Quick Links
1 . Overview
NuPath Oy, Finnish Business ID 3438346-8. Email: info@nu-path.eu. Correspondence: PL 17 02101 Espoo, Finland. Website: https://nu-path.eu.
The policy covers information handled by NuPath personnel and providers acting on our behalf, including personal data, asset maps, fibre routes, technical drawings, event records and security arrangements. Confidential infrastructure data can require protection even when the EU General Data Protection Regulation (GDPR) does not apply to it.
2 . Data in monitoring systems
Depending on the selected configuration, NUSwift Echo, Thermo and Trace produce acoustic, temperature or fibre diagnostic information; Insight analyses events; and DigiEye brings operational information together. A project may combine measurements with timestamps, locations, camera images, vehicle information, alerts and operator activity.
Raw measurements, event labels and aggregate statistics must be assessed in context. They may relate to identifiable people when combined with other information. Removing a name or replacing it with an identifier does not necessarily make data anonymous.
Before collection, the project must define what data is necessary, who is allowed to receive it, how long it is retained and whether any data can be anonymised or processed locally. Sensitive drawings, credentials and detailed site-security information must use an agreed secure channel, not a general website enquiry form.
3 . Roles and deployment responsibilities
NuPath website and business contacts - NuPath is controller for the purposes described in its Privacy Policy.
Customer system operated without NuPath access to personal data - The customer determines its own controller obligations. Supplying equipment or software alone does not make NuPath a processor of data it does not process.
NuPath hosts, accesses or supports customer personal data on instructions - The parties must document controller and processor roles and execute the required data processing agreement before that processing starts.
The parties jointly determine purposes and essential means - Assess joint controllership and put the required allocation of responsibilities in place.
Roles follow the actual processing, not just a contractual label. The customer must establish a lawful purpose and basis for its monitoring and provide required notices. NuPath must fulfil its own duties for its role and alert the customer if, as processor, an instruction appears to infringe applicable data protection law.
4 . Privacy and proportionate monitoring
Project design must limit monitoring zones, identifiers, access and retention to the agreed purpose. Where possible, use an event or aggregate record instead of retaining an unnecessary continuous personal-data record. Camera and vehicle integrations require their own assessment; fibre sensing does not remove that requirement.
Monitoring in workplaces, publicly accessible areas and regulated sites must be assessed against the applicable local privacy, surveillance and employment requirements. High-risk personal-data processing requires a data protection impact assessment before it begins.
Biometric identification, recording of intelligible speech and processing of special-category data require separate legal and technical assessments before being enabled. Special-category data also requires an applicable condition under Article 9 of the GDPR. AI-assisted event labels require suitable validation and human oversight for the decisions they support. They must not be treated as conclusive evidence about an individual.
5. Access and security requirements
Controls must reflect the risk, deployment architecture and responsibilities agreed with the customer. The baseline assessment must address the following measures, selecting and documenting the controls appropriate to the system:
· Named accounts, access limited by role, timely removal of access and stronger authentication for privileged or remote access.
· Protection of data in transit and risk-appropriate protection at rest, with controlled credentials, keys and secrets.
· Separation of customer environments and restrictions on connections between operational systems and external services.
· Security logging, patch and vulnerability management, secure configuration and controlled changes.
· Backups, recovery arrangements and testing proportionate to the agreed availability and retention requirements.
· Confidentiality obligations, appropriate staff guidance and controls over portable copies and exports.
The project security specification or contract identifies the controls actually delivered, support boundaries and any required evidence. This public policy does not claim a particular certification, guarantee uninterrupted monitoring or establish a service level.
6 . Hosting and remote access
For each project, the parties must agree the hosting model, processing countries, provider roles and permitted remote access. On-premises hosting alone does not rule out transfers if support staff or connected services outside the European Economic Area (EEA) can access personal data.
Providers and subprocessors must receive only the access needed for their approved tasks. Personal-data transfers outside the EEA require an applicable transfer mechanism and any necessary supplementary safeguards. A requirement for EU-only or local-only processing must be expressly defined, technically supported and reflected in the supplier chain.
7 . Retention and the end of a service
The customer configuration and agreement must define retention for raw measurements, event records, video, vehicle data, account logs, exports and backups. High data volumes or the possibility of later analysis do not by themselves justify indefinite retention of personal data.
At the end of processing on behalf of a customer, NuPath must return or delete personal data as the controller chooses and as required by the agreement, unless applicable law requires retention. The agreement must address the timing, format of return, deletion evidence and expiry of restricted backup copies. Any retained legal-hold material must be limited and protected.
8 . Analytics and model development
Processing customer data for the agreed monitoring purpose does not give NuPath unrestricted permission to reuse it. Use for general model training, demonstrations, benchmarking or another customer’s project requires a separately assessed lawful basis and the necessary rights and contractual authorisation.
Customer personal data or confidential infrastructure information must not be entered into a public AI service without an approved assessment and contractual safeguards. Data described as anonymous must be assessed for re-identification risk before reuse. Merely removing direct identifiers is insufficient.
9 . Incident management
Suspected unauthorised access, loss, alteration or disclosure must be escalated promptly so the responsible team can contain the incident, preserve relevant evidence, assess the impact and take corrective action.
As processor, NuPath must notify the customer controller without undue delay after becoming aware of a personal data breach and provide available information and assistance. As controller, NuPath must assess regulatory notification: notify the competent authority without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to result in a risk to individuals. Notify affected individuals without undue delay where high risk requires it, subject to the GDPR exceptions.
A suspected security issue can be reported to info@nu-path.eu with “Security” in the subject line. Describe the issue without including passwords or unnecessary personal data. Ask for a secure channel for sensitive evidence. Reporting an issue does not authorise testing or access to systems.
10. Rights requests and policy review
For data controlled by NuPath, individuals can use the contact and rights process in our Privacy Policy. For customer-controlled monitoring data, NuPath must assist the controller as required and forward requests to the appropriate contact without independently changing the customer’s processing instructions.
Management must review this policy and related procedures when processing, risks or legal requirements materially change. The GDPR, applicable Finnish law and binding project agreements take precedence over a general description in this policy.