Privacy Policy

Data Controller

Themeart GmbH
Kabisländer 3
78315 Radolfzell am Bodensee
Germany

Email: hello@tugus.io
Phone: +49 7732 8933 903

General Information on Data Processing

We generally process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. Processing is carried out on the basis of Art. 6 (1) lit. b GDPR (performance of a contract), Art. 6 (1) lit. f GDPR (legitimate interest), or on the basis of consent pursuant to Art. 6 (1) lit. a GDPR.

Hosting and Server Location

Our website and the Tugus platform are operated on dedicated servers provided by Netcup GmbH in Nuremberg, Germany. All data is stored and processed exclusively within the European Union. No transfers to third countries take place.

Access Data and Server Log Files

Whenever our website is accessed, information is automatically collected and stored in server log files, including: IP address (anonymized), date and time of the request, page accessed, HTTP status code, amount of data transferred, referrer URL, and browser/operating system.

This data is used exclusively to ensure the proper operation of our website and is deleted after 30 days.

Cookies

Our website uses only technically necessary cookies. No marketing or tracking cookies are set on the marketing website (www.tugus.io).

Tugus SaaS Platform (app.tugus.io)

If you register to use the Tugus platform, we process the following personal data:

Registration data: name, email address, password (encrypted)
Payment data: processed directly by Stripe, Inc. (data processing agreement in place)
Usage data: event data relating to your customers, received via the Tugus API and forwarded to configured platforms

The legal basis for processing is Art. 6 (1) lit. b GDPR (performance of a contract).

Data Processing on Behalf of Customers

Tugus acts as a data processor within the meaning of Art. 28 GDPR when you process event data of your website visitors through the platform.

The data is forwarded exclusively on your instructions to the platforms configured by you. A Data Processing Agreement (DPA) is concluded automatically upon registration.

Data Transfers to Third-Party Providers

As part of the Tugus platform, event data is forwarded to the platforms configured by you:

Meta Platforms, Inc. (Facebook/Instagram Conversions API)
Google LLC (Google Analytics 4, Google Ads)
TikTok Technology Ltd. (TikTok Events API)
Microsoft Corporation (Bing UET)
LinkedIn Corporation (Conversions API)
Pinterest, Inc. (Conversions API)
Klaviyo, Inc. (Track API)

For payment processing, we use Stripe, Inc., based in the United States. A Data Processing Agreement pursuant to Art. 28 GDPR and EU Standard Contractual Clauses are in place.

Google Consent Mode v2

Tugus natively supports Google Consent Mode v2. Consent signals are passed on with each event to all platforms. Without the end user's consent, only anonymized or restricted data is transmitted.

Data Security

We implement technical and organizational measures to protect your data, including TLS encryption for all connections, encrypted password storage (bcrypt), regular security updates, access restrictions, and automated backups.

Data Retention

Personal data is deleted as soon as the purpose for which it was stored no longer applies. Statutory retention periods apply to contractual data (6 or 10 years).

Event data on the Tugus platform is retained according to the selected plan (6–24 months) and then automatically deleted.

Your Rights

You have the following rights:

Right of access to your stored data (Art. 15 GDPR)
Right to rectification of inaccurate data (Art. 16 GDPR)
Right to erasure of your data (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent (Art. 7 (3) GDPR)

To exercise your rights, please contact us at hello@tugus.io.

You can also export your data directly from the dashboard under Settings > Privacy or delete your account.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority.