Privacy policy
Last updated: 14 September 2026
This Privacy Notice describes how Oicon Oy collects, processes, and uses personal data on its website, and how the rights of data subjects relating to the processing of personal data are exercised.
This notice is based on the EU General Data Protection Regulation (EU) 2016/679 (GDPR) and other applicable data protection legislation. Its purpose is to provide website users with transparent information about the processing of personal data and their rights.
1. Name of the Register and Data Controller
Name of the register: Customer Register
Data Controller:
Oicon Oy
Y-tunnus: 2523677-3
Valinkauhantie 8 B b
01640 Vantaa
Contact person for matters concerning the register
Outi Impivaara
outi.impivaara@oicon.fi
040-5016569
2. Scope of this Privacy Notice
This Privacy Notice applies to the use of Oicon Oy’s website and to the processing of personal data received through forms on the website.
3. Purposes of Processing Personal Data
We collect information about visitors to our website using Google Analytics. The purpose of collecting this information is to analyze and improve the website’s functionality, structure, and user experience, as well as to understand how visitors use the website.
Personal data submitted through website forms is processed for receiving, handling, and responding to enquiries and messages.
Personal data may also be processed, where there is an applicable legal basis, for sales and marketing purposes and for sending newsletters when the user has subscribed to the newsletter or provided the required consent.
4. Personal Data Processed
Website Analytics
Google Analytics collects information about website visitors, such as:
- IP address (anonymized)
- operating system and device
- browser type
- information relating to website use, such as visit duration, page views, and navigation paths
- information about the number of website visitors and the pages viewed on the website.
We use this information to compile anonymous or statistical data in order to improve the website’s structure, content, and user experience. We do not seek to identify individual users based on information collected through Google Analytics.
Website Forms
Information submitted through website forms may include, for example:
- name
- email address
- telephone number
- organization or company name
- the content of the message
- other information voluntarily provided by the user in their message.
We only process personal data that the user provides to us directly or for which there is another applicable lawful basis for processing.
5. Legal Basis for Processing Personal Data
Personal data is processed on a lawful basis in accordance with applicable data protection legislation.
The processing of personal data relating to website analytics and cookies may be based on the user’s consent.
The processing of information submitted through website forms is generally based on the user contacting us and the actions arising from that contact, or on another applicable lawful basis.
Depending on the circumstances, the processing of personal data for direct marketing and newsletters is based on consent, an existing customer relationship, or another lawful basis permitted by applicable legislation. Consent may be withdrawn at any time.
6. Data Processors and Regular Disclosures
We use Webflow as the hosting service for our website. Messages submitted through website forms, and the personal data contained in them, may be transferred outside the European Union or European Economic Area. Such transfers are carried out using the European Commission’s approved Standard Contractual Clauses and other safeguards required under applicable legislation.
Google Analytics is operated by Google LLC, which acts as a processor of personal data where applicable. Google may process data outside the European Economic Area. In such cases, applicable safeguards under data protection legislation are used, including the European Commission’s approved Standard Contractual Clauses where applicable.
Personal data is processed internally within the organization and is not disclosed for external use except in connection with the service providers and processing activities described in this Privacy Notice or where disclosure is required by law.
7. Cookies
Our website uses cookies and similar technologies.
Google Analytics uses cookies to collect information about how the website is used. Cookies may be used, for example, to analyze visitor numbers, website usage, and user experience.
Some cookies placed on the website may process data outside the European Union or European Economic Area. Such transfers are carried out in accordance with the European Commission’s approved Standard Contractual Clauses and other safeguards required under applicable legislation.
You can refuse or restrict the use of cookies through the website’s cookie settings or by changing your browser settings. Blocking cookies may affect the functionality of the website or the use of certain features.
8. Remarketing
The website may use technologies that allow marketing to be targeted to users who have previously visited the website.
Where required, the use of cookies and similar technologies for remarketing is subject to the user’s consent. Users can manage the use of these technologies through the website’s cookie settings.
9. Sales and Marketing
If you provide your contact details through a website form, we may use the information to contact you, offer our services and products, and for other sales and marketing communications permitted under applicable legislation.
Direct marketing is carried out in accordance with the requirements of applicable data protection and electronic communications legislation.
10. Newsletters
The email address and any other information you provide when subscribing to our newsletter may be used to send newsletters.
Newsletter subscribers can unsubscribe using the unsubscribe link included in each newsletter we send.
11. Data Security and Retention
The Data Controller’s information systems and files are protected using technical and organizational security measures generally applied in business operations.
Access to the register requires a personal username and password. Access credentials are granted only to employees of the Data Controller whose position and duties require access to the register.
Any manual records are stored with particular care and caution in a locked location.
Personal data is retained only for as long as necessary to fulfil the purposes described in this Privacy Notice or to comply with obligations under applicable legislation.
As a general rule, information contained in the Customer Register is retained until the customer relationship between the data subject and Oicon Oy can be considered to have ended. The end date is determined based on the data subject’s most recent service interaction or contact, after which the data is retained for an additional five (5) years, unless there is another legal basis for retaining the data after this period or the data needs to be retained for the establishment, exercise, or defense of a legal claim.
12. Transfers of Personal Data Outside the European Union or European Economic Area
Personal data may be transferred to or processed outside the European Union or European Economic Area.
In such situations, we ensure that transfers are carried out in accordance with applicable data protection legislation and that the protection of personal data is ensured through appropriate safeguards. These may include the European Commission’s approved Standard Contractual Clauses or another transfer mechanism permitted under applicable legislation.
13. Rights of Data Subjects
Under applicable data protection legislation, data subjects have the following rights.
Right of Access
The data subject has the right to obtain information about what personal data concerning them has been stored in Oicon Oy’s Customer Register.
A request for access must be submitted in the manner described in Section 14 of this Privacy Notice. The right of access may be refused on grounds provided by law. Exercising the right of access is generally free of charge.
Right to Rectification
The data subject has the right to request that inaccurate, incomplete, or outdated personal data concerning them be corrected or supplemented.
Right to Erasure
In certain circumstances, the data subject has the right to request the deletion of their personal data.
However, Oicon Oy is not required to delete personal data when its processing or retention is necessary, for example:
a) to comply with a statutory obligation requiring processing; or
b) for the establishment, exercise, or defense of a legal claim.
Right to Restriction of Processing
In certain circumstances, the data subject has the right to request restriction of the processing of their personal data. This may apply, for example, while the data subject is waiting for Oicon Oy to respond to a request concerning the rectification or deletion of personal data.
Right to Object
In certain circumstances, the data subject has the right to object to the processing of their personal data in accordance with applicable data protection legislation.
The data subject has the right to object to the processing of their personal data for direct marketing purposes.
Right to Withdraw Consent
Where the processing of personal data is based on the data subject’s consent, the data subject has the right to withdraw their consent at any time by notifying Oicon Oy in the manner described in Section 14 of this Privacy Notice.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
Right to Lodge a Complaint with a Supervisory Authority
The data subject has the right to lodge a complaint with the competent supervisory authority if they believe that Oicon Oy has not complied with applicable data protection legislation.
In Finland, the competent supervisory authority is the Office of the Data Protection Ombudsman.
14. Contact and Exercising Your Rights
For any questions concerning the processing of personal data or to exercise your rights as a data subject, you can contact Oicon Oy:
By email:
outi.impivaara@oicon.fi
By post:
Oicon Oy
Outi Impivaara
Valinkauhantie 8 B b
01640 Vantaa
Oicon Oy may, where necessary, ask the data subject to clarify their request in writing. The identity of the data subject may, where necessary, be verified before any further action is taken.