1. Data controller
NIEL Ab
Sågvägen 9, 10660 Ekenäs, Finland
Privacy contact: benothman@carthavia.com
Data protection officer: not appointed (not required for our activities)
2. Applicable law
Depending on the circumstances, the EU General Data Protection Regulation (GDPR), applicable Finnish/Nordic legislation and Tunisian personal-data legislation (Organic Act No. 2004-63) may apply. Which rules apply depends on where we are established and whose data is processed.
3. Information we collect
The Website has no user accounts, analytics or advertising trackers. We process only:
- When you use the contact form: your name, email address, optional company name, the subject and your message, plus the language you used. To prevent spam and abuse we also store a one-way, salted fingerprint of your IP address and message (not the IP address itself). Form submissions are stored in our Lovable Cloud database and deleted 1 year after the last contact.
- When you email or call us: your name, email address, phone number, company, job title and the contents of your message, plus related correspondence history.
- When you visit the Website: technical connection data (such as IP address, browser and device information, requested page and time) processed by our hosting infrastructure to deliver and secure the Website.
- Preferences stored in your own browser: your chosen language and your cookie choices (see Cookie Policy).
4. Sources
We receive information directly from you (email, phone, meetings), automatically from your browser when visiting the Website, and where relevant from publicly available professional or business sources and business contacts in connection with a business relationship.
5. Purposes, legal bases and retention
| Purpose | Data | Legal basis (where GDPR applies) | Retention |
|---|---|---|---|
| Responding to inquiries | Contact details, message contents | Legitimate interests in answering inquiries; steps before entering a contract | 1 year after the last contact |
| Preparing proposals and performing engagements | Contact and business relationship information | Contract / steps before a contract | Duration of the relationship plus the applicable statutory limitation period |
| Invoicing and accounting | Billing and contract data | Legal obligation | As required by accounting law (currently 10 years under the Finnish Accounting Act for accounting records) |
| Delivering and securing the Website | Technical connection data | Legitimate interests in security and operation | Hosting provider logs kept for a short period set by the provider |
| Remembering language and cookie choices | Preference values in your browser | Strictly necessary / requested by you | Until you clear your browser storage or change your choice |
We do not currently use personal data for analytics or marketing. If that changes, we will update this policy and request consent where required.
6. Recipients and processors
- Website hosting and infrastructure: Lovable (website platform) and its infrastructure providers, including Cloudflare.
- Email provider: our business email service provider
- CRM provider: none used
- Accounting provider and professional advisers: as needed
We do not sell personal data.
7. International transfers
Because Carthavia operates between Tunisia and the Nordic/EU region, personal data may be processed both inside and outside the EU/EEA, including in Tunisia, and by infrastructure providers that may operate globally.
Where GDPR requires, transfers outside the EU/EEA will rely on an appropriate mechanism such as an adequacy decision or Standard Contractual Clauses.
Transfers from Tunisia are subject to Tunisian requirements.
8. Your rights
Depending on applicable law and circumstances, you may have the right to:
- access your personal data
- correct inaccurate data
- request deletion
- restrict processing
- object to processing based on legitimate interests
- data portability where applicable
- withdraw consent at any time, where processing is based on consent
- lodge a complaint with a competent supervisory authority
See the Privacy Request page for how to exercise these rights.
9. Complaints
If you are in the EU/EEA, you may contact the data protection supervisory authority in your country of residence, work or the place of the alleged infringement.
For Tunisia, the relevant authority is the national personal-data protection authority (Instance Nationale de Protection des Données Personnelles). In Finland, the authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).
10. Security
We use appropriate technical and organisational measures, including encrypted HTTPS connections and protective security headers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Deletion and backups
When data is deleted from active systems, copies may remain in backups operated by our providers for a limited period until they are overwritten in the normal backup cycle.
12. Children
Our services are intended primarily for businesses and professionals and are not directed at children. We do not knowingly collect personal data from minors.
13. Data minimisation
Please do not send us sensitive data such as identity or passport numbers, banking credentials, health information, political opinions, religious beliefs or biometric data. It is not needed for ordinary consulting inquiries.
14. Updates
We may update this policy. The effective date, last-updated date and version are shown on this page.