Privacy notice
This notice explains the information used to provide Tsumira, the role of your organization and how to contact us about your rights.
On this page
Controller and contact
- Company
- SourceArt Ltd
- Registered address
- Evagora Pallikaridi 38 8010 Pafos Cyprus
- Represented by
- Steve vom Wege
- [email protected]
- Telephone
- +49 178 5495650
Who is responsible and what this notice covers
SourceArt Ltd is the controller for the operation of this company website, direct inquiries, account administration and our relationship with customers. Its registered address and privacy contact are shown on this page.
When a customer organization enters information about its own customers, employees or other people in a workspace, that organization determines the purposes of that business processing. Tsumira handles such data to provide the service and follow the organization’s instructions and applicable arrangements. A request about that data may therefore need to be handled with the organization responsible for the workspace.
Visiting the website and technical operation
Delivering a page requires technical connection information, including an IP address, requested address, time and browser or device communication information. Infrastructure and security systems use such information to deliver content, diagnose faults and prevent abuse.
Our hosting and delivery setup uses Hetzner infrastructure and Cloudflare for network delivery and protection. Public fonts and website illustrations are served through the website. This company website currently loads no audience-measurement or advertising scripts; merely visiting these pages does not load the legacy Google Analytics integration.
Contact, registration and customer administration
When you contact us, we process the contact details and content you provide to answer and follow up on your request. Workspace registration requests include company name, owner name, email, workspace address, company size, industry and language, together with the registration and confirmation records.
Registration may include limited campaign tags for source, medium and campaign where supplied in the registration link. These are saved with the registration context, not treated as proof of an advertising impression. Technical rate limits and matching values help prevent repeated or abusive registration. Required contact and verification information is needed to create and secure the requested access.
Information inside a workspace
Enabled modules may hold customer and contact records, messages, email, documents, files, bookings, projects, time entries and financial information entered or imported by the customer. Access follows workspace membership, roles and the relevant sharing settings. Authorized operational staff may process information where needed for support, security and operation.
Publishing a page, inviting an external participant, sharing a resource or connecting another company can make the selected information available to the intended recipients. Workspace administrators and users should check the audience and permissions before taking those actions. Public marketing examples do not themselves connect an external account or send workspace information to a listed integration.
Cookies and local browser storage
Requested sign-in, session security, language selection and workspace recall use browser cookies or local storage. The table describes principal functions; cookies are set when the relevant function is used, not all on every public page visit. Session cookies are separate from a remembered workspace address.
The workspace recall function stores up to three workspace addresses and display names. It does not contain a password or an authenticated session. Its browser-local record can remain until removed; the corresponding cookie has a maximum configured duration. You can remove browser storage in your browser settings, but clearing a session or language cookie can sign you out or reset that preference.
| Name or function | Purpose | Storage or validity |
|---|---|---|
tsm_op / tsm_portal | Workspace or customer-portal sign-in | Up to 30 days; can expire or be revoked earlier |
tsm_admin | Restricted platform administration session | Up to 8 hours |
tsm_share | Session for a supported shared-resource access | Up to 1 hour; the shared link can have a separate expiry |
locale | Language selected through the application language control | Up to 365 days |
tsm_ws_recent | Recall up to three workspace addresses and display names | Cookie: up to 400 days; local browser copy until removed |
Service email and delivery information
Tsumira uses the configured Brevo mail transport for service email, such as invitations, verification, account messages and supported customer communication. The transport receives the required sender and recipient details, subject and message content, and attachments when included.
Delivery identifiers and delivery or failure events support reliable sending and the visible communication status. A message sent through a connected customer mailbox additionally involves that mailbox provider and its configured permissions. An ordinary inquiry or workspace registration does not by itself subscribe you to a marketing newsletter.
Optional AI and connected providers
When an enabled AI function is used, the relevant prompt, selected files or audio and authorized workspace context may be sent to the provider configured for that function. The implementation supports providers including OpenAI, Anthropic and fal; their actual use depends on the chosen function and configuration.
Only submit information that your organization is permitted to send for that purpose. AI proposals and actions remain subject to the relevant permissions and review controls. Processing by a selected provider depends on the function and its applicable terms. Ask us about the provider and processing context relevant to your workspace.
