This Website Privacy Policy (the “Privacy Policy”) describes how Nordkeep s.r.o. (“Nordkeep”, “we”, “us” or “our”), acting as a data controller, handles personal data that we collect from and about you when you visit our website located at nordkeep.ai (the “Website”), engage with us through our newsletters, emails or branded social media accounts, or interact with us in person. It also describes the legal rights you may have and how you can exercise them.
This Privacy Policy applies to visitors of the Website only. It does not cover the processing of personal data in connection with the use of the Nordkeep compliance platform or any related services (the “Services”), which is governed by a separate agreement and privacy documentation made available to the relevant customer.
1. Who We Are
Nordkeep helps companies automate the validation of corporate documentation against applicable legislation and regulatory requirements. Our Services are provided exclusively on a business-to-business basis and are not intended for consumers.
Nordkeep is established in the European Union (the “EU”) and processes personal data on infrastructure located within the EU. We comply with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and other applicable laws governing the processing of personal data.
2. What Personal Data We Process
2.1 “Personal data” means any information relating to an identified or identifiable natural person, such as your name, email address, phone number or online identifiers.
2.2 Personal data you give us directly. We collect information you voluntarily provide to us, in particular when you:
(a) contact us or communicate with us (e.g. via a contact form, email, demo request or event): your first and last name, email address, phone number, organization, position or title, and any other information or content you choose to share with us;
(b) subscribe to our newsletter or marketing communications: your email address and, where provided, your name and organization.
2.3 Personal data we collect automatically. When you visit the Website, we automatically collect certain technical information, such as your IP address, browser type and settings, device identifiers, operating system, referral URLs, pages viewed and interaction data. Some of this information is collected through cookies and similar technologies, as further described in our Cookie Policy.
2.4 Personal data we collect from other sources. We may obtain information about you from other sources, such as another individual at your organization, our business partners, publicly available sources (e.g. company websites, professional networks), or third parties that help us update and analyze our records and inform our networking and marketing efforts.
3. How and Why We Use Personal Data
We process personal data for the following purposes and on the following legal bases:
3.1 Website delivery and operation (legitimate interest, Art. 6(1)(f) GDPR): to provide, maintain, operate, secure and improve the Website.
3.2 Communications and support (performance of a contract or steps prior to entering into a contract, Art. 6(1)(b) GDPR; legitimate interest, Art. 6(1)(f) GDPR): to respond to your requests, inquiries, comments and suggestions, including arranging product demonstrations. We keep this data for 2 years after your last interaction with us.
3.3 Analytics (consent, Art. 6(1)(a) GDPR, where required; otherwise legitimate interest, Art. 6(1)(f) GDPR): to monitor and analyze usage and trends in order to improve the Website and user experience. For this purpose we use PostHog (EU Cloud), with all analytics data hosted on servers located in the European Union. We keep this data for 2 years from its collection.
3.4 Marketing (consent, Art. 6(1)(a) GDPR; legitimate interest, Art. 6(1)(f) GDPR for existing business contacts): to send you newsletters and information about our products, offers and events we think may be of interest to you, and to further our networking and marketing strategies. We keep this data for 2 years after your last interaction with us, or until you withdraw your consent or object.
3.5 Security and compliance (legitimate interest, Art. 6(1)(f) GDPR; legal obligation, Art. 6(1)(c) GDPR): to detect, prevent and address technical issues and security threats, and to comply with our legal obligations. We keep this data for 2 years from collection, or longer if required by law.
3.6 Legal claims (legitimate interest, Art. 6(1)(f) GDPR): to establish, exercise or defend legal claims and enforce our agreements.
4. Sharing Your Personal Data
We do not sell or rent your personal data. We may share your personal data with third parties in the following circumstances:
4.1 Group companies: with any current or future parent, subsidiary or affiliate under common control with Nordkeep, for the purposes listed above.
4.2 Vendors and service providers: with vendors, consultants and service providers who need access to the data to perform services on our behalf, such as cloud hosting, analytics, email delivery and marketing tools. These parties act as our processors and are bound by data processing agreements.
4.3 Business transfers: with another company in connection with, or during negotiations of, any merger, acquisition, financing, reorganization or sale of all or a portion of our assets.
4.4 Legal requirements: where we believe disclosure is necessary to comply with a legal obligation, including lawful requests from public authorities, or to protect Nordkeep’s rights and property, the safety of our users, or to defend against legal liability.
5. International Data Transfers
Personal data we collect is primarily processed within the EU. Where we engage vendors or service providers established outside the European Economic Area, we ensure that appropriate safeguards are in place, relying on adequacy decisions of the European Commission or standard contractual clauses, together with supplementary measures where necessary.
6. Data Retention
We keep your personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, as required by law, or as necessary to resolve disputes and enforce our rights and agreements. The specific retention periods are set out in Section 3. Retention periods applicable to cookies and similar technologies are set out in our Cookie Policy.
7. Data Security
Taking into account the nature, scope, context and purposes of the processing, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. These measures include, without limitation, role-based access controls applying the principles of least privilege, encryption of data in transit and at rest, infrastructure security controls, security monitoring and incident response procedures, vulnerability management, and vendor security due diligence.
8. Your Data Protection Rights
8.1 Under the GDPR, you have the following rights regarding your personal data:
(a) Access: the right to request access to your personal data and information about how it is processed;
(b) Rectification: the right to request the correction of inaccurate or incomplete personal data;
(c) Erasure: the right to request the deletion of your personal data;
(d) Restriction: the right to request the restriction of processing of your personal data;
(e) Portability: the right to receive your personal data in a structured, commonly used and machine-readable format and to have it transferred to another controller;
(f) Objection: the right to object to processing based on legitimate interest, including profiling, and to object at any time to processing for direct marketing purposes;
(g) Withdrawal of consent: where processing is based on your consent, the right to withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal;
(h) Complaint: the right to lodge a complaint with a supervisory authority, in particular the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz), or the supervisory authority in the EU member state of your habitual residence or place of work.
8.2 You can opt out of receiving our promotional emails at any time by following the unsubscribe instructions in those emails or by contacting us at the email address below. If you opt out, we may still send you non-promotional emails, such as emails about changes to our legal terms.
8.3 To exercise any of these rights, please contact us at support@nordkeep.ai. We may need to verify your identity before responding to your request. We will respond without undue delay and in any event within one month, unless an extension is permitted by law.
8.4 Please note that we may retain certain personal data as necessary to comply with our legal obligations or for legitimate business purposes, such as to resolve disputes or enforce our agreements.
9. Children’s Privacy
The Website and our Services are intended for professionals and adults. We do not knowingly collect personal data from children. If you are a parent or legal guardian and believe your child under the age of 16 (or a lower age threshold where applicable) has provided us with personal data without your consent, please contact us at support@nordkeep.ai.
10. Third-Party Links
The Website may contain links to third-party websites, services and applications that are not operated or controlled by Nordkeep. This Privacy Policy does not apply to the privacy practices of those third parties, and we are not responsible for their practices or content. We encourage you to review the privacy policies of any third-party sites you visit.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any update is indicated by the date of the last revision at the top of this page. We will notify you of changes by posting the updated Privacy Policy on this page. If we make material changes, we may provide you with additional notice, such as posting a statement on our homepage or sending you an email notification if we have your email address on file.
12. Contact Us
Nordkeep s.r.o.
Email: support@nordkeep.ai