Quick Links
1 . Overview
NuPath Oy, Finnish Business ID 3438346-8. Email: info@nu-path.eu. Correspondence: PL 17 02101 Espoo, Finland. Website: https://nu-path.eu.
These requirements apply to our website, business activities and NUSwift projects. Management is responsible for allocating ownership, resources and oversight. People handling personal data must follow their assigned responsibilities and confidentiality obligations. We assess whether the law requires appointment of a Data Protection Officer and make the relevant contact information available if one is appointed. The general privacy contact is info@nu-path.eu; use of this address does not imply that a statutory Data Protection Officer has been appointed.
2. Principles for personal data
Processing must be lawful, fair and transparent. We define the purpose and legal basis before collection, minimise data, maintain accuracy, set retention limits, protect it against unauthorised use or loss, and document our safeguards.
A new purpose requires an assessment of compatibility or another valid basis before reuse. Legitimate interests require an assessment of necessity and effects on individuals. Consent must be informed, freely given, specific, unambiguous and capable of withdrawal.
3. Information and individual rights
Our Privacy Policy covers website and business-contact processing. Project notices must identify the monitoring activity and controller. Information must meet Articles 13 and 14 and reflect material changes.
We facilitate access, correction, erasure, restriction, portability and objection rights as applicable. Consent withdrawal and direct marketing objections must be effective in the relevant systems. A data subject request is normally answered within one month; any lawful extension is explained within that period. Where NuPath is a processor, it assists the controller under the applicable agreement.
4 . Privacy in project design
Before a pilot or deployment, identify purposes, affected people, data flows, legal basis, roles, retention and access. Privacy settings must limit collection, exposure and retention to what the task requires.
Measurements can become personal data when linked with cameras, vehicle records, access logs or operator identities. Assess the whole configuration, including integrations and remote support.
Likely high-risk processing requires the controller to conduct a data protection impact assessment before it begins. NuPath assists when acting as processor. If high residual risk cannot be sufficiently mitigated, the controller must consult the supervisory authority before processing.
5 . Suppliers and international processing
Assess suppliers’ safeguards and put Article 28 agreements in place where required. Address instructions, confidentiality, security, subprocessors, assistance, deletion and audit provisions.
Identify processing locations and remote access. Transfers outside the European Economic Area (EEA) require an applicable GDPR mechanism and necessary assessments and safeguards. An EU supplier does not, by itself, establish EU-only processing.
6. Security and incident duties
Security must be proportionate to the nature, scope, context and risks of processing. Our Data Protection Policy sets the requirements; the relevant system documentation and contract identify specific controls and service commitments.
When NuPath is a controller, a personal data breach must be reported to the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless it is unlikely to result in a risk to people’s rights and freedoms. Affected people must be informed without undue delay where the breach is likely to result in a high risk, unless a legal exception applies.
When NuPath is a processor, it must notify the customer controller without undue delay after becoming aware of a personal data breach. The customer notification must not wait for the controller’s 72-hour deadline. Relevant facts, decisions and corrective actions must be documented.
7 . Records and review
Accountability requires records appropriate to our processing, including records of processing activities where required, lawful-basis assessments, supplier agreements, retention rules, consent evidence where applicable, and records of rights requests and breaches.
Review these arrangements when services, suppliers, data uses or legal requirements change. Provide staff guidance appropriate to their responsibilities. Public claims about certifications, controls or compliance require current evidence.
8. Enquiries and related information
For privacy questions, requests or concerns, email info@nu-path.eu. Individuals retain the right to complain to a competent supervisory authority, including the Finnish Office of the Data Protection Ombudsman at https://tietosuoja.fi/en.
Read the Privacy Policy, Cookie Policy and Data Protection Policy for further details. Customer processing instructions and contractual duties are set out in the applicable data processing agreement.