Website, Inquiries, Recruitment, and Contact Persons of Customers, Suppliers and Other Business Partners
Nanocomp Oy Ltd (“Nanocomp”) is committed to protecting privacy and personal data and to processing personal data in accordance with applicable data protection legislation, in particular the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”).
This Privacy Notice explains how Nanocomp collects and processes personal data relating to visitors to its website, individuals contacting Nanocomp, and contact persons of customers, prospective customers, suppliers and other business partners.
Separate privacy notices will be provided, where applicable, concerning the processing of personal data relating to job applicants, employees and potential video surveillance.
We may update this Privacy Notice if changes occur in our business operations, personal data processing activities, systems used or applicable legislation. The current Privacy Notice is available on Nanocomp’s website.
1. Data Controller and Contact Information
The data controller responsible for the processing of personal data covered by this Privacy Notice is:
Nanocomp Oy Ltd
Ensolantie 6
80710 Lehmo, Finland
Business ID: 1083600-4
Phone: +358 50 463 6970
Data protection inquiries: privacy@nanocomp.fi
Nanocomp is part of the Radiant Opto-Electronics Group (“ROE”). Personal data may be disclosed or made available for processing to the ROE Group’s parent company and other group companies where necessary for purposes such as managing customer and supplier relationships, customer and supplier approvals, processing orders and deliveries, group reporting, financial control, master data management or other shared group business processes.
Nanocomp’s customer and supplier data may be processed in the ROE Group’s shared SAP system. The ROE Group’s parent company administers the system and is responsible for the related master data management. Customer and supplier approval processes also involve reviews relating to the group’s financial control and master data management.
2. Scope
This Privacy Notice applies to the processing of personal data relating to:
- The use and technical maintenance of Nanocomp’s website
- Website contact forms, emails, telephone calls and other inquiries
- Establishing, managing and developing customer, sales, supplier and business partner relationships
- Quotations, orders, deliveries, invoicing, complaints and other business transactions
- Maintaining customer and supplier information and managing customer and supplier approvals
- The use of shared business systems of Nanocomp and the ROE Group, such as the SAP system, insofar as personal data covered by this Privacy Notice is processed in these systems
- Group financial control, master data management and group reporting insofar as these activities involve personal data of contact persons of Nanocomp’s customers, suppliers or other business partners
- Sales-related inquiries, requests for quotations and other business inquiries received through the Surveypal service, including the processing and storage of related personal data
- Recruitment applications received through the Surveypal service, including their processing and storage. A separate Privacy Notice is provided regarding the processing of job applicants’ personal data
- Trade fairs, events and other professional networking activities
- Communications and marketing directed at companies and their representatives as permitted by law
3. Categories of Personal Data Processed
We may process, in particular, the following categories of personal data:
- Name and other identification details
- Telephone number, email address, postal address and other contact details
- Job title, responsibilities, employer and other professional information
- Content of inquiries, communications and meetings, and related information
- Information relating to customers, suppliers or other business relationships
- Information concerning quotations, orders, contracts, deliveries, invoicing, complaints and service requests
- Purchase and order history, and background information relating to sales and customer relationships
- Information relating to events, surveys and market research
- Preferences, consents and objections relating to marketing and other communications
- Technical information relating to website use, such as IP addresses, browser and device information, log data and website usage data
- Other information voluntarily provided to us
We ask that unnecessary sensitive information or special categories of personal data not be submitted through website contact forms or other routine communications.
4. Sources of Personal Data
We primarily obtain personal data directly from the data subjects themselves, for example in connection with inquiries, requests for quotations, orders, contracts, events and other business interactions.
Personal data may also be obtained from:
- The organisation represented by the data subject
- Nanocomp employees and, where applicable, other ROE Group companies
- Public professional sources, such as company websites, business directories and professional online services
- Public or official registers, within the limits permitted by applicable legislation
- Organisers of trade fairs, conferences and other events, in accordance with their registration and privacy practices
- Websites, servers, cookies and similar technologies
If personal data has not been obtained directly from the data subject, we will provide the required privacy information within the period prescribed by applicable data protection legislation, generally no later than one month after obtaining the data or, if the data is used for communication, no later than the first communication with the data subject.
If personal data is to be disclosed to another recipient before that time, the information will be provided no later than the first disclosure.
