Privacy

The controller for processing related to the marketing site, accounts and our own customer relationship is NordCapital. Contact: sales@nordcapital.ax.

When you as a customer enter data about your own customers, suppliers or employees into the Service, you (your company) are normally the controller for that Customer Data. NordCapital then acts as a processor under a separate DPA where required.

Depending on how you interact with us, we may process:

• Identity and contact details (name, company name, email, phone, address, business ID). • Account and user data (login, permissions, language and theme preferences). • Order and billing details for your subscription. • Communication content (messages via forms or email). • Technical data (IP address, device type, browser, logs, cookies and similar technologies). IP address is used briefly to look up country, region and city for website statistics and is not stored. • Usage data in the Service (e.g. feature calls and diagnostics), in anonymised or limited form where possible.

Please do not send sensitive personal data via open forms unless necessary.

We process personal data to:

• Provide, secure and improve the Service (contract / legitimate interest). • Handle orders, demo requests and customer support (contract / legitimate interest). • Invoice and meet bookkeeping and tax obligations (legal obligation). • Communicate about the Service, security and material term changes (contract / legitimate interest). • Send marketing where you have consented or where law allows – you may always object. • Analyse website use in aggregated form to improve content (legitimate interest). Measurement is cookieless: pages, time on page, referrer, device and approximate location (country/region/city). Part is collected in our own statistics, part via Umami (cloud.umami.is).

You need not provide more data than required for each purpose.

The website may use necessary browser storage for basic functions (e.g. theme). Language is controlled via the URL.

Visit statistics use no analytics cookies. Our own measurement uses a temporary session identifier in sessionStorage (cleared when the tab is closed) to measure time on page. Umami's script is also loaded from cloud.umami.is. No advertising profiling. You can opt out with Do Not Track in your browser.

You can control cookies in your browser settings. Blocking necessary storage may affect functionality.

We may share data with suppliers that help us run the Service, such as hosting, email, support tools, payment/invoicing services and Umami (cloud.umami.is) for website statistics. Such parties may only process data under our instructions and applicable agreements.

We do not sell personal data. Data may be disclosed if required by law, a court or authority, or to protect our or others' rights.

We aim to process personal data within the EU/EEA. If a transfer to a third country still occurs, we use lawful safeguards such as the European Commission's Standard Contractual Clauses and assess the need for supplementary measures.

We keep personal data only as long as needed for the purposes above, including the contract term and thereafter for as long as required by law (e.g. bookkeeping) or to establish, exercise or defend legal claims. Marketing website visit statistics are deleted after 13 months. Data is then deleted or anonymised.

We apply technical and organisational measures to protect personal data against unauthorised access, loss and alteration – including access control, encryption in transit where appropriate, and logging. No method is risk-free; we continuously improve our practices.

Under the conditions set by the GDPR, you have the right of access, rectification, erasure, restriction, data portability and objection to certain processing, and the right to withdraw consent without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).

For Customer Data where your company is the controller, data subjects should primarily contact you; we assist under the DPA.

The Service is aimed at businesses and adult users in a professional capacity. We do not knowingly collect personal data about children.

We may update this policy. The latest version is published on this page with an update date. For material changes we will provide appropriate notice.

Questions about privacy and personal data: sales@nordcapital.ax or via nordcapital.ax/kontakt.