Privacy Notice

This is Noja Rahoitus Oy’s privacy notice in accordance with the EU General Data Protection Regulation (GDPR). Prepared on 15 May 2018. Last amended on 07 October 2026. This privacy notice is published on the noja.fi website.

Noja Rahoitus respects your privacy. This privacy notice describes your rights to protect your privacy and our commitment to safeguarding your personal data. Noja Rahoitus strives for complete transparency in protecting your privacy.

Data controller and person responsible for data protection

Noja Rahoitus Oy
Business ID: 2597279-7
Tel. +358 10 202 2800
Email: noja@noja.fi
Address: Aurakatu 12 b, 20100 Turku, Finland

Person responsible for data protection

Kimmo Waltonen
Tel. +358 40 029 8955
Email: kimmo.waltonen@noja.fi

Who this privacy notice applies to

This privacy notice informs Noja Rahoitus Oy’s customers, potential customers, partners, job applicants, and website visitors about how Noja Rahoitus Oy, acting as data controller, processes their personal data.

Why we process your personal data and on what basis

Noja Rahoitus processes the personal data of data subjects for the following purposes:

Website visitors:

• Visitor statistics and marketing targeting
• Contact requests submitted through forms

Customers and potential customers:

• Making offers for our services
• Marketing
• Managing the customer and contractual relationship, including fulfilling contractual obligations and invoicing, as well as identifying, assessing, and preventing money laundering in relation to the company’s responsible person
• Developing our services
• Identifying and remedying information security threats, and other related maintenance

Partners:

• Managing user credentials

Job applicants:

• Carrying out recruitment and selecting the right person for the role

The processing of personal data is based on the following legal grounds:

• Consent, where a website visitor gives consent to marketing and analytics cookies.
• Contract, where the data subject is a party to a contract that Noja Rahoitus has entered into with them.
• Legal obligation, for example under accounting legislation.
• Legitimate interest of the controller.
  • Customer acquisition calls: Based on legitimate interest, we market our services and products to potential customers in order to develop our business and ensure its continuity. Our legitimate interest is the freedom to conduct business and to promote it through direct marketing.
  • Processing of contact person data for business customers: Based on legitimate interest, we process the personal data of contact persons at customer companies for the purpose of providing our services and products, as well as for related communication. Our legitimate interest is enabling the provision of our services, underpinned by the freedom to conduct business.

We have carried out balancing tests regarding the use of legitimate interest as a basis for processing personal data, and these tests have shown that the processing does not cause disproportionate effects for the data subject. You may object to the processing of your data at any time. For more information about the balancing tests, please contact noja@noja.fi.

How we collect your personal data

Noja Rahoitus collects personal data directly from you or your employer, for example in connection with invoicing, or through the contact request form on our website.

During the preparation of a contract, we retrieve credit information on private individuals, such as a company’s responsible person, and other necessary information about the business customer, from Suomen Asiakastieto or Bisnode D&B Finland.

In addition, in certain cases Noja Rahoitus may ask the customer to grant access to the company’s financial information, such as:

• e-invoicing data, obtained with the customer’s consent from the e-invoicing service provider
• bank account data, obtained with the customer’s consent via open banking interfaces provided by the banks used by the company

In these cases, the data is transmitted via Salt Edge, a GDPR-compliant service provider used by Noja Rahoitus.

This information is used to assess the company’s financial situation, support credit decisions, and provide financing services. In some cases, the assessment is carried out with the assistance of artificial intelligence. AI-assisted assessment applies to legal persons only: applications from sole traders, who are natural persons, are assessed without the use of artificial intelligence. Artificial intelligence does not make the credit decision; the decision is always made by an employee of Noja Rahoitus.

Cookies

If you give your consent to marketing and analytics cookies, a cookie is placed on your device. Cookies are small text files that store information during and between visits to the website. We use cookies to collect personal data as follows:

• Google Analytics: We collect information about how website visitors use our website. The purpose is to understand which content is popular and how we could improve the website. We cannot identify you personally through these cookies.
  