5. Purposes and Legal Bases for Processing Personal Data
We process personal data only for specified purposes and where there is a legal basis for processing under applicable data protection legislation.
| Purpose of Processing | Primary Basis |
| Responding to inquiries and requests for quotations and taking potential pre-contractual measures | Legitimate interests; pre-contractual measures where the data subject is personally a party to the potential contract |
| Establishing, managing and developing customer, supplier and business partner relationships | Legitimate interests; contract where applicable |
| Providing products and services, managing orders and deliveries, invoicing and handling complaints | Contract, legitimate interests and legal obligation |
| Professional communications, sales and marketing, communications relating to events and professional networking, and developing business operations, products, services and customer experience | Legitimate interests or consent where required by law |
| Maintaining customer and supplier information in CRM, SAP and other business systems | Legitimate interests |
| Customer and supplier approvals and master data management in shared group systems | Legitimate interests |
| Group financial control and internal reporting | Legitimate interests; legal obligation where processing is based on a specific statutory requirement |
| Compliance with accounting, tax, export control and other statutory obligations | Legal obligation |
| Establishment, exercise and defence of legal claims and prevention of misuse | Legitimate interests; legal obligation where applicable |
| Technical operation, maintenance and security of the website, processing of log data and troubleshooting | Legitimate interests |
| Optional analytics, user experience development and other non-essential tracking | Consent |
| Responding to statutory requests from authorities and disclosing information to authorities | Legal obligation |
Where personal data processing is based on legitimate interests, our legitimate interests relate in particular to conducting and developing business operations, managing customer, supplier and other business relationships, communicating with companies and their contact persons, sales and marketing, appropriate management of customer and supplier information, group financial control and reporting, and ensuring the security of systems, personal data and business operations.
We assess the necessity of processing based on legitimate interests, taking into account the interests, rights, reasonable expectations and potential impacts on data subjects. Personal data is processed on the basis of legitimate interests only to the extent necessary for the relevant purpose.
Data subjects have the right to object at any time to the processing of their personal data for direct marketing purposes. If a data subject objects to such processing, their personal data will no longer be processed for that purpose.
6. Requirement to Provide Personal Data
Contact details and the content of an inquiry necessary for handling the inquiry are required so that we can respond.
Failure to provide information necessary for entering into a contract, delivering an order, invoicing or complying with a statutory obligation may prevent the matter from being processed or the contractual relationship from being established or fulfilled.
Providing other personal data is generally voluntary.
7. Recipients of Personal Data
Within Nanocomp, personal data is processed only by individuals whose duties require such processing.
Nanocomp uses the Surveypal service to receive, process and store personal data only in situations where an individual submits their information through Surveypal, either in connection with a job application or a sales-related inquiry. Surveypal acts as a data processor on behalf of Nanocomp with respect to personal data stored in the service.
Access to recruitment applications and the personal data they contain is restricted to Nanocomp personnel who participate in the recruitment process for the relevant position and whose duties require the processing of such data.
Personal data relating to sales inquiries is processed only by Nanocomp personnel whose duties include handling the relevant inquiries and managing customer relationships.
Where necessary and in accordance with applicable legislation, personal data may be disclosed or made available for processing to the following recipients:
- The ROE Group’s parent company and other group companies
- IT, cloud, website, email, CRM, financial administration, communications, analytics and other service providers
- Banks and transport and logistics partners
- Other business partners involved in delivering products or services
- Auditors, insurance companies, financiers, legal advisers and other professional advisers
- Authorities and other parties to whom personal data must be disclosed under applicable law, an official request or a legal claim
Where an external service provider processes personal data on behalf of Nanocomp, the processing is governed by arrangements that comply with applicable data protection legislation.
Transfers of personal data outside the European Economic Area and the safeguards applied to such transfers are described in the following section.
8. Transfers of Personal Data Outside the European Economic Area
The ROE Group includes companies located both within and outside the European Economic Area (“EEA”). Nanocomp’s personal data may be processed by and disclosed to ROE Group companies located within the EEA for the purposes described in this Privacy Notice.
Personal data may also be transferred or made accessible to ROE Group companies located outside the EEA, including the ROE Group’s parent company in Taiwan, as well as to service providers operating outside the EEA.
Nanocomp’s customer and supplier data is transferred and made accessible to the ROE Group’s parent company, including through the group’s shared SAP system.
Transfers of personal data outside the EEA are carried out in accordance with applicable data protection legislation.
Where personal data is transferred to a country for which the European Commission has not adopted an adequacy decision, the transfers are protected by the European Commission’s approved Standard Contractual Clauses (“SCCs”) and, where necessary, supplementary safeguards.
Further information about the safeguards used for international data transfers and the possibility of obtaining a copy of them may be requested using the data protection contact details provided in Section 1.
9. Retention of Personal Data
We retain personal data only for as long as necessary to fulfil the purposes for which it is processed or where retention is necessary on the basis of a contract, legislation, or the establishment, exercise or defence of legal claims.
When determining retention periods, we take into account factors such as the duration of customer, supplier or other business relationships, the most recent relevant communication, pending matters, contractual and complaint-related liabilities, potential legal claims and statutory retention obligations.
- Inquiries and requests for quotations: Personal data relating to inquiries and requests for quotations that do not result in a customer or other business relationship is retained for the duration necessary to handle the matter and conduct justified follow-up communications, and thereafter for a maximum of five (5) years from the most recent relevant contact, provided that continued retention remains necessary for the purposes described in this Privacy Notice.
