TUUYA
EN
Get a quote

TUUYA

Privacy Policy

Last updated: 6 August 2026

Change of operator: until 3 August 2026, the Website was operated, and enquiries and customer communications were handled, by Edex SIA (Reg. No. 40103909947). From 3 August 2026, these activities are handled by SIA Tuuya (Reg. No. 40003919385), a separate legal entity.

This Privacy Policy explains how SIA Tuuya, operator of tuuya.eu (the “Website”) and of the TUUYA brand, collects and uses your personal data, and the rights you have. It should be read together with our Cookie Policy and Terms of Use.

1. Who we are (data controller)

The controller of personal data collected through the Website is:

  • SIA Tuuya (brand: TUUYA)
  • Registration number: 40003919385, Enterprise Register of the Republic of Latvia (Uzņēmumu reģistrs)
  • VAT number: LV40003919385
  • Registered address: Kārļa Ulmaņa gatve 119, Mārupe, Mārupes nov., LV-2167, Latvia
  • Email: [email protected]
  • Phone: +371 27199927

We have not appointed a Data Protection Officer, as we are not required to. For any privacy matter, contact us at the email above.

2. What this Website is

The Website is an informational and enquiry site for our timber products and services. It is not an online shop: there is no account, no online payment and no checkout. We collect personal data mainly when you choose to contact us about a project.

3. What data we collect

a. Enquiries you send us. When you use the project form, the enquiry form on a product page, the configurator brief, or contact us by email, phone, WhatsApp or Telegram, we collect the data you provide: typically your name, email address, phone number, and the details of your project or question, together with a note of which form or page the enquiry came from. Enquiry-form data is stored in our website’s database and also sent to us by email. Providing this data is voluntary, but without it we cannot answer your enquiry.

b. Configurator inputs. The online configurator records the choices you make about a possible project (product type, size, stage and similar). These become personal data only when you send them to us together with your contact details in a brief.

c. Analytics and marketing data. With your consent, we use analytics and advertising tools (see section 5) that collect information about how you use the Website, through cookies and similar technologies as described in our Cookie Policy.

d. Technical and security data. Like most websites, our servers and our security / content-delivery provider automatically log technical data such as your IP address, browser and device type, and the pages requested. Our forms also use a hidden anti-spam timestamp to filter automated submissions. This is used to deliver the Website securely, prevent abuse and keep it working.

We do not knowingly collect special categories of data (such as health or political views), and the Website is not directed at children.

4. Why we use your data and our legal basis

  • To answer your enquiry and prepare a quotation: steps taken at your request before a possible contract, and our legitimate interest in responding to you (GDPR Art. 6(1)(b) and (f)).
  • To communicate with you about your enquiry, through the channel you chose: same basis as above.
  • To run analytics and, where applicable, advertising: your consent (Art. 6(1)(a)), which you can withdraw at any time.
  • To keep the Website secure and prevent abuse: our legitimate interest in the security and integrity of the Website (Art. 6(1)(f)).
  • To comply with legal obligations where they apply: Art. 6(1)(c).

5. Analytics and advertising (only with consent)

Non-essential tools load only after you accept them in our cookie banner; until then they stay disabled. For Google services we apply Google Consent Mode v2. The tools we may use are:

  • Google Analytics 4 (Google Ireland Ltd): statistics about how visitors use the Website, based on pseudonymous identifiers, to understand and improve it.
  • Meta Pixel (Meta Platforms Ireland Ltd): measurement of advertising, if and when we run campaigns.
  • Google Ads (Google Ireland Ltd): measurement and targeting of advertising, if and when we run campaigns.

You can change or withdraw your consent at any time through the cookie settings link in the footer.

6. Who we share your data with

We do not sell your personal data. We share it only with:

  • Service providers acting on our behalf (processors): our website hosting and email provider, and our security / content-delivery provider, used to run the Website and handle your enquiry.
  • Analytics and advertising providers (Google, Meta): only for data collected with your consent, as described in section 5.
  • Authorities or professional advisers where we are legally required to, or to establish or defend legal claims.

7. International transfers

Our website hosting and email servers are located within the EU/EEA (Germany). Our security and content-delivery provider, Cloudflare, may route and process technical data (including your IP address) on servers outside the EU/EEA, including in the United States. In addition, where you consent to them, some analytics and advertising providers (such as Google and Meta) may process data outside the EU/EEA, including in the United States. Where personal data is transferred outside the EU/EEA, it is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and, where the recipient is certified, the EU-US Data Privacy Framework.

8. How long we keep your data

We keep enquiry data for as long as needed to handle your request and our reasonable business follow-up. Enquiries that do not lead to a project are typically deleted within 24 months of our last contact with you. If a project goes ahead, related data is kept under the separate contract. Analytics data is retained for the limited periods set by the provider (see the durations in our Cookie Policy). You can ask us to delete your data at any time (section 10).

9. How we protect your data

We use encryption in transit (HTTPS), access controls, a web application firewall and other reasonable technical and organisational measures. No method of transmission over the internet is completely secure, but we work to keep your data safe.

10. Your rights

Under the GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to its processing; data portability; and, where processing is based on consent, to withdraw that consent at any time without affecting earlier processing. To exercise any of these, contact [email protected]. You also have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija, DVI, dvi.gov.lv).

11. Changes

We may update this Privacy Policy from time to time. The current version is always the one on this page, with the “last updated” date above.

12. Contact

For any question about this Privacy Policy or your personal data: [email protected].