Privacy Notice

Privacy Notice

DCA Instruments Oy

Last updated: 2 September 2026

DCA Instruments Oy (“DCA”, “we”) respects the privacy of our clients, contacts and website visitors. This notice explains what personal data we collect, why we process it, how long we keep it, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Finnish law.

1. Who is responsible for your data

DCA Instruments Oy is the controller of the personal data described in this notice.

DCA Instruments Oy

Aerotie 6

FI-20360 Turku

Finland

Business ID: 0773956-1

For any question about your personal data, or to exercise your rights, contact privacy@dca.fi.

2. What personal data we collect

Depending on how you interact with us, we may process:

• Contact details — name, job title, organisation, email address, telephone number and postal address.
• Business contact details of professional contacts — name, role, organisation and business email address of people whose professional role relates to deposition, analytical and measurement instrumentation.
• Enquiry and communication data — your request or quotation enquiry and our correspondence with you, including meeting notes.
• Order and transaction data — orders, deliveries, billing and payment information, and related documentation.
• Newsletter and marketing data — your subscription status, communication preferences, and statistics on whether our emails were delivered, opened or clicked.
• Website data — technical and usage information collected through cookies and similar technologies, including analytics data.
• Recruitment data — job applications, CVs and related correspondence.

We do not intentionally collect special categories of personal data (such as health or trade union data), and we ask that you do not send such information to us.

3. Where we obtain your data

We obtain personal data:

• directly from you, when you use our website contact form, email us, request a quotation, place an order, subscribe to our newsletter, or apply for a job;
• from your employer or organisation, in the course of a business relationship;
• at trade fairs, conferences and industry events where you provided your business contact details or exchanged them with our representatives;
• from publicly available business sources, such as company websites, professional directories and public registers;
• from our other clients and business partners, where relevant to a request or project;
• automatically from your device, through cookies and similar technologies when you visit dca.fi.

4. Why we process personal data, and on what legal basis

We process personal data for the purposes below, on the legal bases stated.

Legitimate interest — GDPR Art. 6(1)(f)

• Managing and developing customer relationships, including responding to enquiries and maintaining contact with our clients and prospective clients.
• Developing our products and services, and understanding the needs of our market.
• Direct marketing to business contacts, including sending our newsletter to people whose professional role indicates an interest in deposition, analytical and measurement instrumentation. We consider it a legitimate interest of a business-to-business instrumentation supplier to inform relevant professionals about products and developments in their own field.
• Keeping our website secure and functional, and preventing misuse.
• Recruitment, in order to assess applications and take steps at the request of the applicant.

Where we rely on legitimate interest, we assess in advance whether our interest is outweighed by the rights and freedoms of the individuals concerned, and we act on any objection without delay. You can ask us for information about that assessment at privacy@dca.fi.

Consent — GDPR Art. 6(1)(a)

• Non-essential cookies, website analytics and marketing cookies.
• Electronic direct marketing in cases where Finnish law requires prior consent, in particular marketing addressed to a private individual rather than to a business, under Section 200 of the Act on Electronic Communications Services (917/2014).

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Performance of a contract — GDPR Art. 6(1)(b)

• Handling quotations, orders, deliveries and related customer service, and taking steps at your request before entering into a contract.

Legal obligation — GDPR Art. 6(1)(c)

• Invoicing, accounting, and statutory record-keeping, including obligations under the Finnish Accounting Act (1336/1997) and tax legislation.

5. Newsletter and direct marketing

We send a newsletter about our products, applications and events to business contacts in our field.

Why you may receive it. We send the newsletter on the basis of our legitimate interest in marketing to business contacts whose professional role relates to the instrumentation we supply. Where Finnish law requires consent instead — for example where the recipient is a private individual — we send it only with consent.

How to stop receiving it. Every newsletter contains an unsubscribe link. You can also write to newsletter@dca.fi or privacy@dca.fi at any time. You do not need to give a reason, and we will stop sending marketing messages to you. This applies whether the marketing is based on legitimate interest or consent.

What we record. We keep your contact details, your subscription and objection status, and delivery statistics such as whether a message was opened or a link clicked. We use these statistics to judge whether our newsletter is relevant, not to build detailed profiles of individuals.

If you object. We keep a minimal record of your email address on a suppression list so that we do not contact you again by mistake. We do not use that list for any other purpose.

