Privacy notice
Last updated 31 July 2026
This notice covers the personal data we handle as a business: enquiries, quotations and our own customer accounts. Personal data belonging to a sauna's own guests is handled under the data processing agreement instead.
1. Two different roles
Getting this distinction right matters, so it comes first.
- We are the controller for data about people who contact us, request a quotation, or administer a customer business. This notice covers that.
- We are the processorfor personal data about a sauna’s own customers held inside the platform. The sauna is the controller. That relationship is governed by the data processing agreement, not by this notice.
2. Who we are
Rí Labs Ltd, trading as Tigh Sauna, Ireland. For anything in this notice, email privacy@tighsauna.com.
3. What we collect and why
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, email, phone, business name and message | Answering an enquiry or demo request | Legitimate interests: responding to someone who contacted us | 24 months from last contact |
| Business name, address, VAT number, contact details, chosen plan | Producing and honouring a quotation, and answering questions about it | Steps at your request before entering a contract | 7 years, because it forms part of a financial record |
| Account administrator name, email and role | Running your account, billing and support | Performance of a contract | Duration of the contract, then 7 years for accounting records |
| Server logs, including IP address and pages requested | Keeping the service available and secure | Legitimate interests: security and service integrity | 30 days |
4. A note on quotations
A quotation is generated as a signed link. The business details you enter are encoded inside that link and are cryptographically bound to it, so the document cannot be altered after it is issued. Anyone holding the link can view the quotation, so treat it the way you would treat any document containing your business details. We also keep a copy so we can answer questions about it later.
5. Cookies and analytics
This website sets no advertising cookies, no tracking cookies and no third-party analytics that profile you. There is nothing here that follows you around the internet, which is also why there is no consent banner. See the cookie notice for the detail.
6. Who we share it with
Only the suppliers we need to run the business, listed on the sub-processors pagewith what each one does and where it is located. We do not sell personal data and we do not share it for anyone else’s marketing.
We may disclose data where the law requires it, or to establish or defend a legal claim.
7. Where it is held
Within the European Union. Where a supplier is outside the EEA, the transfer is covered by an adequacy decision or by standard contractual clauses, and that supplier is named on the sub-processors page.
8. Your rights
Under the GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to processing based on legitimate interests, and ask for it in a portable format. Email privacy@tighsauna.com and we respond within one month.
If you are unhappy with how we have handled your data you can complain to the Irish Data Protection Commission at dataprotection.ie. We would rather you came to us first, but that is your right and not conditional on anything.
9. Security
Encryption in transit and at rest, role-based access, logged administrative access and automated backups. The security overview sets out the controls in full, including what we do not claim.
10. Changes
If we change this notice materially we will tell customers by email. The date at the top always reflects the current version.