English
Last updated:
Privacy & Cookie Policy
This policy explains how NORDIOS ApS handles personal data when you visit nordios.com, contact us about our software services or use our client contact channels. It also explains the cookies and similar technologies used on this website. Our apps and other products may have their own privacy notices, which explain their particular data use.
1. Who is responsible for your data?
NORDIOS ApS is the data controller for the processing described here.
NORDIOS ApS · CVR 36475528Hjallesevej 95
DK-5230 Odense M, Denmark
Email: sales@nordios.com
2. What we collect, why and on what basis
Website operation and security
Our website and hosting services process technical information such as your IP address, browser and device details, requested pages, timestamps, error information and security events. We use this to deliver the site, diagnose faults, prevent fraud and abuse, and protect the site and accounts. Our legal basis is our legitimate interest in operating a reliable and secure service (GDPR Article 6(1)(f)). Necessary cookies are explained below.
Enquiries and business relationships
If you email us or contact us as a client, we receive the contact details, company information, message content and any attachments you provide. We use these to answer you, discuss projects, prepare proposals and manage our relationship. Processing necessary to enter into or perform a contract with you is based on Article 6(1)(b). When you act for a company, our basis is our legitimate interest in communicating with business contacts and delivering our services (Article 6(1)(f)). Accounting and other legally required records are processed under Article 6(1)(c).
Providing enquiry details is voluntary, but we may be unable to answer or provide a requested service without the relevant information. Please avoid sending sensitive personal information or passwords in an ordinary enquiry.
Optional website analytics
We use Google Analytics 4, including its WordPress integration, to understand visits, pages viewed, traffic sources, approximate location and interactions with our website. This can include pseudonymous cookie identifiers and browser/device information. Pseudonymous information can still be personal data. The legal basis for optional analytics and related cookies is your consent (Article 6(1)(a)); you can decline or withdraw it as explained below.
Our public website does not offer a newsletter, run competitions or take card payments. We do not use this site to make solely automated decisions with legal or similarly significant effects on you.
3. Cookies and your choices
Cookies are small pieces of information stored on your device. Similar technologies can also store or access device information. Some last only for your browsing session; others remain until they expire or you delete them.
Necessary technologies support security, login where relevant, and remembering your cookie preferences. They do not require cookie consent when strictly necessary for those purposes. Associated personal data is processed on the legitimate-interest basis described above. Analytics cookies are optional and require your permission.
Use the cookie banner to accept analytics, reject optional cookies or choose your preferences. You can continue to use the public website without accepting optional analytics. Reopen Cookie settings using the consent icon available on the website to change your choices or withdraw consent. Withdrawal does not affect processing lawfully carried out before withdrawal.
Cookie overview
Browser restrictions may shorten cookie lifetimes, and returning visits may refresh analytics cookies. Cookie lifetime is separate from how long reports or other data are retained. The cookie settings show the configured categories and cookie details.
Security and administration features may also use necessary cookies when triggered, including WordPress login/session cookies and Wordfence role-verification cookies. These support authorised login and attack prevention rather than marketing. WordPress login cookies normally last for the session or up to 2 days, or 14 days if “Remember me” is selected; Wordfence’s wfwaf-authcookie-* normally lasts 12 hours. They are not required simply to read the public site.
You can also delete or block cookies in your browser. This may reset saved choices or sign you out. To remove cookies already stored, use your browser’s website-data controls. See Google’s explanation of Analytics cookies.
4. Who receives personal data?
Access is limited to people and providers who need it for the relevant purpose. The website uses:
- Simply.com / team.blue Denmark A/S: website hosting and associated server logs. Simply.com states that its hosting servers and data are located in Denmark.
- Google Ireland Limited and relevant Google group companies: Google Analytics, when you allow optional analytics. See Google’s privacy policy and how Google uses data from partner sites.
- CookieYes: the WordPress consent tool that records and applies your choices.
- Wordfence (Defiant, Inc.) and Shield Security (Fernleaf Systems Limited): website protection, threat detection and security logging. Depending on the event and enabled service, security data such as IP addresses, requests and technical threat information may be processed by the relevant provider. See Wordfence’s privacy notice and Shield’s privacy information.
We also use providers for business email, administration and professional advice where needed to handle your enquiry or our client relationship. We may disclose relevant information to public authorities when legally required, or where necessary to establish, exercise or defend legal claims. We do not sell your personal data. External links, such as LinkedIn and our client portal, lead to services with their own functionality and privacy information.
5. Processing outside the EEA
Some providers, particularly Google and Wordfence/Defiant, operate internationally, including in the United States. Data may therefore be processed outside the European Economic Area. Transfers require a valid GDPR Chapter V mechanism: an applicable adequacy decision, including the EU–US Data Privacy Framework for a recipient whose active certification covers the transfer, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses with additional measures where required.
Google describes its certification and transfer arrangements in its data-transfer framework notice; Defiant describes its safeguards in the privacy notice linked above. Contact us for information about the safeguards relevant to your data or how to obtain a copy. A provider’s location or certification alone does not remove our responsibility to assess the transfer.
6. How long we keep data
- Enquiries: for as long as needed to respond, complete any agreed follow-up and resolve related matters. If an enquiry becomes a project, relevant correspondence becomes part of the client record. We assess continued need by the status of the enquiry, the relationship and any unresolved legal claim.
- Client and contractual records: for the relationship and afterwards where needed for contractual obligations, support, documentation or legal claims. Not all correspondence needs to be retained for the same period.
- Accounting material: normally 5 years from the end of the financial year it relates to, as required by Danish bookkeeping law.
- Hosting logs: Simply.com currently states a retention period of 3 weeks for customer website logs. Separate security records may be held for as long as needed to investigate and prevent attacks or document an incident.
- Analytics: user/event retention depends on the Analytics property’s configured retention controls; cookie expiry is listed above. Standard aggregated reports have separate retention behaviour. We retain identifiable information only for as long as needed for the stated measurement purpose and assess this against the need to compare website performance over time.
- Consent choices: the preference cookie lasts up to 1 year, unless deleted or replaced earlier. Information needed to demonstrate consent may be kept for the period necessary to document lawful processing.
Records may be retained longer where a specific legal obligation, dispute or security incident requires it. Backup copies follow the relevant backup cycle and access restrictions.
7. How we protect information
We use technical and organisational measures appropriate to the risks, including access controls, encrypted website connections, updates, backups and security monitoring. No internet service can guarantee absolute security.
8. Your rights and complaints
Subject to the conditions and exceptions in the GDPR, you can request access to your personal data, correction, erasure, restriction of processing and, where applicable, data portability. You can object to processing based on legitimate interests on grounds relating to your situation. You can always object to direct marketing and withdraw consent at any time.
Email sales@nordios.com to exercise your rights. We may ask for information reasonably necessary to verify your identity. We normally respond within one month; if a request is complex or there are several requests, the GDPR allows an extension of up to two further months, and we will explain this within the first month.
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, or to a competent supervisory authority where you live or work. You may contact us first, but doing so is not a condition of your right to complain.
9. Changes to this policy
We update this policy when our services, providers or legal requirements change. The date at the top shows the latest revision. Where a change requires fresh consent, an updated policy by itself does not replace that consent.