Privacy Policy
This policy explains what personal data we process on norr3.fi, in our marketing channels, in our client work, in our business-to-business sales and in our research, why we process it, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Finnish Data Protection Act. The policy also covers data collected from marketing channels and email programs, data on business decision-makers, and research data collected through the panel of our research partner Norstat.
Updated: 11 October 2026
01Controller
NORR3 Oy (Business ID 2962074-8), Pursimiehenkatu 26 C, 3rd floor, FI-00150 Helsinki, Finland.
For any privacy matter, contact us at info(at)norr3.fi or +358 46 8100 118.
02What data we collect
Form data: the name, email address, phone number, company and message you give in our contact, campaign brief and booking forms, plus the details of your brief or booking.
Job applicant data: name, email address, phone number, the content of your application and any CV you attach.
Client and contact person data: name, role, work email and phone number, and correspondence relating to an engagement.
Business decision-maker data: name, job title, employer, work email and phone number, and the address of a public LinkedIn profile. See B2B decision-makers and business sales for details.
Technical data: IP address, browser and device information, site usage events, and analytics data collected via cookies.
Marketing channel data: enquiries, campaign events and leads coming from social media and search advertising channels (for example Meta, LinkedIn, TikTok and Google).
Email program data: recipient details for newsletters and email campaigns, plus open and click events.
Research data: survey answers and background data collected through the panel of our research partner Norstat and, with your consent, data on ad exposure. See Research and panel respondents for details.
03Purpose and legal basis
We process data to respond to enquiries, manage client relationships, deliver and develop our services, for communication and marketing, for business-to-business sales, for recruitment, and for media and advertising research.
The legal bases are a contract or its preparation (including handling job applications), legitimate interest (client and stakeholder communication, business sales and marketing to decision-makers, and improving the site), statutory obligations, and consent. Non-essential cookies, research data and its linking to ad exposure are based on consent.
We gather data from the site, marketing channels and email programs into one customer register (CRM) so that marketing, insight and sales share the same view of the customer. Research data is not added to the customer register.
04Cookies and tracking
We use cookies and similar technologies on the site. Necessary cookies keep the site running (for example your language choice and cookie consent), and they cannot be switched off.
Analytics cookies help us understand how the site is used. We use Google Tag Manager and Google Analytics 4 (the _ga and _gid cookies).
Marketing cookies are used only with your consent to target and measure advertising. On this site they are set by Google Ads conversion tracking, the LinkedIn Insight Tag, the Meta pixel and the Adform tracking pixel.
Embedded videos and posts on the site (for example YouTube and LinkedIn) load only when you click them. The service in question may then set its own cookies.
Non-essential cookies are set only when you accept them in the cookie notice. You can change or withdraw your consent at any time via the Cookie settings button in the site footer or by clearing your browser cookies.
You choose which cookies you allow. The cookie notice offers three equally easy options: accept all, reject all, or customise your choices (necessary, measurement, marketing and experience). Nothing is pre-selected for you.
For more about cookies and how we process data, contact info(at)norr3.fi.
05Research and panel respondents
We commission surveys, such as NØRR3 Media Insights, brand and consumer studies and campaign studies, in the online panel of the research company Norstat Finland Oy. Norstat collects the answers. Panel membership is covered by Norstat's own privacy policy.
Norstat gives us survey answers and background data, such as age group, gender, region and occupational status, with a permanent pseudonymous respondent ID. We do not receive your name or contact details and cannot identify you.
If you have consented in the Norstat panel to cookies being shared with NØRR3, we link to your respondent ID cookie- and device-identifier-based data on whether you have seen online ads we manage. The ads are served through, for example, Adform, Google Display & Video 360 and BidTheatre.
We also use the same respondent ID to link the answers you give in our different studies. We use the data to research media use, brands and advertising effectiveness. We do not use research data to target advertising at you.
We report only aggregate results to our clients, from which no individual respondent can be identified.
Processing of survey answers is based on the consent you give Norstat when you join the panel and answer a survey. Linking ad exposure is based on your separate cookie consent in the Norstat panel. You can withdraw consent at any time in the Norstat panel, after which we link no new data about you.
We keep research data in pseudonymous form for five years from collection and then delete it. Aggregate results from which no one can be identified may be kept longer.
Because we cannot identify respondents, requests about your rights are best sent to Norstat, which forwards them to us using your respondent ID. You can also contact us directly at info(at)norr3.fi.
06B2B decision-makers and business sales
For business-to-business sales and marketing we keep data on decision-makers at Finnish companies, such as marketing, sales, digital and managing directors. The data consists of name, job title, employer, work email and phone number, and the address of a public LinkedIn profile.
The data comes from public sources (for example company websites and the Finnish Patent and Registration Office's trade and business registers) and from the B2B data service Apollo.io. We do not collect consumers' contact details in this register.
We use the data to contact you about our services, to target advertising at groups of decision-makers, and to understand who in a company decides on marketing and media. We do not sell or disclose this data to our clients.
Processing is based on our legitimate interest in offering our services to businesses. We process only data relating to your work role. You can object at any time by writing to info(at)norr3.fi or replying to our message; we will then stop contacting you and delete your data or add you to our suppression list.
We update the data at least once a year and delete it when the person no longer holds the role or when the data has not been updated for 24 months.
07Disclosure and processors
We do not sell personal data. We use trusted service providers for hosting, email, the customer register, analytics, data storage and media buying, for example. They process data on our behalf and only under our instructions.
Our research partner is Norstat Finland Oy, which collects survey answers from its panel and delivers them to us.
We obtain and update business decision-maker data through the B2B data service Apollo.io (Apollo.io, Inc., United States).
The site's campaign brief assistant and idea field send the text you type to an AI service to generate a suggestion. Text typed in the idea field and the reply are also stored by us. Please do not enter personal data in them.
Data may be transferred outside the EU or EEA only where an appropriate safeguard is in place, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
08Retention
We keep data only for as long as the purpose requires or the law demands.
Contact, brief and booking form data is generally deleted within 24 months if the enquiry does not lead to a client relationship.
Client and contact person data is kept for the duration of the client relationship and thereafter for as long as accounting and other legislation requires.
Business decision-maker data is deleted when the person no longer holds the role or when the data has not been updated for 24 months (see B2B decision-makers and business sales).
Job applications and CVs are deleted within 12 months of the end of the recruitment, unless the applicant has agreed to longer retention.
Research data is kept for five years from collection (see Research and panel respondents).
09Your rights
You have the right to access your data, request its rectification or erasure, restrict or object to processing, port your data to another system, and withdraw consent you have given.
Send requests to info(at)norr3.fi. For survey respondents, see also Research and panel respondents. If you believe we have processed your data unlawfully, you may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
10Security
We protect data with appropriate technical and organisational measures: access is limited by role, connections are encrypted, and system use is monitored. Research data is stored separately from the customer register.
11Changes
We develop our services continuously, so we may update this policy. We will announce significant changes on our site, and the current version is always available on this page.
See also