Privacy notice
Last updated: 14 October 2026
1. Controller
Arctic Dragon Oy (auxiliary business name Nordic Signal Research)
Business ID (Y-tunnus): 3088334-2
Laivurinkatu 3 A 1, 92100 Raahe, Finland
Email: hello@nordicsignalresearch.fi
Privacy requests can also be sent to contact@nordicsignalresearch.fi.
2. What this notice covers
This notice explains how we process personal data under the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act when you visit nordicsignalresearch.fi, subscribe to the free Procurement Radar newsletter, buy a paid plan or report, or contact us.
3. Data we process
- Newsletter subscribers: email address, consent record (time, source), subscription status, and delivery and engagement data provided by the newsletter platform (e.g. bounces, unsubscribes, and whether an email was opened or a link clicked).
- Customers: name, email, company, billing country/address, VAT ID if provided, order and subscription details. Card and other payment details are handled by Stripe and are not received by us.
- Correspondence: the contents of messages you send us and our replies.
- Website: our own pages set no cookies, use no analytics or tracking, and load no third-party fonts (our fonts are self-hosted). Our hosting provider processes technical data (e.g. IP address, request logs) to deliver and secure the site.
4. Purposes and legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Sending the newsletter and measuring its delivery | Consent, Art. 6(1)(a); withdraw any time via the unsubscribe link |
| Selling and delivering paid plans and reports, customer support | Contract, Art. 6(1)(b) |
| Bookkeeping and tax records | Legal obligation, Art. 6(1)(c) (Finnish Accounting Act) |
| Website security and abuse prevention; answering business enquiries; informing existing customers about our related products | Legitimate interests, Art. 6(1)(f) |
5. Processors and recipients
- Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe affiliates) — payments, subscriptions and invoicing. Through Stripe Managed Payments, Stripe acts as reseller and merchant of record: it sells paid plans to you, collects payment and handles sales tax/VAT and invoicing, and is an independent controller for that data under the Stripe Privacy Policy.
- beehiiv (beehiiv, Inc., USA) — newsletter platform (subscriber list, email delivery). The signup form on our Procurement Radar page (/radar) is loaded from beehiiv (subscribe-forms.beehiiv.com) as a script and an embedded frame, so your browser connects to beehiiv when you view that page. Inside the form frame, beehiiv runs its own bot-protection and analytics services under its own privacy policy.
- Cloudflare (Cloudflare, Inc., USA) — website hosting, DNS and security.
- Proton (Proton AG, Switzerland) — business email.
International transfers. Stripe, beehiiv and Cloudflare may process data in the United States. For such transfers we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses included in the provider's data processing terms. Proton is based in Switzerland, which the European Commission recognises as providing an adequate level of data protection (adequacy decision).
We do not sell personal data and we do not use it for advertising profiling. Authorities receive data only where required by law.
6. Retention
- Newsletter data: until you unsubscribe; then removed within 30 days, except a minimal suppression record to honour the opt-out.
- Customer and accounting records: as required by the Finnish Accounting Act (generally 6 years after the end of the financial year for vouchers, 10 years for financial statements).
- Correspondence: up to 2 years after the matter is closed, unless needed longer for a legal claim.
- Hosting logs: according to Cloudflare's retention, typically short-term.
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing (including direct marketing at any time), to data portability, and to withdraw consent at any time without affecting prior processing. Contact us using the details above; we reply within one month. We do not make decisions with legal or similarly significant effect based solely on automated processing.
8. Right to lodge a complaint
You may lodge a complaint with the Finnish supervisory authority: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi, or with the supervisory authority of your EU country of residence or work.
9. Changes
We will update this notice when our processing changes and show the date of the latest version above.