Privacy Policy

1. Introduction

Arctic Marine Fabrication Oy ("we," "us," or "our") operates the website nexiloatls.shop and the associated brand Nexiloatls. We are committed to protecting your privacy and handling your personal data with transparency, care, and full compliance with the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (Tietosuojalaki 1050/2018), and the EU ePrivacy Directive. This Privacy Policy explains what personal data we collect, how we use it, on what legal grounds, with whom we share it, how long we retain it, and the rights you have over it.

2. Data Controller

Arctic Marine Fabrication Oy
Hietalahdenkatu 8, 00180 Helsinki, Finland
Business ID (Y-tunnus): registered in the Finnish Trade Register
Email: [email protected]
Phone: +358 46 921 7732

For all privacy-related inquiries, including requests to exercise your rights, please contact us in writing using the details above. We will respond within 30 days as required by Article 12(3) GDPR.

3. Categories of Data We Collect

We only collect personal data that is necessary for the purposes described in this policy. The categories include:

• Identification data: full name, title, company name (if applicable).
• Contact data: email address, phone number, postal address.
• Communication data: the content of messages, inquiries, project briefs, and any attachments you choose to send us.
• Commercial data: commission preferences, budget indications, project location, and delivery details.
• Technical data: IP address, browser type and version, operating system, device type, screen resolution, language settings, referring URL, time zone, and timestamps of visits.
• Usage data: pages visited, time spent on pages, scroll behavior, and interactions with forms or buttons.
• Cookie data: see our separate Cookies Policy for full details.

We do not knowingly collect special categories of personal data (e.g. health, biometric, political, religious data) and we do not collect data from children under the age of 16.

4. How We Collect Data

We collect personal data through the following channels:

• Directly from you — when you submit a contact form, request a quote, subscribe to the newsletter, email or call us.
• Automatically — through cookies, server logs, and analytics tools when you visit the website.
• From third parties — in rare cases, such as when a partner refers you to us with your prior consent.

5. Legal Basis for Processing (Article 6 GDPR)

We process your personal data only when at least one of the following legal grounds applies:

• Consent (Art. 6(1)(a)): for newsletter subscriptions and non-essential cookies.
• Performance of a contract (Art. 6(1)(b)): to prepare quotes, fulfill commissions, deliver submarines, and provide after-sales support.
• Legal obligation (Art. 6(1)(c)): to comply with Finnish accounting, tax, and consumer protection laws.
• Legitimate interests (Art. 6(1)(f)): to maintain website security, prevent fraud, improve our services, and respond to general inquiries — provided your rights and freedoms do not override these interests.

6. Purposes of Processing

We use your personal data exclusively for the following purposes:

• Responding to inquiries and providing quotations.
• Negotiating, executing, and fulfilling commission contracts.
• Delivering submarines and providing operational training and aftercare.
• Sending requested updates, build progress reports, and launch announcements.
• Maintaining accounting records and complying with statutory obligations.
• Improving the functionality, security, and content of our website.
• Defending or enforcing legal claims where necessary.

We do not engage in automated decision-making or profiling that produces legal effects on you.

7. Data Sharing and Recipients

We do not sell, rent, or trade your personal data. We may share data with the following carefully selected categories of recipients, all bound by contractual confidentiality and GDPR-compliant data processing agreements:

• Hosting and infrastructure providers (EU-based servers).
• Email and communication service providers.
• Analytics providers using anonymized or pseudonymized data.
• Accounting, tax, and legal advisors bound by professional secrecy.
• Logistics and delivery partners, only when required to deliver a submarine commission.
• Public authorities, where disclosure is required by Finnish or EU law.

8. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). If, in exceptional cases, data is transferred outside the EEA, we ensure that appropriate safeguards are in place under Articles 44–49 GDPR, such as Standard Contractual Clauses approved by the European Commission, or transfers to countries with an adequacy decision.

9. Data Retention

We retain personal data only as long as strictly necessary for the purposes for which it was collected, or as required by law:

• Contact form inquiries: up to 24 months after last contact.
• Newsletter subscriptions: until you unsubscribe.
• Commission and contract data: up to 10 years (Finnish Accounting Act, Kirjanpitolaki 1336/1997).
• Server logs: typically 6–12 months.
• Cookie data: as defined in our Cookies Policy.

Once retention periods expire, data is securely deleted or anonymized.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, loss, or destruction. These measures include encrypted connections (TLS/HTTPS), access controls, secure password management, regular backups, restricted physical access to our workshop systems, staff confidentiality obligations, and ongoing security reviews. In the unlikely event of a personal data breach affecting your rights and freedoms, we will notify both the Finnish Data Protection Ombudsman and the affected data subjects within 72 hours, in accordance with Articles 33–34 GDPR.

11. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15): obtain confirmation of and a copy of your data.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion in defined circumstances ("right to be forgotten").
• Right to restriction (Art. 18): limit processing in specific cases.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent (Art. 7): at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint: with the Finnish Data Protection Ombudsman (see Section 13).

To exercise any of these rights, please contact [email protected]. We may request reasonable proof of identity to prevent unauthorized requests.

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on this website. A detailed description of the cookies we use, their purposes, durations, and how to manage them is available in our Cookies Policy. Non-essential cookies are only set after you provide explicit consent through our cookie banner.

13. Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR or Finnish data protection law, you have the right to lodge a complaint with:

Tietosuojavaltuutetun toimisto
(Office of the Data Protection Ombudsman)
Lintulahdenkuja 4, 00530 Helsinki, Finland
PL 800, 00531 Helsinki
Phone: +358 29 566 6700
Website: tietosuoja.fi

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, our services, or our internal practices. The most current version will always be published at this URL with a revised "Last updated" date. For material changes, we will provide additional notice via email (where applicable) or a prominent notice on the website.

15. Jurisdiction

This Privacy Policy is governed by the laws of Finland. Any dispute arising from or in connection with this policy falls under the exclusive jurisdiction of Helsinki District Court (Helsingin käräjäoikeus), without prejudice to your right to lodge a complaint with the supervisory authority or to seek mandatory consumer protection remedies under Finnish law.

16. Contact

For all privacy-related questions, requests, or concerns:
Email: [email protected]
Phone: +358 46 921 7732
Post: Arctic Marine Fabrication Oy, Hietalahdenkatu 8, 00180 Helsinki, Finland.