6. Cookies and website analytics

We use cookies and similar technologies on dca.fi. Cookies that are strictly necessary for the website to function are set without consent. All other cookies are set only if you accept them, and you can decline or later change your choice at any time through our cookie settings.

Strictly necessary cookies. Required for the website to work and to transmit communications over the network. These cannot be switched off.

Statistical cookies. Used to understand how the website is used, so that we can improve it. Where this data is aggregated and cannot be used to identify you, it is used for statistical purposes only.

Marketing and third-party cookies. Set only with your consent:

• Google Analytics — website traffic and interaction reporting, used for improving the site and for marketing.
• YouTube — visitor information, privacy metadata and an identifier, set when videos embedded in our pages are played or a YouTube link is followed.
• LinkedIn — visitor identifier and privacy metadata, set when a LinkedIn link is followed. DCA does not receive data about individual LinkedIn users.

Declining or withdrawing consent to non-essential cookies may affect certain features of the website.

7. Who we share personal data with

We do not sell personal data.

We share personal data only where it is necessary for the purposes described in this notice, and only with:

• service providers acting on our behalf, such as our website host, email and newsletter platform, IT and support providers, and accounting services. These act as processors under written agreements and may use the data only on our instructions;
• logistics and delivery providers, where needed to fulfil an order;
• business partners and manufacturers we represent, where processing your quotation, order or technical request requires it;
• authorities, where we are required to disclose data by law, or where disclosure is necessary to protect the rights, property or safety of DCA, our website users or the public.

Access within DCA is limited to those employees and contractors who need the data for their duties.

8. Transfers outside the EU and EEA

Some of our service providers may process personal data outside the European Union and the European Economic Area. Where that happens, we apply an appropriate transfer mechanism required by data protection law, such as the European Commission’s standard contractual clauses or an adequacy decision, so that your data continues to receive an appropriate level of protection. You can ask us for details of the safeguards used at privacy@dca.fi.

9. How long we keep personal data

We keep personal data only as long as it is needed for the purpose it was collected for, or as required by law.

• Order and billing data — at least six years from the end of the accounting year, under the Finnish Accounting Act (1336/1997), Chapter 2, Section 10.
• Customer relationship data — for the duration of the relationship and for a reasonable period afterwards.
• Newsletter and marketing contact data — until you object or unsubscribe, or after three years without any engagement with our messages or contact with DCA, whichever comes first. Contact details on our suppression list are kept indefinitely so that we can honour your objection.
• Recruitment data — for the duration of the recruitment process and, unless you agree otherwise, for a maximum of one year afterwards.
• Website and analytics data — as set out in our cookie settings.

We review our other records at least every two years and delete personal data that is no longer required.

10. How we protect personal data

DCA treats all personal data as confidential. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure, including access controls, secured systems, and agreements with our service providers. Access is limited to those employees, contractors and service providers who need the data as part of their duties.

11. Personal data breaches

If a personal data breach occurs, we will notify the Finnish Data Protection Ombudsman without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Where a breach is likely to result in a high risk to you, we will also inform you without undue delay.

12. Your rights

Within the limits of applicable data protection law, you have the right to:

• Access the personal data we hold about you, and obtain a copy of it.
• Rectification — ask us to correct inaccurate data or complete incomplete data.
• Erasure — ask us to delete your personal data.
• Restriction — ask us to restrict processing in certain circumstances.
• Data portability — receive data you have provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Object to processing based on legitimate interest, on grounds relating to your particular situation.
• Object to direct marketing at any time. Where you object to direct marketing, we will always stop, and you do not need to give a reason.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email privacy@dca.fi or info@dca.fi. We may need to verify your identity before acting on a request. We respond within one month; if a request is complex we may extend this and will tell you if we do.

13. Complaints

If you believe we have processed your personal data unlawfully, we would like to hear from you first at privacy@dca.fi so that we can put it right.

You also have the right to lodge a complaint with the supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), which provides instructions at tietosuoja.fi.

14. Changes to this notice

We may update this notice as our website and operations develop. The current version is always published at dca.fi, with the date of the last update shown at the top. Where a change is significant, we will draw attention to it.

15. Contact

DCA Instruments Oy

Aerotie 6

FI-20360 Turku

Finland

Business ID: 0773956-1

Data protection enquiries: privacy@dca.fi

General enquiries: info@dca.fi

Newsletter: newsletter@dca.fi