Privacy Policy

Sales and marketing register privacy notice (in Finnish) →

Data controller

NOX Visual Oy
Business ID: 3371824-6
Address: Ratsutie 2, Ylöjärvi
Data protection: info@noxvisual.fi

The controller has not appointed a Data Protection Officer, as the statutory obligation to appoint one does not apply to this processing. Data protection enquiries may be directed to the contact details above.

Purposes of processing

• Responding to enquiries submitted via the contact form
• Managing communications, customer service and potential pre-contractual customer relations
• Ensuring the technical operation and security of the website and contact form, preventing misuse and investigating errors
• Analysing how the website is used with Google Analytics, if you give your consent in the cookie banner (GDPR Art. 6(1)(a)) — this helps us improve content and usability. Google acts as a data processor and data may be transferred outside the EU with appropriate safeguards. You can withdraw your consent at any time via the "Cookie settings" link in the footer

We do not use contact form data for automated profiling, marketing automation or newsletters without a separate legal basis and information notice.

Legal basis for processing

We process personal data submitted via the contact form primarily on the basis of our legitimate interest (GDPR Art. 6(1)(f)): our legitimate interest is to handle enquiries sent to us, respond to them and manage communications with a person or organisation that has contacted us on their own initiative. In such a situation the contact has a reasonable expectation that the information they provide is used for responding, and processing is limited to what is necessary. If an enquiry leads to the preparation of a contract or a contractual relationship, personal data may also be processed for pre-contractual steps or the performance of a contract (GDPR Art. 6(1)(b)) to the extent necessary. For the technical operation, security and bot protection of the website and the form, the legal basis is our legitimate interest in keeping the site functional and secure. We have assessed that this interest does not override the visitor’s interests or rights: processing is limited to technically necessary data. We do not carry out automated profiling or make decisions based solely on automated processing (GDPR Art. 22). Google Analytics is based on your consent (GDPR Art. 6(1)(a)), which you give or decline in the cookie banner and can withdraw at any time via the "Cookie settings" link in the footer; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Completing the form is voluntary. Without the necessary contact details, however, we may not be able to respond to your enquiry.

Personal data collected

• Name
• Email address
• Possible telephone number, company name or other contact details if you provide them in your message
• Message content and other information you provide through the form
• Time of contact and handling history
• Technical log data (IP address, browser user agent, timestamp, server and error logs and security-relevant event data)
• Usage data collected by Google Analytics cookies (e.g. visits, pages viewed, approximate location, and device and browser information) — only if you give your consent in the cookie banner

We do not request special categories of personal data through the contact form. Please do not submit health data, national identification numbers, payment card details or other unnecessary confidential information through the form.

Sources of data

Personal data is primarily obtained directly from you when you complete the contact form or otherwise contact us. Technical log data is generated automatically when you use the website or submit the form.

Recipients and processors

Personal data is processed on behalf of the controller only by persons and service providers that need the data for the purposes described above. We use the following service providers / sub-processors:

• Resend Inc. (USA) — Email delivery service — data related to form submission and email delivery
• Vercel Inc. (USA) — Website hosting and infrastructure provider — technical data, logs and possibly form traffic
• Neon Inc. (USA) — PostgreSQL database service — form submissions and technical database data
• Cloudflare, Inc. (USA) — Form bot protection (Turnstile) — technical data related to form submission, such as IP address and browser data
• Google Ireland Ltd. / Google LLC (EU/USA) — Visitor analytics (Google Analytics) — only if you give your consent in the cookie banner. Google then receives e.g. visit data, pages viewed, approximate location, and device and browser information.

The service providers process personal data only on behalf of the controller and in accordance with the controller's instructions. The controller ensures that a data processing agreement or equivalent GDPR Article 28 arrangement is in place with each service provider.

Data may also be disclosed to public authorities where required by law or a binding authority request.

Transfers outside the EU or EEA

The technical implementation of the website uses service providers established in the United States, so personal data may be transferred outside the EU or EEA to the United States. Transfers are carried out using applicable safeguards, such as:

• the EU–US Data Privacy Framework (DPF), where the provider has a valid DPF certification covering the relevant data at the time of transfer,
• the European Commission's Standard Contractual Clauses (SCCs, Commission Implementing Decision 2021/914),
• the provider's Data Processing Agreement (DPA) and the technical and organisational measures described therein.

You may request further information on the applicable transfer safeguards by contacting the controller.

Retention period

Data submitted via the contact form is retained for a maximum of 24 months from the last contact, unless a longer retention period is necessary for pre-contractual steps, customer relationship management, the establishment, exercise or defence of legal claims, or compliance with a legal obligation.

Technical log data is retained only for as long as necessary for the technical operation and security of the website, troubleshooting and prevention of misuse. When data is no longer needed, it is deleted or anonymised.

Protection of personal data

We protect personal data using appropriate technical and organisational measures, which may include access controls, encrypted connections, service provider security practices, logging, backups and system and access management procedures. Access to personal data is limited to persons and service providers who need to process the data for the purposes described in this policy.

Your rights

As a data subject, you have the following rights under applicable data protection law:

• Right of access (Art. 15) — You may request confirmation as to whether we process personal data concerning you and obtain a copy of the data being processed.
• Right to rectification (Art. 16) — You may request the correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — You may request deletion of your data where there is no longer a basis for processing or where another condition under GDPR Article 17 is met.
• Right to restriction (Art. 18) — You may request restriction of processing, for example while disputing the accuracy of the data.
• Right to data portability (Art. 20) — This right applies only to data processed by automated means on the basis of consent or contract. It generally does not apply to processing based on legitimate interests.
• Right to object (Art. 21) — You may object to processing based on legitimate interests on grounds relating to your particular situation. We will stop the processing unless we have compelling legitimate grounds to continue or the processing is necessary for the establishment, exercise or defence of legal claims.
• Right not to be subject to automated decision-making (Art. 22) — We do not make decisions concerning you based solely on automated processing, nor do we profile you in connection with the processing described in this policy.

To exercise your rights, contact the controller using the contact details above. We will generally respond within one month of receiving the request (GDPR Art. 12). We may ask you to verify your identity before fulfilling the request.

You have the right to lodge a complaint with the competent supervisory authority. In Finland, the supervisory authority is the Finnish Data Protection Ombudsman, PO Box 800, FI-00531 Helsinki, Finland, tietosuoja.fi.

Cookies and similar technologies

We always use cookies and similar technologies that are necessary for the site to function (e.g. session, security and form bot protection). In addition, we use Google Analytics cookies (e.g. _ga, stored for up to 2 years) only with your consent, to analyse visitor numbers and how the site is used. You can accept or decline them in the cookie banner and change your choice at any time via the "Cookie settings" link in the footer; withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

When you make a choice in the cookie banner, we record it to be able to demonstrate that consent was given (GDPR Art. 7): the content of your choice, a timestamp, a random technical identifier, browser information and a salted hash derived from your IP address — not your raw IP address, name or contact details.