- Customer, supplier and business partner relationships: Personal data relating to these relationships is retained for the duration of the business relationship and for a maximum of ten (10) years after its termination, to the extent that continued retention remains necessary, for example, due to liabilities, documentation requirements or legal claims relating to the business relationship. Unnecessary personal data is deleted earlier. Personal data retained to comply with statutory obligations is subject to the applicable statutory retention periods.
- Accounting records: Personal data included in accounting records is retained for the period required by applicable legislation. Under the Finnish Accounting Act, accounting vouchers, correspondence relating to business transactions and other similar accounting records must be retained for at least six (6) years from the end of the year in which the financial year ended. Financial statements, annual reports, accounting records and other accounting materials specified by law must be retained for at least ten (10) years from the end of the financial year.
- Complaints, disputes and legal claims: Personal data relating to complaints, disputes and other legal claims may be retained for as long as necessary to handle the matter and to establish, exercise or defend legal claims.
- Marketing: Personal data relating to marketing is retained for as long as necessary for the relevant marketing purpose. If a data subject objects to the processing of their personal data for direct marketing, the data will no longer be used for that purpose. Information concerning a marketing objection may be retained to ensure that the objection is respected.
- Website logs, analytics and cookies: Log, analytics and cookie data relating to the website is retained for the period necessary for its purpose, in accordance with the systems and cookie settings in use. More detailed cookie-specific retention periods are provided in the website’s cookie settings or cookie information.
When personal data is no longer necessary for the purpose for which it was collected or otherwise processed, it is deleted or anonymised unless there is another lawful basis for its continued retention.
Personal data stored in the Surveypal service is retained only for as long as necessary to fulfil the purpose of processing or as permitted or required by applicable legislation.
Retention periods for recruitment applications are defined in the separate Job Applicants’ Privacy Notice.
Personal data relating to sales and other business inquiries is subject to the retention principles and periods described in this Privacy Notice.
10. Website, Cookies and Analytics
When Nanocomp’s website is used, personal data necessary for the technical operation and security of the website may be processed, including IP addresses, browser and device information, and server log data.
Nanocomp’s website does not currently use non-essential cookies or cookie-based analytics or marketing technologies.
If non-essential cookies or other tracking technologies requiring user consent are introduced on the website in the future, users will be provided with the relevant information and the necessary consent will be obtained before such technologies are activated.
11. Protection of Personal Data
We protect personal data through appropriate technical and organisational measures.
Access to personal data is restricted according to job responsibilities, and access rights to electronic systems are managed through individual user accounts. Users are granted only the access rights necessary for their duties.
For recruitment applications, access rights are granted only to Nanocomp personnel participating in the relevant recruitment process.
System security is maintained through appropriate technical and organisational measures, and service providers processing personal data on behalf of Nanocomp are required to maintain appropriate data protection and information security standards.
Any paper records are stored in a manner that restricts access to individuals who require the information for their duties.
12. Rights of Data Subjects
Under applicable data protection legislation, data subjects have the right to:
- Receive information about the processing of their personal data and request access to their personal data
- Request the correction of inaccurate or incomplete personal data
- Request the deletion of personal data under the conditions prescribed by law
- Request restriction of the processing of personal data under the conditions prescribed by law
- Object to processing based on legitimate interests on grounds relating to their particular situation
- Object at any time to the processing of their personal data for direct marketing purposes
- Receive the personal data they have provided in a structured, commonly used and machine-readable format and transfer it to another data controller where the right to data portability applies
- Withdraw their consent at any time where processing is based on consent
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Data subject rights are not absolute in all circumstances, and their applicability depends, among other things, on the purpose and legal basis of the processing.
Requests concerning data subject rights may be sent to privacy@nanocomp.fi. We may request additional information where necessary to verify the identity of the person making the request.
Data subjects also have the right to lodge a complaint with the competent data protection supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (www.tietosuoja.fi).
13. Automated Decision-Making
Nanocomp does not make decisions based solely on automated processing, including profiling, using personal data covered by this Privacy Notice where such decisions would produce legal effects concerning the data subject or similarly significantly affect them.
14. Changes to This Privacy Notice and Contact Information
We may update this Privacy Notice if changes occur in our personal data processing activities, business operations, systems used or applicable legislation.
The current version will be published on Nanocomp’s website. If a change materially affects the rights of data subjects or the way personal data is used, we will communicate the change in an appropriate manner.
Questions concerning data protection or the processing of personal data may be addressed to:
Nanocomp Oy Ltd
Ensolantie 6
80710 Lehmo, Finland
Phone: +358 50 463 6970
Email: privacy@nanocomp.fi
Last updated: October 15, 2026