Login
Try the Demo

Privacy Policy.

Last updated: 27 August 2026

At Tuleva, we believe that better circularity starts with better information.

This Privacy Policy explains how Tuleva (“Tuleva”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal data when you visit our website, create or use a Tuleva account, access or use our platform, or otherwise interact with our services.

Tuleva is designed for organisations, professionals, and individuals working within the circular economy and circular fashion ecosystem. Because we operate in or provide services to users in the European Economic Area (“EEA”), we process personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), where applicable.

Please read this Privacy Policy carefully to understand how we handle your information.

1. Who We Are

The organisation responsible for your personal data is:

Legal entity: Tuleva 
Registered address: Lisbon, Portugal
Country: Portugal 
Privacy email: hello@mytuleva.com
Website: https://mytuleva.com

For questions concerning privacy or your personal data, you can contact us at:

Privacy enquiries: hello@mytuleva.com

Where applicable, details of our Data Protection Officer or EU representative will be provided below:

Data Protection Officer / EU Representative: 

2. What This Policy Covers

This Privacy Policy applies to personal data collected through:

  • The Tuleva website;
  • Tuleva user accounts;
  • The Tuleva platform and dashboard;
  • Forms and other information submitted through Tuleva;
  • Communications between you and Tuleva;
  • Product usage and technical information; and
  • Other services or interactions that expressly refer to this Privacy Policy.

This Policy does not necessarily apply to personal data that organisations upload to Tuleva as part of their own activities where those organisations determine the purposes and means of processing that data.

In those circumstances, the organisation using Tuleva may act as the data controller, while Tuleva may act as a data processor on its behalf.

3. The Data We Collect

The type of personal data we collect depends on how you interact with Tuleva.

3.1 Information You Provide Directly

Depending on the service you use, we may collect information such as:

  • Name;
  • Email address;
  • Job title or professional role;
  • Organisation name;
  • Organisation contact details;
  • Account login information;
  • Profile information;
  • Information submitted through forms;
  • Communications and enquiries sent to us; and
  • Information required to provide or administer our services.

We only request information that is reasonably necessary for the relevant purpose.

3.2 Account and Platform Information

When you create or use a Tuleva account, we may collect information such as:

  • Account details;
  • Organisation or business profile information;
  • User role and permissions;
  • Account activity;
  • Records and information you submit to the platform;
  • Changes made to Records; and
  • Information relating to platform usage.
3.3 Technical Information

When you access our website or platform, certain technical information may be collected automatically, including:

  • IP address;
  • Browser type and version;
  • Device type;
  • Operating system;
  • Approximate location derived from technical information;
  • Date and time of access;
  • Pages or features accessed;
  • Referring website;
  • Error and diagnostic information; and
  • Security and authentication logs.

Some of this information may constitute personal data under applicable data protection laws.

3.4 Cookies and Similar Technologies

We may use cookies and similar technologies to operate our website and platform, remember preferences, understand how our services are used, improve our services, and, where applicable, measure or analyse website activity.

Our use of cookies is explained in more detail in our Cookie Policy.

4. How We Use Personal Data

We may process personal data for the following purposes.

Providing and Operating Tuleva

We may use information to:

  • Create and manage accounts;
  • Provide access to the Tuleva platform;
  • Provide requested features and services;
  • Manage user permissions;
  • Process and manage Records;
  • Maintain organisation profiles;
  • Generate requested Outputs and reports; and
  • Provide customer and technical support.
Improving Tuleva

We may use information to:

  • Understand how the platform is used;
  • Identify technical problems;
  • Improve usability and functionality;
  • Develop and improve existing or new features; and
  • Monitor platform performance.

Where possible, we use aggregated or de-identified information for analytical and product-improvement purposes.

