Privacy policy

Two different roles

Almost every confusing question about an email platform comes from mixing these up, so they are separated here.

Tiuha as controller. When you visit tiuha.com, join our product-update list, write to us, or hold an account with us, we decide why and how your data is used. That is this policy.

Tiuha as processor. When a customer uses Tiuha to email their subscribers, the customer is the controller and we act only on their instructions. Those terms are in the Data Processing Agreement, not here. If you received an email sent through Tiuha and want your data removed, contact the sender — they control it. We will help them, but we cannot act without them.

What we collect, and why

Data	Why	Lawful basis
Email address, and a name if you give one	To send the product updates you asked for	Consent
Confirmation record: when you opted in, your IP address, browser user-agent, and the wording of the consent you were shown	To prove the opt-in was genuine, which is what makes double opt-in worth anything	Legal obligation & legitimate interest
Delivery events: sent, delivered, bounced, complained	To stop mailing addresses that do not work, and to honour complaints	Legitimate interest
Opens and link clicks, where enabled on a campaign	To see whether what we send is useful	Legitimate interest
Anything you write in the contact form	To answer you	Legitimate interest / pre-contractual steps
Account details, for customers	To run the service and bill for it	Contract

We do not buy lists, we do not enrich your address with data from elsewhere, and we do not sell anything to anyone.

Where it lives

Application data is stored in the European Union. Outbound email is delivered through Amazon SES in the eu-north-1 (Stockholm) region — see the sub-processor list. Message content necessarily reaches the recipient's own mail provider, which is outside anyone's control but theirs.

How long we keep it

• Subscription data — until you unsubscribe. After that a minimal suppression record is kept indefinitely so we cannot accidentally mail you again. That record is your address and the reason, nothing else.
• Consent records — kept while we hold the subscription and for a reasonable period after, because their entire purpose is proving the opt-in happened.
• Contact form messages — deleted automatically once the form's retention period expires. For enquiries to us that is 180 days.
• Delivery logs — kept for operational troubleshooting and removed on a rolling basis.

Your rights

Under the GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or withdraw consent at any time. Withdrawing consent does not affect anything done before you withdrew it.

The fastest routes:

• Stop the emails — the unsubscribe link at the bottom of any message. One click, no login, no questions asked.
• Fewer emails instead of none — the preference link in the same footer.
• Anything else — write to us. We answer subject requests within one month.

If you think we have handled your data badly you may complain to your national supervisory authority. In Finland that is the Office of the Data Protection Ombudsman, tietosuoja.fi.

Cookies

This marketing site sets no tracking cookies and runs no analytics. The admin application at app.tiuha.com stores a sign-in session, which is strictly necessary and is not used for tracking.

Tracking in email

Where open and click tracking is enabled it runs on our own domain rather than through a third party, and the record stays with the sender. Our emails are readable with images disabled, which prevents open tracking entirely.

Who we are

Puida Oy, business ID 2918901-1, Ruopankatu 2 B 5, 15100 Lahti, Finland. Reach us through the contact form.