• LinkedIn cookies: We collect information about how website visitors respond to our advertisements on LinkedIn.

What personal data we process

Noja Rahoitus may process, for example, the following personal data about you:

• Information necessary for providing the service, such as which services are in use
• Your own contact details and the contact details of the customer company, such as name, address, email address, and phone number
• Personal identity code
• Feedback, comments, and questions you have sent to Noja Rahoitus, or that concern Noja Rahoitus, for example via the website’s contact request form
• Unique user information, such as a username
• Information provided by your browser, such as browser type, language, the address of the website you arrived from, an estimate of your location, information about your use of our website, such as time spent on the site, and other traffic data, such as your IP address

As a data controller, Noja Rahoitus does not process special categories of personal data (sensitive data) about you.

Disclosure of personal data to other controllers

Noja Rahoitus may disclose your personal data to third parties for other purposes only in the following cases:

Authorities
The police and other authorities may require Noja Rahoitus to disclose personal data. In such cases, Noja Rahoitus discloses the data only pursuant to a court order.

Business transactions
If Noja Rahoitus merges with another company, undergoes a business acquisition, or if Noja Rahoitus’s business is sold in part or in full, the acquiring party, as well as the consultants used by the acquiring party and Noja Rahoitus, will gain access to the data managed by Noja Rahoitus. In some cases, this may include personal data. In such situations, external parties will enter into a confidentiality agreement with Noja Rahoitus that also covers any disclosure of personal data.

Disclosures related to website use
Information about website usage is disclosed to Google, and in some cases to LinkedIn and Twitter. You can read Google’s privacy policy at https://policies.google.com/privacy.

• Google Fonts: Noja Rahoitus’s website retrieves design-related content from the Google Fonts service. When this content is retrieved, information about the website visitor and the service delivered to them is stored on Google’s service, such as the visitor’s IP address, the time the content was retrieved, and the content requested.
• Google Analytics: If you have given your consent to marketing and analytics cookies, information about your website visit is sent to Google. Google receives the web address of our site and your IP address in connection with your visit. Google also places cookies on your device, and based on your browsing behaviour, Google may show you advertisements that may be of interest to you after you leave our website.
• LinkedIn: If you have given your consent to marketing and analytics cookies, information about your website visit is sent to LinkedIn. This function allows us to determine whether you found us through LinkedIn.

Processors of personal data

Noja Rahoitus uses external service providers for the processing of personal data, for example as part of the practical implementation of our services. In these situations, the processing of personal data always remains the responsibility of, and under the control of, Noja Rahoitus. Noja Rahoitus is responsible to data subjects for all processing of personal data carried out by its processors. Contractual arrangements always ensure that personal data is processed only to the extent permitted by the controller and in accordance with applicable data protection legislation. In particular, we ensure that external service providers do not use personal data for their own purposes.

Transfers of personal data to third countries and safeguards used

To provide services to contractual customers, personal data may be transferred outside the EU through the use of Microsoft. This transfer is based on the European Commission’s adequacy decision of 10 July 2023 regarding the EU–U.S. Data Privacy Framework, to which Microsoft Corporation has certified. This means that the European Commission has determined that the United States provides an adequate level of data protection within the scope of this framework, and that the transfer of personal data to Microsoft is therefore in compliance with the GDPR.

Your rights

Data subjects have the rights listed below regarding the processing of personal data carried out by Noja Rahoitus.

You can exercise your rights by contacting Noja Rahoitus’s customer service at noja@noja.fi. Other contact details can be found at the beginning of this notice.

Right of access

The data subject has the right to obtain confirmation as to whether the controller is processing their data. The data subject also has the right to access the personal data concerning them held by Noja Rahoitus and, if desired, to obtain a copy of it. If the right of access must be restricted due to legislation or the protection of other individuals’ privacy, this will be communicated to the data subject when the request is processed.