Security and Fraud Prevention

We may process information to:

  • Protect accounts;
  • Detect suspicious activity;
  • Prevent unauthorised access;
  • Investigate security incidents; and
  • Maintain the integrity and security of our services.
Communications

We may use contact information to:

  • Respond to enquiries;
  • Send service-related communications;
  • Provide important account or security notices;
  • Communicate about changes to our services; and
  • Send marketing communications where permitted by law and where the appropriate legal basis exists.
Legal and Regulatory Obligations

We may process personal data where necessary to:

  • Comply with applicable laws;
  • Respond to lawful requests from authorities;
  • Establish, exercise, or defend legal claims; and
  • Maintain appropriate business and compliance records.

5. Our Legal Bases for Processing

Under the GDPR, we process personal data only where a lawful basis exists.

Depending on the circumstances, we may rely on the following legal bases.

Contract

We may process personal data where it is necessary to provide a service or perform a contract with you.

For example, account information may be processed to provide you with access to Tuleva.

Legitimate Interests

We may process personal data where it is necessary for our legitimate interests, provided that those interests are not overridden by your rights and freedoms.

These interests may include:

  • Maintaining and improving Tuleva;
  • Securing our systems;
  • Preventing fraud and abuse;
  • Understanding product performance;
  • Managing our business; and
  • Communicating with existing users about relevant services.

Where we rely on legitimate interests, we consider the potential impact on individuals and apply appropriate safeguards.

Consent

Where required, we may process personal data based on your consent.

You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Legal Obligation

We may process personal data where necessary to comply with a legal obligation applicable to us.

6. Data Submitted Through Tuleva by Organisations

Tuleva is a platform for organisations to document and manage circular activities, Records, and impact information.

An organisation using Tuleva may upload or otherwise submit information relating to individuals as part of its own activities.

In these circumstances, the organisation may determine:

  • Why the information is being collected;
  • What information is collected;
  • How the information is used; and
  • How long it should be retained.

The organisation may therefore act as the data controller, while Tuleva acts as a data processor.

Where Tuleva acts as a processor, we process personal data only in accordance with the applicable agreement and documented instructions of the relevant organisation, subject to applicable law.

Organisations using Tuleva are responsible for ensuring that they have an appropriate legal basis for collecting and providing personal data to Tuleva and that their processing complies with applicable data protection laws.

Where required, Tuleva will enter into an appropriate Data Processing Agreement (“DPA”) with customers acting as controllers.

7. Categories of Personal Data

Depending on how Tuleva is used, personal data may include:

  • Identification information;
  • Contact information;
  • Professional information;
  • Organisation-related information;
  • Account and authentication information;
  • Platform activity information;
  • Technical and device information;
  • Communications; and
  • Information contained within Records submitted by organisations.

Tuleva does not intentionally request special categories of personal data, such as information concerning health, biometric data, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation, unless such processing is specifically required, lawfully permitted, and appropriately safeguarded.

Users and organisations should not submit unnecessary sensitive personal data to Tuleva.

8. How We Share Personal Data

We do not sell personal data.

We may share personal data with carefully selected third parties where necessary to operate Tuleva, provide our services, comply with legal obligations, or otherwise fulfil a legitimate purpose.

These parties may include:

Service Providers

We may use third-party providers for services such as:

  • Cloud hosting and infrastructure;
  • Database and storage services;
  • Authentication;
  • Email delivery;
  • Analytics;
  • Customer support;
  • Security;
  • Error monitoring; and
  • Other technical infrastructure.

Where these providers process personal data on our behalf, we require appropriate contractual and data protection safeguards.

Legal and Regulatory Authorities

We may disclose information where required by applicable law, legal process, or a lawful request from a competent authority.

Business Transactions

If Tuleva is involved in a merger, acquisition, restructuring, financing, sale of assets, or similar transaction, personal data may be transferred as part of that transaction, subject to applicable legal requirements and appropriate safeguards.

9. International Data Transfers

Some of our service providers or infrastructure may be located outside the European Economic Area.

Where personal data is transferred outside the EEA, we will take appropriate steps to ensure that the transfer complies with applicable GDPR requirements.

Depending on the circumstances, this may include:

  • An adequacy decision adopted by the European Commission;
  • Standard Contractual Clauses approved by the European Commission;
  • Other lawful transfer mechanisms recognised under applicable data protection law; and
  • Additional safeguards where required.

