Privacy Policy
NORDIC TECH SYSTEM is committed to transparency, robust data protection, and compliance with the General Data Protection Regulation (EU 2016/679) and European privacy frameworks.
Table of Contents
Data Protection Officer (DPO)
Direct privacy inquiries, subject access requests, or deletion queries:
Related Compliance Docs
1. Data Controller Information
The primary organization responsible for the processing of personal data under this Privacy Policy is:
Company: NORDIC TECH SYSTEM
Service Reach: Norway, Sweden, Denmark & Europe
Contact Email: solutions@nordictech.no
When our enterprise clients utilize our custom web applications, portals, or integrated business systems to process end-user data, NORDIC TECH SYSTEM operates strictly as a Data Processor under a formal Data Processing Agreement (DPA).
2. Information We Collect
We collect data strictly necessary to communicate, scope projects, deliver engineering solutions, and provide support:
A. Direct Inquiries & Technical Scoping — When submitting inquiry forms or contacting our team, we collect your name, business email, organization name, estimated project budget, and requirements.
B. Commercial Billing & Invoicing — For active projects, we record corporate VAT/registration numbers, billing addresses, signatory details, and payment confirmations.
C. System Telemetry & Error Monitoring — To maintain reliable uptime and performance, servers log aggregated response times, anonymized IP addresses, browser types, and error traces. No cross-site tracking profiles are created.
3. Legal Basis for Processing
Every processing operation conducted by Nordic Tech System is anchored in verified legal grounds:
- Contract Performance (Art. 6(1)(b)): Necessary to execute Statements of Work, deliver custom software milestones, host cloud servers, and provide SLA support.
- Legitimate Interests (Art. 6(1)(f)): Necessary to safeguard our network infrastructure against cyber threats, DDoS attacks, and unauthorized system access.
- Legal Obligation (Art. 6(1)(c)): Compliance with the Norwegian Bookkeeping Act (Bokføringsloven) and corporate taxation reporting.
- Consent (Art. 6(1)(a)): For optional email newsletters, where consent can be withdrawn instantly with one click.
4. Security & EU Storage
We adhere to rigorous European cybersecurity and privacy principles:
100% EU/EEA Data Residency — All data centers are located in Oslo (Norway), Stockholm (Sweden), and Frankfurt (Germany).
Military-Grade Encryption — AES-256 encryption at rest and TLS 1.3 in transit with automated key rotation.
Zero Third-Party Data Sales — We never monetize, broker, or transfer client personal data to third-party ad networks.
Isolated Sandboxes — Staging and production databases are strictly air-gapped with RBAC credential access.
5. Sub-processors & DPAs
To maintain scalable cloud infrastructure, we partner exclusively with verified Tier-3 infrastructure providers operating under strict DPAs:
Google Cloud Platform (GCP EU) — Server hosting, container orchestration, encrypted backup clusters (EU-West region).
Stripe Payments Europe Ltd. — PCI-DSS Level 1 compliant payment processing and invoice settlement.
6. Data Retention Policy
We hold personal data only for as long as necessary:
- Consultation Inquiries: Retained for 12 months after initial contact if no formal contract is entered.
- Active Client Project Records: Retained for the lifetime of the client SLA plus 5 years under Norwegian corporate record retention statutory laws (Bokføringsloven).
- System Telemetry Logs: Automatically purged after 90 rolling days.
7. Your GDPR Rights
As a data subject in the EU/EEA, you possess guaranteed legal rights:
Right to Access (Art. 15) — Request a full machine-readable copy of all personal records we hold concerning you.
Right to Rectification (Art. 16) — Correct any incomplete, outdated, or inaccurate personal information immediately.
Right to Erasure (Art. 17) — Request complete permanent deletion of your data where statutory retention permits.
Data Portability (Art. 20) — Receive your data in a structured, standard JSON/CSV format for transfer.
8. Contact DPO & Authorities
To exercise any of your rights or submit a privacy inquiry, reach out to our dedicated Data Protection team:
Data Protection Office — Nordic Tech System AS — Email: ops@nordictech.no • Response Time: < 48 hours
You also have the right to lodge a formal complaint with the Norwegian Data Protection Authority (Datatilsynet, Postboks 458 Sentrum, 0105 Oslo) or your national EU supervisory authority.