Optional GIF search and external media
If the organization enables GIPHY GIF search, search terms, language, display or selection events and a pseudonymous user identifier may be sent through our server to GIPHY. The identifier is derived separately for the organization; it is not a plain name, email address or account ID.
Displaying a GIPHY GIF also connects your device to the provider’s media servers, which receive connection information such as IP address and browser details. GIPHY uses these requests to provide search and media and for its service measurement. If GIPHY is not enabled, this search integration is not used; organization-provided media follows its own storage and sharing context.
Service providers and other recipients
Infrastructure, mail and enabled external services process the information needed for their respective task. The following links describe the providers’ own policies; they do not replace the organization-specific instructions and agreements governing customer data.
Information can also be disclosed to an intended recipient you select, an authorized adviser or a competent authority where a legal requirement applies. We do not infer a right to disclose an entire workspace merely because a person has access to one record.
- Provider privacy information
Hetzner
Hosting infrastructure; stored service data and technical operation.
- Provider privacy information
Cloudflare
Network delivery and protection; connection and request information.
- Provider privacy information
Brevo
Configured service email transport; recipients, messages, attachments and delivery events.
- Provider privacy information
GIPHY
Only when enabled: GIF search, external media delivery and related usage events.
Purposes and legal grounds
Where the GDPR applies to our processing as controller, Article 6(1)(b) applies to processing necessary for a contract with you or steps requested by you before entering that contract. Business-contact and account administration, necessary operation, network security and abuse prevention are based on Article 6(1)(f), with our interests in handling the business relationship and providing a reliable, secure service balanced against the rights of the people concerned.
Article 6(1)(c) applies where a specific legal obligation requires retention or disclosure. When a particular optional processing operation is based on consent, Article 6(1)(a) applies and consent can be withdrawn for the future. The customer organization remains responsible for the grounds for its own workspace processing. This paragraph does not turn acceptance of every optional function into a condition for simply reading the website.
Processing locations and international transfers
Our registered office is in Cyprus. Infrastructure and connected providers may process information in other countries, including countries outside the European Economic Area, such as the United States. Processing locations depend on the particular service, enabled function and agreed settings.
Transfers subject to the GDPR must meet its international-transfer requirements. The applicable recipient, location and safeguard depend on the particular service and arrangement; contact us for information about the processing relevant to you and any applicable safeguards.
How long information is kept
Information is retained for the purpose for which it is needed, taking account of account use, outstanding inquiries, security requirements and applicable legal retention duties. Workspace information also depends on the customer’s instructions, document status and deletion arrangements.
The registration workflow records a necessity-review point around one year after registration. This is not automatic deletion after one year. Session expiry does not delete business records. Backups, audit evidence and records that must be preserved can have a different lifecycle from a visible working copy; contact us about a specific deletion request.
Access and security
The service uses encrypted network connections, scoped sessions, role-based access and operational controls intended to protect information against unauthorized access and misuse. Workspace permissions and the intended recipient remain important even when the technical connection is encrypted.
Please protect your credentials, check sharing choices and contact us promptly if you suspect unauthorized access. We investigate reports and assess the steps needed to protect the affected accounts and information.
Your rights and how to exercise them
Under the applicable conditions, GDPR rights include access, correction, erasure, restriction, portability and objection. You can object to processing based on legitimate interests on grounds relating to your situation, and to direct marketing at any time. Consent can be withdrawn without affecting the lawfulness of earlier processing.
Write to the contact address on this page. We may need information to verify your identity and locate the relevant account. GDPR requests are normally answered within one month; legally permitted extensions and exceptions can apply. You may complain to a supervisory authority, including the authority at your habitual residence or workplace or the place of the alleged infringement. The Cyprus Commissioner for Personal Data Protection provides information at the link below.
Cyprus Commissioner for Personal Data ProtectionChanges and further questions
This notice describes the website and service context at the date shown above. We update it when relevant processing changes. Information shown for a particular connection or workspace and any applicable data-processing arrangements should also be considered.
For questions about the controller, a provider or a particular use of your information, contact SourceArt Ltd using the details on this page.
Questions about your data?
Contact us about the website, your account or a privacy request. For data managed by your employer or another customer organization, identify the relevant workspace so the request can reach the responsible organization.