1. Data Controller

Canales Nuclear & Civil Infrastructure Engineering Oy (CNCI)

Business ID: 3585719-4

Laitatuulenkaari 40

00850 Helsinki

Finland

Email: francisco.canales@cncinuclear.com

CNCI is responsible for the processing of personal data described in this Privacy Policy.

2. Personal Data We Collect

We may collect personal data when you contact us, submit a website form, communicate with us by email, or otherwise interact with CNCI.

This may include:

• name
• company or organisation
• email address
• telephone number
• job title or professional role
• information included in enquiries or messages
• correspondence relating to potential or existing assignments
• limited technical information generated through the use of our website

We aim to collect only information that is necessary for the relevant purpose.

3. Purposes of Processing

We process personal data for purposes including:

• responding to enquiries and contact requests
• discussing potential assignments and cooperation
• preparing proposals and contracts
• managing client and business relationships
• delivering engineering and consulting services
• maintaining professional and business correspondence
• fulfilling contractual and legal obligations
• maintaining the security and functionality of our website and information systems

We do not sell personal data.

4. Legal Basis for Processing

Depending on the situation, personal data may be processed because:

• processing is necessary to take steps before entering into or performing a contract;
• processing is necessary for CNCI's legitimate interests in conducting and developing its B2B engineering and consulting business;
• processing is necessary to comply with a legal obligation; or
• you have provided consent where consent is required.

These are among the lawful grounds recognised by Article 6 GDPR.

5. Contact Form

When you submit a contact form through our website, the information you provide is used to respond to your enquiry and, where relevant, to discuss potential services, projects or cooperation.

Information submitted through the contact form is not used for unrelated marketing purposes without an appropriate legal basis.

6. Service Providers

CNCI may use trusted service providers to support its business operations and information systems.

These may include, for example:

Odoo – website hosting, website functionality and contact-form processing.

Microsoft 365 – email, document management, collaboration and related business services.

Where these providers process personal data on behalf of CNCI, they act under applicable contractual and data-protection arrangements. Odoo identifies itself as a processor for customer data stored in Odoo Cloud, and Microsoft maintains a Data Protection Addendum governing processing under its online services.

7. Disclosure of Personal Data

Personal data is not disclosed to third parties except where necessary:

• to provide or administer our services;
• to use trusted IT, accounting, legal or other professional service providers;
• to fulfil contractual obligations;
• where disclosure is required by law or a competent authority; or
• where you have otherwise authorised the disclosure.

8. International Data Transfers

Some service providers may process data outside Finland or the European Economic Area.

Where personal data is transferred outside the EEA, CNCI will use the safeguards required by applicable data-protection legislation, such as an adequacy decision or appropriate contractual safeguards.

9. Data Retention

Personal data is retained only for as long as necessary for the purpose for which it was collected.

As a general principle:

• ordinary enquiries that do not result in a business relationship may be retained for up to 24 months after the last relevant contact;
• information relating to clients, contracts and assignments may be retained for the duration of the business relationship and afterwards where necessary for contractual, professional, legal or legitimate business purposes;
• accounting and other legally required records are retained for the periods required by applicable law.

Data that is no longer required will be deleted or anonymised where appropriate.

10. Data Security

CNCI applies appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

Access to personal data is limited to persons and service providers who require it for legitimate business purposes.

11. Your Rights

Subject to the conditions of applicable data-protection law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete information;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing;
• request data portability where applicable; and
• withdraw consent where processing is based on consent.

GDPR also gives individuals these rights generally, subject to the circumstances and legal basis of the particular processing.

To exercise your rights, contact:

francisco.canales@cncinuclear.com

We may need to verify your identity before fulfilling a request.

12. Right to Lodge a Complaint

If you believe that your personal data has been processed in violation of applicable data-protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Finland, the supervisory authority is the:

Office of the Data Protection Ombudsman

Finland

www.tietosuoja.fi

13. Cookies

Our website may use cookies and similar technologies necessary for its operation.

Where analytics, marketing or other non-essential cookies are introduced, information about their use and any required consent choices will be provided separately.

14. Changes to This Privacy Policy

CNCI may update this Privacy Policy as its services, systems or legal requirements develop.

The current version will always be available on this website.