Information Security Principles

Upea Puu is a brand operated by Trissixty. We handle customer and marketing register data with care and protect it with technical and organisational measures. These principles complement our Privacy Policy.

Registers and data

• Customer and order register: name, email, shipping address, order details.
• Marketing register: email address and consent records (source and timestamp).
• Usage data: cookie consents and anonymous statistics.

Security principles

• Data is transmitted encrypted (HTTPS/TLS) and stored encrypted at our hosting provider.
• Access is limited to named individuals with a work-related need (least privilege).
• Admin accounts are personal and strongly protected; role-based permissions are verified server-side.
• Card details are never processed or stored in our own systems; payments are handled by a PCI DSS compliant payment provider.
• Row-level access rules in the database prevent unauthorised access to records.
• Service providers and sub-processors operate within the EU/EEA or under equivalent safeguards.

Retention and minimisation

We collect only the data required to run the service. Order data is retained for the period required by accounting and tax law, and marketing consent until it is withdrawn. Unnecessary data is deleted or anonymised.

Backups and continuity

The database is backed up regularly and restores are tested. Software updates and dependency security checks are performed on a routine basis.

Incident management

Detected security incidents are investigated without delay. Where an incident is likely to result in a risk to individuals' rights, we notify the supervisory authority within 72 hours and, where required, the individuals concerned.

Your rights and contact

You may request access, correction, portability or deletion of your data, and withdraw consent at any time: privacy@trissixty.com. Security findings can be reported to the same address.