Privacy policy

Tullisali / Qstock Oy

Prepared in accordance with the EU General Data Protection Regulation (GDPR, 2016/679) and the Finnish Data Protection Act (1050/2018). This policy covers the website www.tullisali.fi and the personal data collected through it. Updated: 19 August 2026.

1. Data Controller

Qstock Oy (Tullisali)
Business ID 2811591-8
Kansankatu 53 T3, 90100 Oulu

2. Contact person for data protection matters

Binta Jabbi
binta.jabbi@qstock.fi
040 456 4113

3. What this policy covers

Qstock Oy processes personal data on the Tullisali website in three separate contexts, each described as its own section under point 4: subscribing to the newsletter, filling in the feedback/contact form, and website visitor tracking and marketing targeting via cookies.

4. Purposes of processing, legal bases, and data content

4.1 Newsletter

Purpose of use: informing subscribers by email about Tullisali’s events, tickets, and current matters.
Legal basis: the data subject’s consent (GDPR Article 6(1)(a)).
Data collected: email address. Consent is collected either through the website’s newsletter form or through direct marketing permission given via the Ticketmaster.fi website.
Retention period: for as long as the subscription is active. The subscriber may cancel the subscription at any time via the link at the bottom of the newsletter, after which the data is deleted.

4.2 Feedback form / contact

Purpose of use: responding to contact requests and feedback, and handling customer service.
Legal basis: the controller’s legitimate interest in responding to inquiries addressed to it (GDPR Article 6(1)(f)).
Data collected: name, email address, and phone number (mandatory), as well as organization and message content (optional).
Retention period: data submitted through the form is automatically deleted 365 days after submission (automatic deletion by the WordPress form system). The same 365-day automatic deletion has also been implemented in the customer service email inbox to which the form data is forwarded, so that the data does not remain in email longer than in the form.

4.3 Cookies, visitor tracking, and marketing targeting

Purpose of use: analyzing website usage (visitor numbers, behavior) and forming target groups for marketing campaigns and measuring their effectiveness.
Legal basis: consent (GDPR Article 6(1)(a)). Non-essential cookies and tracking identifiers are only loaded once the visitor has given consent via the cookie banner.

Services in use:

  • Google Analytics 4 — visitor statistics (Google LLC)
  • Google Tag Manager — management of the above and other tracking identifiers on the website (Google LLC)
  • Meta / Facebook Pixel — forming target groups for marketing campaigns and measuring advertising effectiveness (Meta Platforms, Inc.)

Cookie consent is managed using the Cookiebot tool. An up-to-date, technical list of the cookies in use, their purpose, and their validity period is available on the cookie settings page.

5. Recipients and processors of data

Newsletter data: the Creamailer system (email marketing). The service’s data is located on servers within the EU, and data security complies with Finnish and EU legislation (including Traficom regulation TRAFICOM/54045/03.04.05.00/2020).
Feedback form data: form data is forwarded by email to Tullisali’s customer service and is processed there internally by Qstock Oy in the Microsoft 365 email service (Microsoft Ireland Operations Limited / Microsoft Corporation). Automatic deletion after 365 days is in use in both the form system and the receiving email inbox.
Cookies and tracking: Google LLC (Google Analytics 4, Google Tag Manager) and Meta Platforms, Inc. (Facebook Pixel) act as data recipients in accordance with their own terms of service. Cookiebot (Usercentrics A/S) acts as the processor for consent management.

6. Transfer of data outside the EU or EEA

Google and Meta also process data in the United States. Transfers are based on the EU-US Data Privacy Framework insofar as the service provider is certified under the framework, or alternatively on the European Commission’s approved Standard Contractual Clauses (SCCs).
Feedback form data is processed in the Microsoft 365 service. Microsoft offers EU customers the option to keep stored data within the EU (EU Data Boundary), but some processing (e.g., technical support, diagnostics) may still take place outside the EU depending on the tenant’s settings.
Data collected by Google Analytics 4 is retained for 26 months from the time of collection. IP addresses are not combined with other Google data and are shortened so that an individual user cannot be identified.
The external service provider of Qstock Oy’s Whistleblowing channel (Falcony) uses subcontractors, some of which are located in the United States. Appropriate safeguards have been ensured through contractual means. See the Whistleblowing channel’s own privacy policy: https://app.falcony.io/oulun-karpat-oy/links/whistleblowing
Otherwise, data is not disclosed to third parties or transferred outside the EU or EEA.

7. Principles of register protection

The use of the register is regulated within Qstock Oy’s organization, and access to the data is restricted to those employees who need the data for their work duties. Staff processing personal data are bound by a duty of confidentiality. Only designated persons use the Creamailer system, and outside parties have no access to it.

8. Rights of the data subject

  • The right to check what data has been stored in the register.
  • The right to demand correction of inaccurate data or completion of incomplete data.
  • The right to request the deletion of data (“the right to be forgotten”).
  • The right to demand restriction of processing in certain situations.
  • The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
  • The right to lodge a complaint with a supervisory authority if the data subject considers that their data has been processed unlawfully.

Requests should be addressed to the controller by email (see point 2). The controller may ask the person making the request to prove their identity and will respond to the request within the time period prescribed by the EU General Data Protection Regulation (as a rule, within one month).

Contact details of the supervisory authority:
Office of the Data Protection Ombudsman
P.O. Box 800, 00531 Helsinki
tietosuoja@om.fi
029 566 6700
www.tietosuoja.fi

9. Changes to this policy

This policy may be updated as needed, for example due to changes in legislation, practices, or the services in use. The current version is always available at www.tullisali.fi/yksityisyydensuoja/.