How Tula Sleep handles website data.

Controller

Tula Sleep GmbH, Bebié-Weg 4A, 5300 Baden, Aargau, Switzerland, is responsible for the processing of personal data collected through this website, including enquiries, waitlist submissions, analytics, cookies, and the Referral Program.

You can contact us about privacy and data protection matters at [email protected].

Scope of this notice

This notice applies to personal data collected through this website. If you later proceed to a measurement consultation, you will receive separate privacy information before any additional consultation data is collected.

Personal data we collect

When you join the waitlist, participate in the Referral Program, or contact us through the website, we may collect the personal data you provide, including your name, email address, phone number if provided, country, mattress-size selection, partner-mattress selection, team or organisation details, role, approximate team size, referral code, message content, consent confirmation, submission time, and source page.

Why we process your data

We process this data to operate the website, manage waitlist requests, respond to enquiries, contact interested private individuals and sports teams, assess interest in future production cycles, maintain basic lead records, administer and verify referrals, and prevent misuse of the Referral Program.

The legal basis for this processing may include your consent, steps taken at your request before entering into a contract, our legitimate interest in responding to enquiries and managing business relationships, and legal obligations where applicable.

Sensitive personal data

Please do not submit medical diagnoses, detailed health records, or other sensitive personal data through the website form. If you voluntarily include health-related or recovery-related information in your message, we will process it only for the purpose of responding to your enquiry and evaluating your interest in Tula Sleep.

Service providers, website hosting and international transfers

Waitlist submissions are transmitted through Google Apps Script and stored in a private Google Sheet accessible only to authorised persons working for Tula Sleep. Submission details may also be sent to Tula Sleep by email.

Google processes information on our behalf through Google Workspace services, including Google Drive, Google Sheets and Google Apps Script, under the Google Workspace Cloud Data Processing Addendum. Our data-at-rest region for supported Google Workspace services is set to Europe. This setting does not mean that every processing operation takes place exclusively in Europe.

Depending on the service and processing activity, Google and its approved subprocessors may process personal data in Switzerland, the European Economic Area, the United Kingdom, the United States and other countries identified in Google’s current subprocessor information. Where required, international transfers are protected by an adequacy decision, recognised standard contractual clauses or another legally permitted safeguard. Current Google Workspace subprocessors and processing locations are available in Google’s subprocessor list.

We use Cloudflare, Inc. and its affiliated companies (“Cloudflare”) as a provider of website hosting, content delivery, DNS, SSL/TLS, security and performance services. Our website is hosted through Cloudflare Pages and delivered through Cloudflare’s global network. Where Cloudflare processes personal data on our behalf in connection with these services, Cloudflare acts as a service provider.

When you access our website, Cloudflare may process technical information required to deliver, route, cache, secure and maintain the website. This may include your IP address, the requested URL, the date and time of access, HTTP headers, browser and device information, operating-system information, the referring page, and technical traffic, error and security information.

This information is processed to provide the website, maintain its reliability and performance, detect or prevent attacks and misuse, and investigate technical problems.

We do not use Cloudflare Pages as a database for waitlist submissions, contact enquiries or other form records. However, technical request and security information may be processed by Cloudflare when information is transmitted through the website.

We retain information available to us through Cloudflare dashboards only for as long as necessary for website operation, security, troubleshooting and the purposes described in this Privacy Notice. Cloudflare’s specific retention periods may vary according to the service, plan and security features being used.

Cloudflare operates a global network. Technical and security information may therefore be processed in Switzerland, the European Economic Area, the United Kingdom, the United States and other countries where Cloudflare or its approved subprocessors operate. Where required, international transfers are protected by an adequacy decision, recognised standard contractual clauses or another legally permitted safeguard. Further information is available in Cloudflare’s Privacy Policy and Data Processing Addendum.

Tula Sleep remains responsible for personal data processed on its behalf. We select and instruct service providers, limit their access to what is necessary, and use contractual and organisational safeguards appropriate to the processing.

Analytics and cookies

With your consent, we use Google Analytics 4 to understand how visitors find and use our website. This may include information about pages viewed, approximate location, device and browser category, referral source, interactions with website features, and waitlist conversions. We do not use Google Analytics for personalised advertising, and advertising storage and Google signals are disabled.

Google Analytics is not loaded and analytics cookies are not set unless you select “Accept analytics.” If you select “Only necessary,” analytics is disabled and no further analytics data is sent to Google after the choice takes effect. Withdrawing consent does not retrieve data transmitted while consent was active. We store your consent choice in your browser’s local storage for up to 180 days so that the website can remember it. You can change or withdraw your choice at any time using “Cookie settings” in the footer.

When analytics is accepted, Google Analytics may use identifiers such as _ga and _ga_<container-id> to distinguish visits and maintain session information. For visitors in Switzerland, the European Economic Area and the United Kingdom, Google Analytics processes IP addresses through regional infrastructure to derive approximate location information and discards them before the information is logged. The remaining analytics information may subsequently be processed through Google’s international infrastructure, including in the United States, subject to applicable contractual and legal safeguards. Further information is available in Google’s regional-processing information. Our legal basis for this optional processing is your consent.

Retention

We keep waitlist, enquiry, and Referral Program data only for as long as necessary for the purposes described above. As a general rule, we review waitlist records after 12 months of inactivity and delete or update records that are no longer needed. Referral and reward records may be retained for longer where necessary for program administration, fraud prevention, legal, accounting, warranty, or other legitimate business reasons.

Data sharing

We do not sell personal data. Where necessary for the purposes described in this Privacy Notice, we may disclose limited personal data to authorised personnel and contractors, Google Workspace and Google Apps Script, Cloudflare and other website-hosting, content-delivery, security or analytics providers, professional advisers, and competent public authorities where legally required. Each recipient receives only the information necessary for its role.

Automated decision-making

We do not use submitted waitlist data for automated decision-making or profiling that produces legal or similarly significant effects.

Your rights

You may request access to your personal data, correction, deletion, restriction of processing, objection to processing, data portability where applicable, or withdrawal of consent at any time by contacting [email protected]. Withdrawal of consent does not affect processing that occurred before withdrawal.

Complaints

If you believe your data protection rights have been violated, you may contact the competent data protection authority. In Switzerland, this is the Federal Data Protection and Information Commissioner.