Legal
Privacy notice
How Noccela Oy processes personal data on noccela.com and in business contacts: purposes, legal bases, recipients, retention, your rights and cookies.
Last updated 27 October 2026. This notice explains how Noccela Oy processes personal data when you visit noccela.com, contact us, do business with us or apply for a job with us. It is given under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
Who is responsible
The controller is:
Noccela Oy (Business ID 2616553-2)
Kaarinantie 700, 20660 Littoinen, Finland
E-mail: support@noccela.com (subject "Privacy")
Send all questions about this notice and all requests about your personal data to the address above.
What this notice covers
This notice covers personal data about:
- visitors to noccela.com
- people who contact us or book a meeting with us
- contact persons at our customers, partners, suppliers and prospects
- job applicants
It does not cover location data that a Noccela system collects at a customer's site. There, the customer decides what is tracked and why, and is the controller; Noccela processes the data on the customer's behalf under a data processing agreement. If your employer or another organisation uses a Noccela system, ask them how they process your data.
Summary
| Why we process data | What data | Legal basis | How long we keep it |
|---|---|---|---|
| Answering enquiries (contact form, e-mail, phone) | Name, e-mail, company, phone number, topic, your message, the page you sent the form from, time of contact | Steps you ask us to take before a contract (Art. 6(1)(b)); our legitimate interest in answering business enquiries (Art. 6(1)(f)) | Up to 24 months after our last exchange |
| Booking a meeting | Name, e-mail, optional phone number and notes, the time you choose | Steps you ask us to take before a contract (Art. 6(1)(b)) | 12 months after the meeting |
| Customer, partner and supplier relationships | Name, title, company, business contact details, correspondence, orders, contracts, invoices | Contract (Art. 6(1)(b)); legitimate interest in managing business relationships (Art. 6(1)(f)); legal obligations such as accounting (Art. 6(1)(c)) | For the duration of the relationship and up to 5 years after it ends; accounting records as long as the Finnish Accounting Act requires |
| Business-to-business marketing | Name, title, company, business e-mail and phone, your interests in our products | Legitimate interest in telling business contacts about relevant products (Art. 6(1)(f)); consent where the law requires it (Art. 6(1)(a)) | Until you object or the contact is no longer relevant, and at most 3 years after our last exchange |
| Recruitment | CV, application, contact details, information you give in interviews; references only with your consent | Steps you ask us to take before an employment contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) | 12 months after the recruitment decision, longer only with your consent |
| Running and protecting the website | IP address, time, requested address, the page you came from, browser type, response status | Legitimate interest in a secure, working website (Art. 6(1)(f)) | Up to 30 days |
| Website statistics | Pages viewed, the site you came from, browser, operating system, device type, screen size, language and approximate location (country, region and city) derived from your IP address; the IP address itself is not stored | Legitimate interest in knowing how the website is used so that we can improve it (Art. 6(1)(f)) | As statistics for as long as we run the website; they contain nothing that identifies you directly (see Website statistics) |
When you contact us
When you send the contact form, e-mail or call us, we use what you tell us to answer you and, if you ask, to prepare an offer, a demonstration or a pilot. The contact form sends your message to our own web server, which e-mails it to us through Scaleway, an e-mail delivery service in France. Through the same service the server sends you a short automatic confirmation, at most once a day. A copy of your message stays in our server log for 30 days. To protect the form from abuse, the server counts requests per IP address in memory for a few minutes; these counts are not stored. Before the form can be sent, your browser also solves a small calculation (ALTCHA, a spam check that runs on your device and our own server). It sets no cookies, does not track you and sends nothing to another company.
The meeting-booking link on our contact page opens a booking page provided by Microsoft. The details you enter there are stored in our Microsoft 365 environment and used only to arrange and hold the meeting.
Customers, partners and suppliers
We process the business contact details of the people we work with at customers, partners and suppliers to deliver products and services, provide support, send invoices and maintain the relationship. We may also tell business contacts about products, events and news that are relevant to their work. You can object to this at any time (see Direct marketing).
Job applications
If you apply for a job or send an open application, we use your application to assess whether you are suitable for a position at Noccela. We collect information primarily from you. We contact referees or use other sources only with your consent, as required by the Finnish Act on the Protection of Privacy in Working Life (759/2004). If you would like us to keep your application for future positions, tell us; otherwise we delete it 12 months after the recruitment decision.
