%20black%20logo%20text.webp)
Privacy Policy
1. Who we are
Kaada Nordic MarTech is a Norwegian sole proprietorship (enkeltpersonforetak) owned and run by Fredrik Asche Kaada. Organisation number 936 289 835. Address: Ytre Eiganesveien 13, 4022 Stavanger, Norway.
Privacy contact: Fredrik Asche Kaada, contact@nordicmartech.com, +47 46 500 745. We have not appointed a formal data protection officer; the privacy contact handles every request personally.
2. Our two roles
Controller. For the people this policy is about — website visitors, people who contact us, newsletter subscribers, business prospects, our clients' contact persons, investor and partner enquirers, and suppliers — we decide why and how personal data is used. This policy explains that processing.
Processor. When we deliver services on data a client gives us (for example Database Reactivation, chatbots and voice receptionists, Smart Pixel tracking or campaign platforms), we act only on that client's written instructions under a data processing agreement. The client is the controller, and the client's own privacy notice applies. If you received a message from one of our clients, contact that business first; we will help them answer you.
3. What we process, why, on what legal basis, and for how long
| Activity | Personal data | Purpose and legal basis (GDPR Art. 6) | Kept for |
|---|---|---|---|
| Enquiries and Free AI Audit requests (contact form, email, phone, WhatsApp) | Name, email, phone (if given), website, answers about goals, budget and tools, your message, the page you sent it from | Replying and preparing a proposal: steps at your request before a contract (6(1)(b)) and our legitimate interest in answering business enquiries (6(1)(f)) | 12 months after our last contact if no engagement follows |
| Visibility check before we reply | Public information about your business website | Making our first reply specific to you: legitimate interest (6(1)(f)) | With the enquiry |
| Competitor Snapshot orders | Email, your domain, the competitors you name, order and payment status (card details are handled by the payment provider, not by us) | Producing and sending the report: contract (6(1)(b)); accounting: legal obligation (6(1)(c)) | Order records 5 years (see accounting) |
| Client work | Names, roles and contact details of client contact persons, contracts, correspondence, meeting notes, deliverables | Delivering the contract (6(1)(b)); keeping records to handle questions or claims: legitimate interest (6(1)(f)) | 5 years after the end of the financial year in which the engagement ends (Norwegian bookkeeping law) |
| WhatsApp and direct messages | Your phone number or handle and the messages you send us | Replying and delivering the work you asked for: steps before a contract or the contract itself (6(1)(b)) and our legitimate interest (6(1)(f)) | 12 months after the project is completed, then deleted or moved into the client record |
| Invoicing and bookkeeping | Name, business details, invoices, payments | Legal obligation under Norwegian bookkeeping law (6(1)(c)) | 5 years after the end of the financial year |
| Newsletter | Email address, sign-up date and source, confirmation status | Sending the newsletter: your consent (6(1)(a)); proof of consent: legal obligation and legitimate interest | Until you unsubscribe; consent record kept up to 3 years after |
| Business prospecting | Name, role, company and business contact details from public sources (company websites, LinkedIn, Brønnøysundregistrene) | Finding business clients: legitimate interest (6(1)(f)). See section 5 for the rules we follow | 12 months without a reply; opt-outs kept on a suppression list so we never contact you again |
| Investor and partner interest register | Name, email, organisation, type of interest, your message | Keeping you informed about investment or partnership: your consent (6(1)(a)) | Enquiries: 6 months from receipt, or sooner if you withdraw consent. Where an NDA is signed: the NDA and due-diligence log for 3 years after the agreement ends |
| Website operation and security | IP address, browser and device data, server logs | Running a secure website: legitimate interest (6(1)(f)) | As set by the hosting provider, normally a short rolling period |
| Analytics and marketing cookies | Device identifiers, pages viewed, interactions | Understanding how the site is used: your consent (6(1)(a) and ekomloven) | See section 8 |
You do not have to give us personal data. Without a name and email we cannot reply to an enquiry, and without the details in a contract we cannot deliver it. Phone number is always optional.
4. Lead prioritisation
When you use the contact form, your answers on intent and budget are grouped automatically (for example "package enquiry" or "single service") so we can reply in the right order and with the right material. A person reads every enquiry. We make no decision with legal or similarly significant effect on you by automated means alone.
5. How we market our services
- We send marketing email or SMS to a named person only with their consent, or where there is an existing customer relationship and they have not opted out, as markedsføringsloven § 15 requires.
- A first approach to a business goes to a company address, through LinkedIn, by phone or by letter.
- Every marketing message tells you where we found your details and how to stop further messages. Opting out is free and takes effect at once.
- We do not buy consumer lists and we do not market to private individuals.
