, encryption, and regular security reviews, to protect personal data against unauthorized access, loss, or misuse. In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, we will notify the Office of the Data Protection Ombudsman within 72 hours of becoming aware of it, in accordance with Article 33 of the GDPR, and will notify affected individuals where required.