1. Data controller
Arctic Ravn Oy
Business ID: 3548284-7
Address: Tekniikantie 12, 02150 Espoo, Finland
Email: b2b@arcticravn.fi
2. Data protection contact
Data Protection Officer: Matti Vansén
For any questions about this notice or about how we process your personal data, please contact: b2b@arcticravn.fi
3. What personal data we process and for what purpose
1) Website forms
The website has three forms through which a visitor can submit their details directly to Arctic Ravn Oy. Data submitted through these forms is stored in the website's own system, and is processed in order to respond to enquiries, procurement requests and quote requests, and to prepare and manage the customer and sales relationship.
Contact form: name (required), organisation, email address (required), message (required).
Procurement form: name (required), organisation, email address (required), VAT/business ID number, area of interest, quantity, message (required).
Enquiry form: name (required), organisation, email address (required), VAT/business ID number, enquiry details, message (required).
When a form is submitted, the organisation, an internal reference, the form type and the submission timestamp are also stored, in encrypted form, on a separate hardened host. The submitter's IP address and browser user agent are not stored with a form submission.
In practice, the job title and phone number of the person submitting a procurement request or other form may also be requested and stored as part of the enquiry; this information is processed on the same legal basis and for the same purpose as the other form data.
2) Sales customer relationship management (CRM)
Data from forms and other sales-related enquiries (such as company name, business ID, contact person's name, job title, email address and phone number) is stored in Arctic Ravn Oy's customer relationship management system (Pipedrive) in order to manage the customer and sales relationship, prepare quotes and track sales activity.
3) Direct marketing and customer communications
Contact details collected through the forms may also be used for direct marketing and customer communications relating to Arctic Ravn Oy's products and services, such as newsletters. The data subject has the right to object to the use of their data for direct marketing purposes at any time, in which case the data will no longer be used for this purpose.
4) Website analytics (Matomo)
Arctic Ravn Oy uses a self-hosted Matomo service (matomo.donbran.co) for website visitor analytics. Analytics requests are proxied through the website's own domain, so the visitor's browser does not make separate requests to third-party servers for analytics purposes.
The Matomo implementation is cookieless, so it does not require cookie consent.
The visitor's IP address is passed to Matomo to enable country-level statistics and visitor counting. At the time of writing, it has not yet been confirmed whether IP anonymisation is enabled on the Matomo instance; for this reason, this notice does not currently state that IP addresses are anonymised. This notice will be updated once this has been confirmed.
Analytics data is not shared with third parties.
5) Error reporting (GlitchTip)
The website's technical implementation uses the GlitchTip error-reporting service (errors.donbran.co) to detect and resolve technical errors on the site. This service operates server-side only, and the visitor's browser never connects to it.
Before any data is sent to the error-reporting service, request bodies, cookies, query strings, user identity information and other additional context (breadcrumbs) are automatically stripped. Only the URL and HTTP method associated with the error are retained.
The error-reporting service is a shared instance used across multiple clients, and its data retention period may outlast this website project.
6) Spam protection (Altcha)
Form submissions are protected against spam using a self-hosted Altcha service, based on a proof-of-work challenge. The solution does not use any third-party services and does not use cookies. The hash of a solved challenge is retained for 15 minutes for replay protection.
7) Web server logs
Access logging is disabled on the public web server, so visitor requests are not logged at the server level. Matomo is therefore the only point at which visitor data is collected.
8) Marketing and media monitoring
Arctic Ravn Oy uses the Meltwater service for media monitoring and management of PR contacts. This may involve the processing of contact details of journalists and other media contacts.
Arctic Ravn Oy maintains accounts on LinkedIn, Meta and YouTube. The processing of visitor and usage data on these channels is governed by each platform's own privacy policy, and the platforms act as independent data controllers in that respect.