Information about relevant international transfers and applicable safeguards can be obtained by contacting us using the details provided in this Policy.

10. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to:

  • Provide our services;
  • Maintain accounts;
  • Meet contractual obligations;
  • Resolve disputes;
  • Maintain security;
  • Comply with legal obligations; and
  • Establish, exercise, or defend legal claims.

Retention periods may vary depending on the type of information and the purpose for which it is processed.

Where a specific retention period cannot reasonably be determined in advance, we use appropriate criteria to determine how long information should be retained.

When personal data is no longer required, we will delete it, anonymise it, or otherwise securely dispose of it where appropriate.

11. Your Rights Under the GDPR

Where the GDPR applies, you may have the following rights:

  • Right to Be Informed: You have the right to understand how and why your personal data is processed.
  • Right of Access: You may request a copy of the personal data we hold about you.
  • Right to Rectification: You may ask us to correct inaccurate or incomplete personal data.
  • Right to Erasure: In certain circumstances, you may ask us to delete your personal data.
  • Right to Restriction: In certain circumstances, you may request that we restrict the processing of your personal data.
  • Right to Data Portability: Where applicable, you may request your personal data in a structured, commonly used, and machine-readable format and, where technically feasible, request that it be transmitted to another controller.
  • Right to Object: You may object to certain processing, including processing based on legitimate interests.

You may also object to direct marketing at any time.

  • Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time.
  • Rights Relating to Automated Decision-Making: Where applicable, you have rights concerning decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

Tuleva does not currently make decisions producing legal or similarly significant effects about individuals solely through automated processing.

12. How to Exercise Your Rights

To exercise your rights, contact us at: hello@mytuleva.com

Please provide enough information for us to identify your account or request.

We may need to verify your identity before fulfilling a request in order to protect personal data from unauthorised disclosure.

We will normally respond to valid GDPR requests within one month. Where permitted by law, this period may be extended where a request is particularly complex or where multiple requests are made.

13. Your Right to Complain

If you believe that we have processed your personal data unlawfully or have not adequately addressed your privacy concerns, you have the right to lodge a complaint with a competent data protection supervisory authority.

You may contact the supervisory authority in the EU/EEA country where you live, work, or where you believe an infringement occurred.

A list of European data protection authorities is maintained by the European Data Protection Board.

14. Data Security

We use appropriate technical and organisational measures designed to protect personal data against:

  • Unauthorised access;
  • Unauthorised disclosure;
  • Accidental loss;
  • Destruction;
  • Alteration; and
  • Other unlawful or unauthorised processing.

Security measures may include access controls, authentication mechanisms, system monitoring, secure communications, and appropriate organisational controls.

No internet-based service can guarantee absolute security. Users are also responsible for protecting their account credentials and using Tuleva responsibly.

More information about our security practices is available in our Data & Security Policy.

15. Children’s Data

Tuleva is designed primarily for organisations, professionals, and business users.

Our services are not directed at children.

We do not knowingly collect personal data from children where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to us in circumstances where this should not have occurred, please contact us so that we can investigate and take appropriate action.

16. Automated Decision-Making and Profiling

We do not currently use personal data to make decisions about individuals that produce legal or similarly significant effects solely through automated decision-making.

Tuleva may use aggregated or technical information to understand platform usage, improve services, detect security issues, or provide product functionality.

If our use of automated decision-making or profiling changes materially, we will update this Privacy Policy and provide any information required by applicable law.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • Changes to Tuleva;
  • Changes to our data processing activities;
  • Changes in technology; and
  • Changes in applicable laws or regulatory requirements.

When we make material changes, we will take reasonable steps to notify users where required.

The “Last updated” date at the top of this Policy indicates when it was most recently revised.

18. Contact Us

If you have questions about this Privacy Policy, our handling of personal data, or your rights, please contact us:

Tuleva 
Lisbon, Portugal
Privacy: hello@mytuleva.com
General enquiries: hello@mytuleva.com

Related Policies

Login
Try the Demo