Quick Links
1 . Overview
NuPath Oy, Finnish Business ID 3438346-8. Email: info@nu-path.eu. Correspondence: PL 17 02101 Espoo, Finland. Website: https://nu-path.eu.
NuPath Oy is the controller for the processing described in this policy because it determines why and how that personal data is used. NUSwift is an offering presented by NuPath. Privacy requests can be sent to info@nu-path.eu, with “Privacy” in the subject line.
Where a customer determines how personal data is collected through a monitoring installation and NuPath processes it on that customer’s behalf, the customer is normally the controller. Section 11 explains that distinction. Employee and recruitment processing, where relevant, is covered by separate notices.
Personal data and its sources
Information you provide may include your name, business email address, company, role, telephone number if supplied, message content, project requirements and correspondence. The enquiry form asks for a name, email address, company and message. A newsletter subscription uses the information entered in the subscription form and the record of your choice.
Website delivery and security may involve technical data such as an IP address, browser and device information, requested pages, access times, error records and server logs. Cookies and similar technologies, where used, are described separately in our Cookie Policy. We do not treat a claim that analytics are cookie-free as proof that every website data flow is outside data protection law.
We usually receive data directly from you. In a business relationship, a colleague, your organisation or a referral contact may provide your work contact details and role. We may also obtain relevant professional contact information from a public business source. When data is obtained indirectly, we provide the required information within the applicable GDPR time limit, normally no later than one month and sooner if we first contact you or disclose it to another recipient.
3 . Purposes and legal bases
We use a legal basis appropriate to the specific purpose. A company’s contract with NuPath does not automatically make contract performance the legal basis for processing its employees’ contact data.
Reply to enquiries and arrange discussions or demonstrations using contact details and correspondence. Legitimate interests under Article 6(1)(f): responding to relevant business requests and developing business relationships.
Take steps you request before a contract with you personally, or perform that contract. Article 6(1)(b), only where you are the individual contracting party and the processing is necessary.
Manage customer, supplier and partner relationships, including communications and project administration. Article 6(1)(f): administering professional relationships and delivering agreed business services.
Send the newsletter or other updates for which you subscribe. Consent under Article 6(1)(a). Consent can be withdrawn at any time.
Deliver and secure the website, troubleshoot faults and prevent misuse. Article 6(1)(f): reliable and secure website operation, subject to a necessity and balancing assessment. Device access consent is obtained separately where required.
Meet applicable accounting, tax or other statutory duties; establish or defend legal claims. Article 6(1)(c) for a specific legal obligation; Article 6(1)(f) for necessary legal claims and defence.
When relying on legitimate interests, we assess the purpose, necessity and impact on you. You may object on grounds relating to your particular situation. We stop the relevant processing unless an applicable legal exception permits it.
4. Providing information and marketing choices
You are not legally required to send a website enquiry or subscribe. Fields marked as required are needed to handle that form. If necessary information is missing, we may be unable to reply or assess the request. Please avoid including sensitive personal data or confidential site information in an initial website message.
A request for a pilot, quotation or demonstration does not subscribe you to a newsletter. Newsletter consent must be a separate, informed and voluntary choice. You can unsubscribe through the link in a marketing email or by writing to info@nu-path.eu. We will stop the relevant marketing and may keep a minimal suppression record to respect your choice.
5 . Service providers and other recipients
Access is limited to people who need the information for the stated purpose. Recipients may include authorised NuPath personnel; website and form providers; email and newsletter providers; customer relationship and IT support providers; professional advisers; and authorities where disclosure is legally required.
The Framer-hosted website uses Framer for website publishing and built-in website measurement. The production services used for form delivery, business email and newsletter management.
Providers acting as processors must process personal data under an appropriate data processing agreement and our documented instructions. Other recipients may act as independent controllers for their own legal or professional duties. We disclose only the information reasonably needed for the relevant purpose.
6. Processing locations and international transfers
NuPath Oy is based in Finland. We use external providers for website hosting, email and related services. Depending on the provider, personal data may be processed within the European Economic Area (EEA) or in other countries, including through remote support access.
NuPath requires transfers outside the EEA to be covered by a valid GDPR transfer mechanism. This may include an applicable European Commission adequacy decision or the European Commission’s Standard Contractual Clauses, together with any additional safeguards required to protect the data.
You can request information about processing locations and applicable transfer safeguards, or a copy of those safeguards, by contacting info@nu-path.eu.
7. Retention
We keep personal data for the stated purpose and apply a retention schedule to the relevant systems. The following limits apply unless a specific legal obligation or a necessary legal hold requires longer retention of a limited record.
8. Your rights
Subject to the conditions in the GDPR, you may request access and a copy of your personal data, correction of inaccurate data, erasure or restriction of processing. You may receive data you provided in a structured, commonly used, machine-readable format where processing is automated and based on consent or a contract, and request transmission where technically feasible.
You may object to processing based on legitimate interests because of your particular situation. You may object to direct marketing at any time, without giving a reason. Where processing relies on consent, you can withdraw it at any time; this does not affect processing that was lawful before withdrawal.
Send a request to info@nu-path.eu. We may request proportionate information if we reasonably need to verify your identity. We respond without undue delay and normally within one month. Where permitted because of complexity or the number of requests, we may extend this by up to two further months, explaining the reason within the first month. Requests are normally free; any exception must be permitted by law.
You may complain to the Finnish Office of the Data Protection Ombudsman at https://tietosuoja.fi/en, or another competent supervisory authority, including in the country of your habitual residence, workplace or the alleged infringement. You do not need to contact NuPath before exercising this right.
9 . Security and confidentiality
We apply technical and organisational safeguards appropriate to the data and risk, and require confidentiality and access restrictions for those handling it. Our Data Protection Policy explains the safeguards required for project data and processing on behalf of customers. No website or communications channel can guarantee absolute security. Please contact us before sending sensitive material.
10 . Automated decisions and children
We do not use website enquiry or newsletter data to make decisions based solely on automated processing that produce legal or similarly significant effects on you. Technical filtering of spam or security threats does not change the purposes stated in this policy.[PR1]
The website is intended for business and professional audiences and is not directed to children. If you believe a child has provided unnecessary personal data, contact us so that we can assess and remove it where appropriate.
1 1. Personal data in customer monitoring projects
NUSwift projects may involve fibre measurements, event locations, cameras, vehicle information or operator accounts. Such data may be personal data when it relates to an identifiable person, including through combination with other records.
The actual purposes and decision-making determine controller and processor roles. When NuPath processes data solely for a customer, the customer’s privacy notice and the project data processing agreement apply. Contact the relevant site operator first for information about that monitoring. If a request reaches NuPath, we will direct or assist it as required by our role. This website policy does not authorise surveillance or replace notices to affected people.
1 2. Changes and legal framework
We update this policy when our processing or applicable requirements change. We make the revised text available and provide additional notice of material changes where appropriate. If a new use requires consent, a policy update alone does not provide that consent.
General Data Protection Regulation (EU) 2016/679