Privacy policy

This policy explains which personal data Nordic Life Systems OÜ processes when you visit this website or contact us, for which purposes, on which legal basis, and which rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

We have not appointed a data protection officer, as we are not required to under Art. 37 GDPR. Questions about data protection go to the address above.

2. Hosting and server log files

This website runs on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The server is located in Germany. IONOS processes data on our behalf under a data processing agreement (Art. 28 GDPR).

When you open a page, the web server automatically records: your IP address, date and time of the request, the page requested, the referring page, browser type and version, operating system, the HTTP status code and the amount of data transferred. We need this data to deliver the website and to keep it secure and stable.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and error-free operation of the website).
• Retention: log files are deleted automatically after 14 days.

3. Contacting us

3.1 Brief form

If you send us a brief through the form, we process the data you enter: name, work email, company (optional), your message and the options you selected (format, market, volume, timing). The data is transmitted encrypted (TLS) to our server in Germany, stored there and forwarded to our business mailbox. For forwarding we may use a technical email delivery service that acts as our processor. If the direct transmission is not possible, your email program opens with the brief pre-filled; the message is then sent through your own email provider.

3.2 Email

If you write to us by email, we process your address, the content of your message and any attachments. Our mailboxes are operated with Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, which we obtain through GoDaddy. Microsoft processes the data as our processor.

3.3 WhatsApp

The “Chat with us” button opens a conversation with our WhatsApp Business account. WhatsApp is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you use it, WhatsApp processes your account data (including your phone number) and the chat content under Meta’s own terms and privacy policy; messages are end-to-end encrypted. We see your WhatsApp name, number and messages and use them only to answer you. Using WhatsApp is entirely optional; the form and email offer the same service.

• Legal basis for 3.1–3.3: Art. 6(1)(b) GDPR where your enquiry concerns a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Starting a WhatsApp chat is your own choice (Art. 6(1)(a) GDPR).
• Retention: enquiries that do not lead to a business relationship are deleted after 12 months. Where a business relationship follows, correspondence is kept as part of our commercial records for the statutory period (up to 7 years under the Estonian Accounting Act).

4. Cookies and local storage

We only store what is listed below. Necessary entries are used without consent because they are strictly required to provide the service you request (§ 25(2) no. 2 TDDDG, Art. 5(3) ePrivacy Directive). Analytics cookies are set only after you have agreed in the cookie banner.

You can change or withdraw your choice at any time via Cookie settings at the bottom of every page. Withdrawal takes effect for the future; Matomo cookies are then deleted.

5. Web analytics with Matomo

If you consent, we use Matomo, an open-source web analytics software. Matomo is installed on our own server at IONOS in Germany; no data is transmitted to the makers of Matomo or to any other third party.

Matomo processes: your IP address, shortened by two bytes before it is stored (e.g. 192.168.x.x), so that it can no longer be assigned to you; the approximate location derived from it (country, region, city); the pages you view, date, time and duration of your visit; the website, search engine or campaign that referred you; device type, operating system, browser, screen resolution and language; actions on our website such as sending the brief form, clicking WhatsApp or email, or switching the language; and a random visitor ID stored in a cookie so that repeat visits can be recognised.

We use this information to understand which content is useful to our visitors, to improve the website and to measure enquiries. We do not combine it with other data and do not try to identify you personally.

• Legal basis: your consent, Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
• Withdrawal: at any time via “Cookie settings”. Browsers that send a “Do Not Track” signal are not tracked.
• Retention: raw visit data is deleted after 14 months; after that only aggregated statistics without any personal reference remain.

6. Web fonts

All typefaces are served from our own server. No connection to Google or any other font provider is made when you view this website.

7. Recipients

We only share personal data with the processors named above: IONOS (hosting and analytics server), Microsoft (email), a technical email delivery service where one is used for the form, and WhatsApp/Meta only if you choose to chat with us. We do not sell data and do not pass it on to third parties for their own purposes.

8. Transfers outside the EU/EEA

Hosting, server logs, form data and analytics remain in Germany. Microsoft and Meta may process data in the United States. Microsoft Corporation and Meta Platforms, Inc. are certified under the EU–US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); in addition, the European Commission’s Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have data erased (Art. 17) or its processing restricted (Art. 18);
• receive data you provided in a structured, machine-readable format (Art. 20);
• withdraw any consent at any time with effect for the future (Art. 7(3));
• lodge a complaint with a supervisory authority (Art. 77). Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee. You may also contact the authority of your place of residence or work.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an email to c@nordiclifesystems.com is enough. We answer within one month.

10. No automated decision-making

We do not use your data for automated decisions or profiling within the meaning of Art. 22 GDPR.

11. Security

This website is served exclusively over encrypted connections (TLS/HTTPS). Access to enquiry data is restricted to the people who handle your request, and our server is kept up to date.

12. Children

This is a business-to-business website and is not directed at persons under 16. We do not knowingly process their data.

13. Changes

We update this policy when our processing changes. The current version and date are shown at the top.