Legal
Privacy notice
How Noccela Oy processes personal data on noccela.com and in business contacts: purposes, legal bases, recipients, retention, your rights and cookies.
Last updated 22 October 2026. This notice explains how Noccela Oy processes personal data when you visit noccela.com, contact us, do business with us or apply for a job with us. It is given under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
Who is responsible
The controller is:
Noccela Oy (Business ID 2616553-2)
Kaarinantie 700, 20660 Littoinen, Finland
E-mail: info@noccela.com (subject "Privacy")
Phone: +358 20 735 1180
Send all questions about this notice and all requests about your personal data to the address above.
What this notice covers
This notice covers personal data about:
- visitors to noccela.com
- people who contact us or book a meeting with us
- contact persons at our customers, partners, suppliers and prospects
- job applicants
It does not cover location data that a Noccela system collects at a customer's site. There, the customer decides what is tracked and why, and is the controller; Noccela processes the data on the customer's behalf under a data processing agreement. If your employer or another organisation uses a Noccela system, ask them how they process your data.
Summary
| Why we process data | What data | Legal basis | How long we keep it |
|---|---|---|---|
| Answering enquiries (contact form, e-mail, phone) | Name, company, e-mail, phone number, your message, time of contact | Steps you ask us to take before a contract (Art. 6(1)(b)); our legitimate interest in answering business enquiries (Art. 6(1)(f)) | Up to 24 months after our last exchange |
| Booking a meeting | Name, e-mail, optional phone number and notes, the time you choose | Steps you ask us to take before a contract (Art. 6(1)(b)) | 12 months after the meeting |
| Customer, partner and supplier relationships | Name, title, company, business contact details, correspondence, orders, contracts, invoices | Contract (Art. 6(1)(b)); legitimate interest in managing business relationships (Art. 6(1)(f)); legal obligations such as accounting (Art. 6(1)(c)) | For the duration of the relationship and up to 5 years after it ends; accounting records as long as the Finnish Accounting Act requires |
| Business-to-business marketing | Name, title, company, business e-mail and phone, your interests in our products | Legitimate interest in telling business contacts about relevant products (Art. 6(1)(f)); consent where the law requires it (Art. 6(1)(a)) | Until you object or the contact is no longer relevant, and at most 3 years after our last exchange |
| Recruitment | CV, application, contact details, information you give in interviews; references only with your consent | Steps you ask us to take before an employment contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | 12 months after the recruitment decision, longer only with your consent |
| Running and protecting the website | IP address, time, requested address, browser type, response status | Legitimate interest in a secure, working website (Art. 6(1)(f)) | Up to 30 days |
When you contact us
When you send the contact form, e-mail or call us, we use what you tell us to answer you and, if you ask, to prepare an offer, a demonstration or a pilot. The contact form sends your message to our own web server, which forwards it to us by e-mail or through our internal messaging tools; a copy stays in the server log for up to 30 days. To protect the form from abuse, the server briefly counts requests per IP address.
The meeting-booking link on our contact page opens a booking page provided by Microsoft. The details you enter there are stored in our Microsoft 365 environment and used only to arrange and hold the meeting.
Customers, partners and suppliers
We process the business contact details of the people we work with at customers, partners and suppliers to deliver products and services, provide support, send invoices and maintain the relationship. We may also tell business contacts about products, events and news that are relevant to their work. You can object to this at any time (see Direct marketing).
Job applications
If you apply for a job or send an open application, we use your application to assess whether you are suitable for a position at Noccela. We collect information primarily from you. We contact referees or use other sources only with your consent, as required by the Finnish Act on the Protection of Privacy in Working Life (759/2004). If you would like us to keep your application for future positions, tell us; otherwise we delete it 12 months after the recruitment decision.
Website logs and security
Like any web server, ours records technical information about each request: your IP address, the time, the address requested, your browser's user agent and the response status. We use these logs to keep the website running, to find faults and to detect and stop abuse. We do not use them to profile visitors. Logs are deleted within 30 days.
Where the data comes from
Most data comes from you. For business contacts it may also come from your employer or colleagues (for example when you are named as a contact person in a contract), from public sources such as company websites and the Finnish Trade Register, or from trade fairs and events where you give us your details.
Who receives the data
We do not sell personal data. We use service providers that process data on our behalf, under data processing agreements:
- Hosting and infrastructure providers that run this website and its server.
- E-mail providers that deliver e-mail to and from us.
- Microsoft, for e-mail, calendars and the meeting-booking page (Microsoft 365, including Exchange Online and Microsoft Bookings).
- Accounting, invoicing and e-invoicing service providers, for customer and supplier invoices.
We may also disclose data to authorities when the law requires it, and to our professional advisers, such as auditors and lawyers, under a duty of confidentiality.
Transfers outside the EU
We prefer service providers that process data in the European Union or the European Economic Area. If a provider or one of its subcontractors processes personal data outside the EU/EEA, for example in the United States, we transfer the data only with appropriate safeguards: an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or the Commission's standard contractual clauses. You can ask us for a copy of the safeguards.
How long we keep data
We keep personal data only as long as we need it for the purpose it was collected for, and then delete it or make it anonymous. The periods are given in the summary above. Where the law requires us to keep records longer, for example accounting records, we keep them for the period the law sets.
Your rights
You have the right to:
- know whether we process your personal data, and get a copy of it
- have inaccurate data corrected
- have your data erased, for example when we no longer need it
- restrict the processing of your data
- object to processing that is based on our legitimate interest
- receive the data you have given us in a machine-readable format and have it moved to another controller, where processing is based on consent or a contract
- withdraw your consent at any time, where processing is based on consent. This does not affect processing before the withdrawal.
To use your rights, e-mail info@noccela.com with the subject "Privacy". We may ask you to confirm your identity. We answer within one month; if a request is complex, we may extend this by up to two months and tell you why.
Direct marketing
You can object at any time to the use of your personal data for direct marketing. Reply to any of our messages or e-mail info@noccela.com, and we will stop. This is free of charge.
Complaints
If you think we process your data unlawfully, please tell us first so that we can put it right. You also have the right to lodge a complaint with the supervisory authority, the Office of the Data Protection Ombudsman:
Office of the Data Protection Ombudsman
Lintulahdenkuja 4, 00530 Helsinki, Finland (postal address: P.O. Box 800, 00531 Helsinki)
Phone: +358 29 566 6700
Website: tietosuoja.fi
Do you have to give us your data?
No law requires you to give us personal data. Without your contact details we cannot answer an enquiry, and without an application we cannot consider you for a job. Where we have a contract with you or your organisation, some data is needed to perform it.
We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
Cookies and tracking
This website does not use cookies for analytics or advertising and does not track you.
- There are no analytics, advertising or social media scripts on the website, and no third-party tracking pixels.
- Fonts, images and the site search are served from our own server, so loading a page does not send your data to other companies.
- Videos and social media profiles are plain links. Nothing from YouTube, LinkedIn or GitHub loads until you follow a link to their site, where their own privacy policies apply.
- The meeting-booking page is provided by Microsoft on its own domain; Microsoft's privacy statement applies there.
If we ever add cookies or similar technologies that need your consent, we will ask for it before using them, and we will update this notice first.
Changes to this notice
We update this notice when our processing changes. The date at the top shows when it was last changed. This notice replaces the privacy policy of the previous noccela.com website.