PRIVACY POLICY – DEMO VERSION FOR APPROVAL. This draft incorporates NorthQ’s provisional retention and analytics decisions. Before publication, confirm supplier identities, agreements, processing locations, transfer safeguards, log/backup retention and the final anonymous-visitor cookie inventory. Document the legitimate-interest assessments and implement the deletion procedures. This text does not certify the current public website’s settings.
-
NorthQ AS, Norwegian company registration number 999 617 395, is responsible for the personal data described in this policy. Contact us at post@northq.no or +47 51 55 58 00. Visiting address: Kvernevik Ring 177B, 4048 Hafrsfjord, Norway.
-
When you contact us, we process your name, email address, enquiry type, service area and message. The form also lets you provide your company, telephone number, project/location and preferred start date. These additional fields are optional. We use the information to respond, clarify competence and project requirements, prepare quotations and follow up an agreed assignment. Enquiries are delivered to NorthQ’s receiving email address. Please do not send health information, identity documents or other sensitive personal information through the contact form.
Where you personally request steps necessary before entering a contract with us, the basis is GDPR Article 6(1)(b). For representatives of business customers and other professional enquiries, the basis is our legitimate interest in responding and maintaining business relationships, Article 6(1)(f), subject to a documented balancing assessment. Applicable mandatory record-keeping is based on Article 6(1)(c). Supplying the necessary contact details and message enables us to answer; without them we may be unable to handle the enquiry. Enquiries do not constitute consent to marketing.
-
Contact enquiries are normally retained for 12 months after the last relevant contact. We then delete personal data no longer needed. Longer retention requires a documented need, such as an unresolved matter or the establishment, exercise or defence of legal claims, or an applicable legal obligation. The reason and further retention period must be recorded and reviewed.
Customer and quotation documentation is retained according to the customer relationship, necessary follow-up and applicable documentation requirements. The 12-month enquiry rule does not override those requirements. Information no longer necessary must be deleted or anonymised. Access to retained material is restricted to people who need it for their work.
Security logs, email archives and backups have separate retention and deletion procedures. Backup copies may not disappear at the same time as live records. Their retention cycle, access controls and measures to avoid reintroducing previously deleted data on restoration must be documented before launch; the 12-month enquiry rule is not a verified backup-retention period.
-
The contact forms use Cloudflare Turnstile to reduce automated abuse. Cloudflare processes technical signals, including IP address and browser information. Verification is checked on the server, and submission requires successful verification. See Cloudflare’s Turnstile privacy information. The proposed basis for necessary security processing is our legitimate interest in protecting the service, Article 6(1)(f); necessity and proportionality must be documented.
NorthQ Form Guard limits repeated submissions using keyed hashes as counter identifiers. Its counter table does not store raw IP addresses, raw email addresses or message text. Counters expire within one hour; physical removal depends on the cleanup task running. This description concerns that counter table, not separate hosting, email or security logs. Hashing is a security measure and does not by itself make data anonymous.
-
The new website is planned without marketing cookies. Norwegian and English are available through the language selector. Necessary functionality, any storage of language preferences and security-related browser storage must be listed with purpose, provider and duration in the final cookie inventory. Technologies requiring consent must remain inactive until valid consent is given, with a way to refuse and withdraw it.
NorthQ has selected Google Search Console for monitoring search visibility and indexing. This is distinct from installing Google Analytics or a visitor-tracking tag. Search Console account access and verification remain to be arranged. Matomo is being assessed and is not authorised for installation at this stage. No visitor analytics will be introduced until its purposes, configuration, legal basis, consent requirements, retention and supplier arrangements have been assessed. Cookieless analytics does not automatically remove all privacy or consent requirements.
-
Authorised NorthQ personnel and suppliers providing hosting, email, maintenance, backup and anti-spam services may process relevant information for their tasks. Cloudflare is involved in Turnstile verification. Suppliers acting as processors must be covered by appropriate processing agreements and may only process information under the agreed instructions. Hjelseth provides hosting for NorthQ. The email provider, subprocessors, processing locations and retention periods must be confirmed in the final supplier schedule.
Processing or remote access outside the EEA must be assessed before use. Where relevant, NorthQ must verify an applicable adequacy decision or appropriate safeguards such as standard contractual clauses, together with any required supplementary measures. We do not claim that all processing takes place in Norway or the EEA. You may contact us for information about recipients and the applicable transfer safeguards. Editorial completion point: the final supplier and transfer schedule must be verified and reflected here before publication.
-
Depending on the legal basis and circumstances, you may request access, correction, deletion, restriction or portability of your personal data. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Contact post@northq.no; we may need proportionate identity checks to protect your information. You may complain to the Norwegian Data Protection Authority, Datatilsynet.
Draft updated: 22 October 2026. Effective publication date to be added after approval.