Website logs and security
Every request to the website passes through our web proxy, which records technical information about it: your IP address, the time, the address requested, the page you came from, your browser's user agent and the response status. We use these logs to keep the website running, to find faults and to detect and stop abuse. We do not use them for statistics or to profile visitors. The logs are kept in Google Cloud's logging service and deleted automatically after 30 days.
Where the data comes from
Most data comes from you. For business contacts it may also come from your employer or colleagues (for example when you are named as a contact person in a contract), from public sources such as company websites and the Finnish Trade Register, or from trade fairs and events where you give us your details.
Who receives the data
We do not sell personal data. We use service providers that process data on our behalf, under data processing agreements:
- Google Cloud (Google Cloud EMEA Limited, Ireland), which hosts this website, its server, the visitor statistics and the server logs. The website runs in Google Cloud's Finland region.
- Scaleway (Scaleway SAS, France), which delivers contact-form messages to us and the confirmation to you.
- Microsoft, for e-mail, calendars and the meeting-booking page (Microsoft 365, including Exchange Online and Microsoft Bookings).
- Accounting, invoicing and e-invoicing service providers, for customer and supplier invoices.
We may also disclose data to authorities when the law requires it, and to our professional advisers, such as auditors and lawyers, under a duty of confidentiality.
Transfers outside the EU
We prefer service providers that process data in the European Union or the European Economic Area. If a provider or one of its subcontractors processes personal data outside the EU/EEA, for example in the United States, we transfer the data only with appropriate safeguards: an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or the Commission's standard contractual clauses. You can ask us for a copy of the safeguards.
How long we keep data
We keep personal data only as long as we need it for the purpose it was collected for, and then delete it or make it anonymous. The periods are given in the summary above. Where the law requires us to keep records longer, for example accounting records, we keep them for the period the law sets.
Your rights
You have the right to:
- know whether we process your personal data, and get a copy of it
- have inaccurate data corrected
- have your data erased, for example when we no longer need it
- restrict the processing of your data
- object to processing that is based on our legitimate interest
- receive the data you have given us in a machine-readable format and have it moved to another controller, where processing is based on consent or a contract
- withdraw your consent at any time, where processing is based on consent. This does not affect processing before the withdrawal.
To use your rights, e-mail support@noccela.com with the subject "Privacy". We may ask you to confirm your identity. We answer within one month; if a request is complex, we may extend this by up to two months and tell you why.
Direct marketing
You can object at any time to the use of your personal data for direct marketing. Reply to any of our messages or e-mail support@noccela.com, and we will stop. This is free of charge.
Complaints
If you think we process your data unlawfully, please tell us first so that we can put it right. You also have the right to lodge a complaint with the supervisory authority, the Office of the Data Protection Ombudsman:
Office of the Data Protection Ombudsman
Lintulahdenkuja 4, 00530 Helsinki, Finland (postal address: P.O. Box 800, 00531 Helsinki)
Phone: +358 29 566 6700
Website: tietosuoja.fi
Do you have to give us your data?
No law requires you to give us personal data. Without your contact details we cannot answer an enquiry, and without an application we cannot consider you for a job. Where we have a contract with you or your organisation, some data is needed to perform it.
We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
Website statistics
We count visits with Umami, open-source statistics software that we run ourselves on our servers in Google Cloud's Finland region. When a page loads, your browser sends the page address and title, the site you came from, your language and your screen size to our own server, which passes them to Umami. Umami uses your IP address and browser details to tell visitors apart and to look up your approximate location, and then discards the IP address. The identifier that tells visitors apart changes every month and is not stored in your browser, so it cannot follow you from month to month or to other websites. No cookies are set and nothing is shared with other companies.
If your browser sends a Do Not Track signal, your visit is not counted.
Cookies and tracking
This website sets no cookies and does not track you across websites.
- Visits are counted with our own Umami installation, without cookies and without storing your IP address (see Website statistics). There are no advertising or social media scripts on the website, and no third-party tracking pixels.
- Fonts, images and the site search are served from our own server, so loading a page does not send your data to other companies.
- Videos and social media profiles are plain links. Nothing from YouTube, LinkedIn or GitHub loads until you follow a link to their site, where their own privacy policies apply.
- The meeting-booking page is provided by Microsoft on its own domain; Microsoft's privacy statement applies there.
If we ever add cookies or similar technologies that need your consent, we will ask for it before using them, and we will update this notice first.
Changes to this notice
We update this notice when our processing changes. The date at the top shows when it was last changed. This notice replaces the privacy policy of the previous noccela.com website.