Right to rectification

The data subject has the right to request correction of inaccurate or incomplete data. An exception to this may occur where previously submitted information is material for some reason, such as in relation to a contract or delivery. In such cases, the old information may not necessarily be replaced, but new information may instead be added alongside the changed data.

Right to erasure

The data subject has the right to request the erasure of their data. Data is erased in the following cases:

• the data subject withdraws their consent to the processing, and there is no other basis for processing
• the data subject exercises their right to object and objects to the processing, and there is no other basis for continuing the processing
• the personal data has been processed unlawfully
• the personal data must be erased in order to comply with a legal obligation applicable to the controller

Noja Rahoitus also proactively erases, without a request from the data subject, personal data that it no longer needs to process, for example due to the termination of a contract.

Right to restriction of processing

The data subject has the right to have the controller restrict the processing of their personal data. The right to restriction applies, for example, in situations where the data subject disputes the accuracy of their personal data, suspects that the processing is unlawful, or has objected to the processing, but the matter has not yet been resolved.

Right to object

The data subject has the right to object at any time to the processing of their data in situations where Noja Rahoitus processes personal data based on its own legitimate interest. If the controller cannot, for a justified reason, comply with this right, the data subject will be informed of this when the request is processed.

If personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such marketing.

Right to data portability

The data subject has the right to have their data transferred from one system to another, provided that the processing of personal data is carried out automatically and is based on the data subject’s consent or on a contract to which the data subject is a party.

The data subject also has the right to receive the personal data they have provided in a machine-readable format. This right applies to personal data that has been processed automatically on the basis of a contract or consent.

Right to withdraw consent

Noja Rahoitus processes personal data on the basis of consent for website analytics and advertising targeting through cookies. The data subject has the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. Withdrawing consent does not place the data subject at a disadvantage compared to others in relation to the use of Noja Rahoitus’s services.

Right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with a supervisory authority regarding Noja Rahoitus’s processing of personal data. Noja Rahoitus primarily hopes that the data subject will first contact Noja Rahoitus directly, so that the matter can be resolved promptly.

Office of the Data Protection Ombudsman

Visiting address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Postal address: P.O. Box 800, 00521 Helsinki, Finland
Switchboard: +358 29 566 6700
Fax: +358 29 56 66735
Email: tietosuoja@om.fi

Information security and data retention

How do we protect your personal data?
Noja Rahoitus wants to be worthy of the trust you place in us. Noja Rahoitus is committed to preventing the unauthorised use, disclosure, and other improper processing of your data. In addition, Noja Rahoitus is committed to ensuring that data is used correctly in order to guarantee information security and safe usability. As part of this commitment, we use physical, technical, and administrative measures to safeguard the data we collect and process.

How long do we retain your personal data?
Noja Rahoitus retains your personal data only for as long as necessary for processing. Once the personal data we process is no longer needed, we destroy or delete it securely.

Noja Rahoitus also has statutory obligations to retain personal data, such as those arising from accounting legislation. For this reason, not all data is deleted immediately after the end of a customer relationship, for example, but only once the relevant statutory obligation has expired.

If data has been disclosed prior to the signing of a contract and the contract is ultimately not concluded, Noja Rahoitus will securely delete the data as soon as there is no longer a need to process it.

Changes to this notice

If we make changes to this privacy notice, we will publish the amended notice along with the date of the amendment here. We encourage you to read this notice regularly. If we make significant changes to this notice that materially alter the processing of personal data, we may also notify you in other ways, for example by sending an email or by publishing a notice on our website before the changes take effect.

Contacting us

We value your opinion and want to operate as transparently as possible. If you have any comments or questions regarding our processing of personal data, if you are concerned about the protection of your privacy or the use of your data, or if you suspect that your privacy has been violated, please send a message to noja@noja.fi.

We handle your inquiry confidentially. The person responsible for data protection will contact you at the address you provide. We aim to ensure that your request is processed in a timely manner and in accordance with applicable legislation.