6. Who receives your data
We do not sell, rent or trade personal data. We share it only with the providers we need to run the business, each under a written data processing agreement, and with public authorities where the law requires it.
| Recipient | What they do for us | Where |
|---|---|---|
| Webflow, Inc. | Website hosting, content management and website forms | USA (EU-US Data Privacy Framework) |
| Google (Google Tag Manager, and analytics where you consent) | Loading the consent tool and, after consent, analytics tags | EU / USA (EU-US Data Privacy Framework) |
| CookieConfirm | Cookie consent banner and consent records | See section 7 |
| Kit (ConvertKit) | Sending the newsletter, double opt-in confirmation and unsubscribes | USA, see section 7 |
| ThriveCart | Checkout and order records for online purchases, including the Competitor Snapshot | USA, see section 7 |
| Report platform for the Competitor Snapshot | Running the Snapshot widget and delivering the report; named on request | See section 7 |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. and card payment providers | Online payments | Luxembourg / EEA |
| Amazon Web Services EMEA SARL | Email sending (Amazon SES) and file storage | Frankfurt and Ireland, EU |
| Hetzner Online GmbH | Servers for our automation workflows | Germany |
| Make and Zapier | Workflow automation for our own business processes (never used for Database Reactivation data) | EU / USA, see section 7 |
| Aiven | Managed database | Frankfurt, EU |
| Twilio Ireland Ltd | SMS and voice delivery | Ireland, EU, with transfers to the USA (Data Privacy Framework / Standard Contractual Clauses) |
| WhatsApp Ireland Ltd | WhatsApp messages you choose to send us | Ireland, with transfers to the USA (Data Privacy Framework) |
| OpenAI and Anthropic | AI processing in audits, content drafting and diagnostics, under business API terms that do not allow our data to be used for model training | USA (Data Privacy Framework / Standard Contractual Clauses) |
| Synthesys, VideoRemix or Higgsfield AI | Producing personalised AI video for client campaigns, as set in each campaign's agreement; presenters give written consent first | As stated in the campaign agreement |
| Specialist partners | Vetted subcontractors working on a specific client project, bound by confidentiality and data processing terms | EEA unless agreed otherwise |
| Fiken AS, our accountant and bank | Accounting software, bookkeeping and payments | Norway |
For client campaigns we may also connect the client's own CRM or email platform (for example HubSpot, Klaviyo, ActiveCampaign or HighLevel). Only the platform named in the client's signed agreement is used, as the client's processor.
Voice search in the FAQ is optional and uses your browser's built-in speech recognition. Your browser's provider (for example Google in Chrome or Apple in Safari) processes the audio under its own terms; Nordic MarTech receives only the resulting text in your browser and does not record, receive or store audio.
7. Transfers outside the EEA
Our delivery systems (servers, database, email sending) run in the EU. Some providers, or their support teams, are in the USA or other countries outside the EEA. We only use them where the transfer is covered by an EU adequacy decision (including the EU-US Data Privacy Framework for certified US companies) or by the EU Standard Contractual Clauses with any extra safeguards needed. For CookieConfirm, Kit, ThriveCart, Make, Zapier and the Snapshot platform, the safeguard in use is set out in our data processing register. You can ask for a copy of the relevant safeguard at any time.
8. Cookies and similar technology
Under the Norwegian Electronic Communications Act (ekomloven) we may only store or read information on your device without consent where it is strictly necessary for a service you asked for. Everything else waits for your consent.
| Category | What it is for | Consent needed |
|---|---|---|
| Strictly necessary | Remembering your cookie choice (CookieConfirm) and keeping the site secure and working | No |
| Analytics | Counting visits and seeing which pages help people, loaded through Google Tag Manager only after you accept | Yes |
| Marketing | Measuring campaigns, loaded only after you accept | Yes |
You can accept, reject or choose categories when you first visit, and change your mind at any time with the Cookie settings link at the bottom of every page. Rejecting is as easy as accepting. Ask us at any time for the current cookie-by-cookie list, with provider, purpose and lifetime.
9. Your rights
- Access — get a copy of the personal data we hold about you.
- Correction — have inaccurate data corrected.
- Erasure — have data deleted, unless we must keep it by law (for example accounting records).
- Restriction — have use of your data paused while a question is resolved.
- Objection — object to processing based on legitimate interest. You can always object to direct marketing, and we will stop.
- Portability — receive data you gave us, under consent or contract, in a machine-readable format.
- Withdraw consent — at any time, without affecting what was done before.
Email contact@nordicmartech.com. We reply within one month and may ask you to confirm your identity first. You can also complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no).
10. How we protect data
Access to personal data is limited to the owner and, for a specific project, the partner working on it. Our servers use full-disk encryption, and administrator accounts at our main providers are protected with hardware security keys. If a breach puts your data at risk, we notify Datatilsynet within 72 hours where required, and tell you when the law requires it.
11. Children
Our services are for businesses and are not directed at anyone under 18.
12. Changes to this policy
When we change this policy we update the version and date at the top. Earlier versions are available on request.
Contact
Questions about this policy: contact@nordicmartech.com or +47 46 500 745.