9) Systems outside the scope of this notice
This notice does not cover technical systems and tools that do not process personal data of website visitors or enquirers. These include, among others, source code management (GitHub), certificate management (Let's Encrypt, cosign), the remote access solution (WireGuard), the monitoring registry for technical components, and the content management and staff administration panels. Log data relating to staff logins to these panels (such as IP address and browser user agent) is addressed under separate internal staff/employee data protection documentation, not under this visitor-facing notice.
4. Legal basis for processing
The legal basis for processing data submitted through the contact, procurement and enquiry forms is the performance of steps requested by the data subject prior to entering into a contract, together with Arctic Ravn Oy's legitimate interest in managing customer and sales relationships (GDPR Article 6(1)(b) and (f)).
The legal basis for direct marketing is Arctic Ravn Oy's legitimate interest in carrying out B2B marketing towards existing or prospective business customers (GDPR Article 6(1)(f)). The data subject has the right to object to this processing at any time.
The legal basis for website analytics is Arctic Ravn Oy's legitimate interest in understanding and improving the functioning and use of the website (GDPR Article 6(1)(f)).
5. Data retention
Personal data is retained for as long as necessary to fulfil the relevant processing purpose, taking into account, where applicable, minimum retention periods under accounting legislation and other applicable law. Data that is no longer needed is deleted on a regular basis.
6. Recipients and processors of data
The technical implementation and maintenance of the website is outsourced to Don & Branco, which acts as a data processor on behalf of Arctic Ravn Oy. The service is hosted at a Hetzner data centre in Finland, which acts as a sub-processor in this context. Data therefore remains within the EU and is not transferred outside the EU/EEA in connection with this processing.
Pipedrive is used for sales customer relationship management and acts as a data processor in this context.
Meltwater is used for media monitoring and PR contact management and acts as a data processor in this context.
A data processing agreement in accordance with GDPR Article 28 is in place, or will be put in place, with each processor and any applicable sub-processor.
Personal data may also be disclosed where required by law or in response to a binding order of a competent authority (such as a court or government agency).
In the event of a merger, acquisition or sale of Arctic Ravn Oy’s business or assets, personal data may be transferred to the acquiring party. In such a case, the data subjects will be informed prior to the transfer and prior to the data becoming subject to a different privacy notice.
7. Transfers outside the EU/EEA
For the processing activities described in this notice, personal data is not, as a rule, transferred outside the EU/EEA. Should there be any change in the operations of the service providers used that requires a transfer of data outside the EU/EEA, this notice will be updated to describe the transfer and the safeguards applied.
8. Data subject rights
Under applicable data protection law, the data subject has, among others, the following rights:
the right to access their own personal data
the right to request correction of inaccurate data
the right to request erasure of data, where the legal conditions for this are met
the right to request restriction of processing
the right to object to the processing of their personal data, in particular for direct marketing purposes
the right to data portability, to the extent this right applies
the right to lodge a complaint with a supervisory authority, in Finland the Office of the Data Protection Ombudsman
Requests to exercise these rights should be directed to the contact given in Section 2.
9. Cookies and tracking technologies
The website's visitor analytics (Matomo) is implemented on a cookieless basis and therefore does not require cookie consent. The spam protection solution (Altcha) also does not use cookies. Should the website later introduce functionality requiring cookies or other tracking technologies, this notice and, where relevant, the website's cookie policy, will be updated accordingly.
10. Data security
Data submitted through the forms is stored in encrypted form on a separate, hardened host. Data sent to the error-reporting service is automatically stripped of sensitive and identifying content before transmission. Arctic Ravn Oy and its processors apply appropriate technical and organisational measures to protect personal data.
11. Links to third-party websites
The website may contain links to third-party websites or services that are not operated by Arctic Ravn Oy. Arctic Ravn Oy has no control over, and assumes no responsibility for, the content or privacy practices of any such third-party sites or services. We encourage visitors to review the privacy policy of every site they visit.
12. Updates to this notice
This privacy notice may be updated, for example, as a result of changes in legislation or in the functionality of the website, such as the future addition of an online shop. We recommend reviewing this notice from time to time.