Privacy Policy

Tonsuavari respects your privacy. This policy explains what personal data we collect when you visit tonsuavari.com, why we collect it, the lawful basis for each use, who we share it with and the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018.

1. Who we are

Tonsuavari operates this promotional publication. For the processing described below we act as the data controller. You can reach us at [email protected] or by post at the address given in our Legal Notice.

2. Data we collect

• Technical data — IP address (truncated where possible), browser and device type, operating system, referring URL, approximate region derived from IP, and the pages you view.
• Usage data — time on page, scroll depth, and which outbound product links you click.
• Consent data — the cookie preference you selected and when you selected it.
• Correspondence — your name, email address and message if you contact us.

We do not ask for payment details on this Site. If you buy the featured product, your order data is collected directly by the retailer under their own privacy policy, and we receive only anonymised or aggregated conversion information.

3. Lawful bases

• Legitimate interests — operating and securing the Site, preventing fraudulent affiliate clicks, and understanding aggregate readership.
• Consent — analytics, advertising and affiliate attribution cookies; you may withdraw consent at any time.
• Legal obligation — retaining records required by tax, accounting and advertising-compliance rules.

4. Sharing

We share data with our hosting and content-delivery provider, our analytics provider, advertising and affiliate networks, and professional advisers where necessary. Each processor acts under a written contract. Where data is transferred outside the UK we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses. We never sell your personal data.

5. Retention

Server logs are kept for up to 30 days. Analytics data is retained in aggregated form for up to 14 months. Consent records are kept for 12 months. Correspondence is kept for 24 months after the matter is closed, unless a longer period is required by law.

6. Your rights

You have the right to access your data, to have inaccurate data corrected, to erasure, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Send requests to [email protected]; we respond within one calendar month. If you are unhappy with our response you may complain to the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113).

7. Security and children

We use TLS encryption in transit, access controls and regular patching to protect the Site. No transmission over the internet is completely secure, so we cannot guarantee absolute security. The Site is not directed at children under 16 and we do not knowingly collect their data.

8. Changes

We may update this policy to reflect changes in our practices or the law. The "last updated" date above always shows the current version.