kontakt@tusauna.pl write to us about your sauna
Configure your sauna

Privacy policy

Information on how personal data is processed on tusauna.pl

1. Data controller

The controller of the personal data collected through tusauna.pl is The Arrow Biz, with its registered office at ul. Poprawna 168, 03-984 Warszawa, Poland, NIP (tax ID) 7010192039 (hereinafter: The Arrow Biz).

For privacy matters, you can write to kontakt@tusauna.pl or send a letter to our registered office address.

2. Purpose and legal basis

Personal data is processed for the following purposes:

  1. replying to an enquiry sent through the contact form, under Art. 6(1)(b) GDPR (steps taken at the request of the data subject before entering into a contract)
  2. contact by phone or email to present an offer, where you have given consent, under Art. 6(1)(a) GDPR (consent, which you can withdraw at any time)
  3. providing our services, under Art. 6(1)(b) GDPR (performance of a contract)
  4. visitor statistics and analysis of how the site is used (Google Analytics 4, Microsoft Clarity), under Art. 6(1)(a) GDPR (consent given in the cookie banner, which can be withdrawn at any time)
  5. measuring the effectiveness of our marketing based on information about the source of an enquiry, under Art. 6(1)(f) GDPR (the controller's legitimate interest)

3. Data we collect

The contact form collects the following data: first name, email address, phone number (optional) and information about the planned sauna (number of people and, optionally, a message). The controller does not collect sensitive data.

If you send a project from the configurator, we also store its summary, the drawings and the configuration link. We delete the drawing files after 90 days. We also store the wording, version and date of your consent to contact, so that we can show it was given.

Together with the form, we store technical information about the source of the enquiry: the address of the page the form was sent from, the address of the previously visited page, campaign parameters from the page address (utm_source, utm_medium, utm_campaign, gclid) and the first page of the visit, the latter only with consent to statistics cookies. We use this information to assess which marketing activities bring in enquiries.

4. Retention period

Personal data is kept for as long as needed to fulfil the purpose for which it was collected, and no longer than 3 years from the last contact, unless a longer period is required by law.

5. Recipients of data

Personal data may be shared with entities providing services to the controller: the server hosting provider (DigitalOcean), email sending and email service providers (Brevo, Google) and providers of statistics tools (Google, Microsoft). Some of these entities are based in the USA or use subcontractors outside the European Economic Area. In such cases, data is transferred on the basis of the European Commission's decision on the EU-US Data Privacy Framework or standard contractual clauses approved by the Commission.

6. Your rights

As a data subject, you have the right to:

  1. access your personal data
  2. rectify your data
  3. erase your data (the right to be forgotten)
  4. restrict processing
  5. data portability
  6. object to processing
  7. withdraw consent at any time
  8. lodge a complaint with the President of the Personal Data Protection Office (UODO, Poland)

7. Cookies

The site uses technical cookies, which are necessary for it to work properly, and statistics cookies (Google Analytics 4, Microsoft Clarity). We only store statistics cookies after you give consent in the cookie banner. You can change or withdraw your consent at any time in the cookie settings in the footer of the site.

You will find a detailed list of cookies in our cookie policy.

8. Google Analytics and Microsoft Clarity

Google Analytics 4 (Google Ireland Ltd.) shows us where visitors come from and which pages they read. Microsoft Clarity (Microsoft Ireland Operations Ltd.) shows how you use the site, for example clicks and scrolling, which helps us make it easier to read. Both tools may process device and browser identifiers and your IP address. We only store their cookies after you consent to statistics. You will find details in the Google and Microsoft privacy policies.

9. Security

The controller uses appropriate technical and organisational measures to keep personal data secure, including protection against unauthorised access, loss or destruction.

10. Changes to this policy

The controller reserves the right to make changes to this privacy policy. Users will be informed of significant changes through the website.

Last updated: 23.10.2026